OFFLINE · SECURITY ANALYSIS LAB

Windows Event Log Triage

Evidence before assumptions. Explore Windows activity without uploading your logs.

1 / Load a capture

Authorized educational analysis only. All processing stays in this tab; nothing is stored or sent.

Or drop a CSV here.

Choose a fictional demo or a CSV.

2 / Capture overview

The investigation count includes each event referenced by a finding once, even when findings overlap. It is not a risk score. Counts continue to describe the full capture when you filter the explorer.

Event ID breakdown

Top failed-logon accounts

3 / Findings

4 / Event explorer

Trustworthy timeline

The timeline orders only valid ISO timestamps with an explicit timezone. Events with missing or locale-formatted timestamps remain visible in the explorer without an assumed chronological position.

    Analyst workflow

    1. Confirm authorization and export scope.
    2. Check audit policy, channel, hosts, and capture coverage.
    3. Inspect parsing and timestamp caveats.
    4. Compare failed and successful logons by target account/domain.
    5. Check source IP, host, workstation and logon type.
    6. Validate account creation and member-to-group identity against approvals.
    7. Review log clearing, processes, scripts and services in context.
    8. Document evidence, benign alternatives, missing logs and next steps.

    Preparing a Windows export

    On an authorized Windows computer, select the required events and date scope before exporting CSV. Keep the original EVTX logs for follow-up. Include Event ID and, where possible, structured actor, target, member, domain and SID fields, with ISO timestamps carrying an explicit timezone. Security events, System service-installation events and PowerShell operational events may require separate exports. This tool does not parse EVTX files or provide a configurable analysis window.

    The Windows export instructions have not been tested on Windows. Event Viewer exports can omit structured fields or use localized headers and timestamps, so check the resulting CSV before relying on its findings.

    Event learning guide

    Audit configuration, retention and export scope determine which events are available. Missing events therefore do not establish that an activity did not occur. Use findings as leads for review in the original logs and operational context, rather than as a substitute for SIEM monitoring or an investigation.