Windows EVTX log analysis for DFIR — fast parsing, ATT&CK mapping, IOC extraction, and Sentinel anomaly detection. Normal + Juggernaut Mode (Arrow/DuckDB) for 10M+ events.

A simple System monitor(Sysmon) EVTX inspector; search, visualize, and track Sysmon events

This is a PySimpleGUI-based Python software tool for processing and visualising selected Windows Event Security.evtx log files that meet a condition in Event ID 4688.

Advanced PowerShell DFIR module for forensic analysis, threat hunting, and cmdline investigation in Windows.

A python 3 script to extract and re-create Powershell script block from windows event logs(evtx).

Windows 安全排查轻量工具，集成 Sysmon 管理、事件监控、攻击链分析与取证快照

Covert folder containing windows event logs (*.evtx) to sorted timeline csv files for easy processing and analysis.

AI-assisted SOC analysis pipeline with deterministic guardrails, evidence-first reporting, and multi-source security log ingestion.