#eventlogs — Public Fediverse posts

----------------

🛠️ Tool
===================

Opening: Tool purpose and capabilities overview

EventLogExpert is a Windows-focused Event Log viewer designed for technical support, IT professionals, and DFIR practitioners. The project emphasizes performance with the ability to load very large .evtx files, support multiple concurrent files, and present an interleaved combined view that helps correlate events across servers.

Key Features

• Fast bulk loading of large .evtx files and concurrent multi-file handling.

• Interleaved combined view for correlating events from multiple hosts in a single timeline.

• Inline event description previews within the table to reduce the need for opening individual records.

• Friendly UI filters via drop-downs and an Advanced Filter option that accepts LINQ expressions for precise querying.

• Ability to create an event database to enable viewing of product-specific logs (for example, Exchange or SQL Server logs) on machines that lack those products.

• Live log viewing mode that functions as a usable replacement for Event Viewer by continuously updating and showing new events in real time.

Technical Implementation (conceptual)

The tool centers on efficient parsing and indexing of .evtx files to support rapid random access and merged timelines. The combined view implies an internal timestamp-based merging mechanism and a lightweight local database capability for normalized event storage and cross-host lookups. The Advanced Filter accepting LINQ suggests .NET-based expression parsing and runtime filtering against in-memory or on-disk event objects.

Use Cases

• Incident responders correlating events across multiple servers to reconstruct timelines.

• Support engineers examining large exported log archives without waiting for slow viewers.

• Administrators wanting a lightweight alternative to Event Viewer with richer filtering and preview capabilities.

Limitations and Considerations

• The project distributes as a Windows package (.msix) and targets Windows 10/11 and Server; runtime requirements and auto-update behavior may vary by OS version.

• Creating and using an event database is useful for portability but may require storage and maintenance considerations depending on scale.

Hashtags

🔹 tool #evtx #eventlogs #forensics

🔗 Source: https://github.com/microsoft/EventLogExpert

Windows Event Logs - I have just completed this room! Check it out: https://tryhackme.com/room/windowseventlogs #tryhackme #eventlogs #wevtutil #get-winevent #eventviewer #windowseventlogs via @RealTryHackMe

Windows Event Logs - I have just completed this room! Check it out: https://tryhackme.com/room/windowseventlogs #tryhackme #eventlogs #wevtutil #get-winevent #eventviewer #windowseventlogs via @RealTryHackMe

Windows Event Logs - I have just completed this room! Check it out: https://tryhackme.com/room/windowseventlogs #tryhackme #eventlogs #wevtutil #get-winevent #eventviewer #windowseventlogs via @RealTryHackMe

Windows Event Logs - I have just completed this room! Check it out: https://tryhackme.com/room/windowseventlogs #tryhackme #eventlogs #wevtutil #get-winevent #eventviewer #windowseventlogs via @RealTryHackMe

Got #PowerShell 7 and not seeing event logs in your triage? N.B. for PowerShell 7: Windows PowerShell logs events to "Microsoft-Windows-PowerShell/Operational"), but PowerShell 7 now logs events to "PowerShellCore/Operational." Detailed (e.g., Script Block) logging is NOT enabled by default.

PowerShell 7 includes Group Policy templates and an installation script in $PSHOME. Specifically, you can use the "RegisterManifest.ps1" and "InstallPSCorePolicyDefinitions.ps1" scripts in the PS7 installation directory to enable logging.

Also, ISE doesn't support PS7 :( --> but there is an official Visual Studio Code extension that does, and it even has an "ISE Mode."

H/T Nasreddine Bencherchali ( @[email protected] ): https://twitter.com/nas_bench/status/1616211194934882304

I also consulted https://learn.microsoft.com/en-us/powershell/scripting/whats-new/migrating-from-windows-powershell-51-to-powershell-7?view=powershell-7.3

#PowerShell7 #DFIR #eventlogs #logging #artifacts

I have this long-term #project of applying #DifferentiableComputing and #DeepLearning to #industrial #AnomalyDetection.

I have created a #simulation of a #FlexibleManufacturingSystem for benchmarking on #uncorrelated #ProcessTraces, or #interlaced #EventLogs, and have some approaches to solve this under work.

If you're interested in this from the perspective of research, collaboration, investment or just general curiosity, please let's get in touch!