#eventsight — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #eventsight, aggregated by home.social.
-
🛠️ Tool
===================Opening: EventSight is an AI-powered toolkit for Windows Event Log analysis composed of two linked projects: a standalone Eventsight CLI and an Eventsight-MCP server for Claude Code integration. The repository centralizes analyst feedback and correlation rules in a shared learnings database to improve semantic retrieval over time.
Key Features:
• EVTX parsing and batch analysis for Security event sets with streaming output and report generation in HTML/Markdown.
• Continuous monitoring mode with a live HTML dashboard that auto-refreshes to present ongoing findings.
• Shared learnings database containing learnings.db, events.db, embeddings.npy, and event_embeddings.npy to persist analyst teachings, correlation rules, and indexed event vectors.
• Two RAG modalities: Standard RAG for deterministic lookup and fast vector similarity; Agentic RAG via Eventsight-MCP that uses Claude Code to interpret natural-language feedback and orchestrate tools.
• MCP toolset: A collection of 16 MCP tools exposed by Eventsight-MCP to enable programmatic analysis, semantic event search, feedback ingestion, and export/import of learnings.Technical Implementation (conceptual):
• Data layer: Persistent SQLite-like databases (analyst learnings, stored events) plus 384-dimensional embeddings stored in embeddings.npy and event_embeddings.npy for semantic search and similarity scoring.
• Retrieval modes: Standard RAG performs embedding→similarity search→Top-K retrieval with an O(1) Event ID path when available. Agentic RAG routes natural-language input to an LLM (Claude) which selects and composes MCP tools to perform searches, create learnings, or mark findings.
• Integration: Eventsight-MCP exposes tools to Claude Code, enabling analyst-style commands via natural language such as marking findings benign or generating generalized learnings.Use Cases:
• Forensic analysts processing bulk EVTX files and producing reproducible HTML reports.
• SOC teams that want a feedback loop: analyst corrections persist as learnings and improve subsequent semantic searches.
• Interactive investigation workflows where an LLM coordinates multiple analysis tools and refines correlation rules.Limitations and Considerations:
• The toolset targets Windows Event Log formats (EVTX) and relies on embeddings and an LLM for Agentic RAG behaviors.
• Shared learnings imply a data consolidation point; operational controls around data governance and model inputs may be required in production deployments.
• Deterministic Standard RAG is suited to batch, reproducible analysis while Agentic RAG favors conversational, generalized learning creation.References / Artifacts:
• Notable files: learnings.db, events.db, embeddings.npy, event_embeddings.npy, Eventsight and Eventsight-MCP components.