03 / CASE STUDY
Windows event analysis
Review Windows activity without confusing who acted and which account was affected.
Open offline demo →I defined the project goals and reviewed the results. AI agents assisted with implementation and ran the automated tests.
Challenge
Help a learner or junior analyst review Windows activity while keeping the person performing an action, the affected account and an added group member distinct. Confusing those roles can connect unrelated events.
Environment
The offline HTML, CSS and JavaScript analyzer accepts Windows-event comma-separated values (CSV) exports up to 10 MiB and 50,000 rows. Fictional examples include explicit identity fields and timestamps with timezones so event order can be checked.
Built
The application provides an event learning guide, findings linked to evidence rows, a dashboard, filters and a timeline. Rules identify repeated login failures, failures followed by success, account creation, privileged group membership, audit-log clearing and service installation for review.
Tested
AI-executed automated tests cover accounts with the same name in different domains, actor/member confusion, unavailable security identifiers, reversed or ambiguous times and preservation of event details. Real-browser checks exercise fictional examples, file import and demo navigation at desktop and mobile widths.
Concepts
A Windows security identifier (SID) identifies an account or group. The tool prefers valid SID matches when linking a created account to an added member; conflicting valid SIDs cannot be overridden by matching names. The placeholder S-1-0-0 is treated as unavailable, not as a shared identity. Sequence rules also require timestamps that establish a reliable order.
Outcomes
The password-guessing example has six events and two findings. The account-persistence example has two events and three overlapping findings because one event can support several rules. A reviewer can trace those findings back to their rows in the offline demo, rather than rely on an unexplained risk score.
Takeaways
Names alone are weak evidence for linking events. Keeping identity roles separate and leaving missing identity or ambiguous times unknown is relevant to careful log review and escalation.
Limitations
This tool reads exported CSV files rather than native Windows event-log files (EVTX). Relationships depend on the identities and timestamps preserved in the export, and the analysis window is not user-configurable. Missing records or ambiguous times can prevent a reliable sequence. PowerShell activity and service installations require operational context; they do not prove malicious behavior. Findings need follow-up in the original logs and relevant records. The tool does not query Active Directory, the Windows directory service, or perform forensic analysis.