evtx

Evtx Log (xml) Browser

Triaging Windows event logs based on SANS Poster

Bulk-run Hayabusa across a folder of KAPE collections, one run per host, with per-host reports and a cross-host triage dashboard

Powershell scripts

Read-only Windows first-response evidence collection with offline reporting and SHA-256 integrity verification.

Advanced Windows Event Log threat hunter in pure PowerShell — Sigma-subset detection, correlation engine, per-entity risk scoring, self-contained HTML reports. Zero dependencies, air-gap ready.

Windows Active Directory event (Evtx) collection script for scaled up forensic investigations.

Windows Events Attack Samples

Takes Windows event log timeline in CSV format and export all the user sessions in separate CSV timelines.

Covert folder containing windows event logs (*.evtx) to sorted timeline csv files for easy processing and analysis.

Single-file PowerShell Incident Response and DFIR triage collector for Windows. Gathers high-value forensic artifacts into one timestamped, hashed, packaged output. Defensive and authorized use only.