EVTX parser — Windows Event Log viewer in your browser
Drop a Windows .evtx event log. Parsing runs entirely in your browser via WebAssembly — nothing is uploaded.
How to get your .evtx files
Never pulled event logs off a Windows machine? Pick the first method that works for you — it takes a minute.
- Collect the .evtx files
- Drop them here (several at once is fine)
- Everything stays in your browser
Run as administrator on the Windows host (right-click PowerShell or Command Prompt → Run as administrator). Reading the Security log needs admin rights.
Export the key logs in one go
New-Item -ItemType Directory -Force C:\triage | Out-Null; foreach ($c in 'Security','System','Application','Microsoft-Windows-PowerShell/Operational','Microsoft-Windows-Sysmon/Operational') { wevtutil epl $c "C:\triage\$($c -replace '/','%4').evtx" /ow:true }Writes Security, System, Application, PowerShell and Sysmon logs to C:\triage\. A log that doesn't exist on the host (e.g. Sysmon not installed) just prints an error — ignore it. Then drop the files from C:\triage\ here.
Just the Security log
mkdir C:\triage 2>nul & wevtutil epl Security C:\triage\Security.evtx /ow:trueNo command line? Use Event Viewer
Run eventvwr.msc → Windows Logs → right-click Security (or any log) → Save All Events As… → keep the type Event Files (*.evtx) → Save.
Run as administrator. KAPE and Velociraptor are separate free downloads from their official project pages. They also grab the archived Archive-*.evtx files that an export skips.
KAPE — EventLogs target
kape.exe --tsource C: --target EventLogs --tdest C:\triageCopies every .evtx from winevt\Logs under C:\triage\, keeping the original folder structure. Open that Logs folder, select all the .evtx files and drop them here.
Velociraptor — offline collector
In the Velociraptor GUI: Server Artifacts → Build offline collector → select Windows.Triage.Targets (from the Velociraptor Triage project) → tick the EventLogs target → build, then run the collector on the host as administrator. It writes a collection ZIP. Unzip it first — the .evtx files sit under the winevt/Logs folder inside.
Older Velociraptor releases — command line
mkdir C:\triage 2>nul & velociraptor.exe artifacts collect Windows.KapeFiles.Targets --args EventLogs=Y --output C:\triage\evtx.zipOnly for releases that still ship Windows.KapeFiles.Targets, the former name of the triage artifact. Collects its EventLogs target into C:\triage\evtx.zip; use your Velociraptor binary's file name. Unzip it first — the .evtx files sit under the winevt/Logs folder inside.
Already have an E01/raw image or a copy of the drive? Pull the files from \Windows\System32\winevt\Logs\ of the Windows partition — no admin rights or live host needed.
FTK Imager
File → Add Evidence Item → Image File → browse to [root]\Windows\System32\winevt\Logs → select the .evtx files → right-click → Export Files.
Mounted image (Linux / macOS)
mkdir -p ~/triage && cp /mnt/win/Windows/System32/winevt/Logs/*.evtx ~/triage/Assumes the Windows partition is mounted read-only at /mnt/win (e.g. ewfmount + mount -o ro, or Arsenal Image Mounter on Windows) — adjust the path to your mount point.
Every event log channel is its own .evtx file in one folder (Windows Vista / Server 2008 and later):
C:\Windows\System32\winevt\Logs\- Main files:
Security.evtx,System.evtx,Application.evtx;/in a channel name becomes%4, e.g.Microsoft-Windows-Sysmon%4Operational.evtx. Each file is self-contained — no companion files needed. Drop several and they are merged into one timeline. - Rotated logs are kept next to them as
Archive-Security-<timestamp>.evtxwhen auto-backup is on — drop them too.
Log moved elsewhere? Check its real path (logFileName)
wevtutil gl SecurityGotchas
- A plain copy of a live log fails because Windows keeps it open — use one of the methods above, not Explorer or
copy. - Logs are circular: when full, the oldest events are overwritten (the default size is often just 20 MB). Collect early, and grab
Archive-*.evtxtoo —wevtutil eplexports only the active log. - Drop .evtx files, not a .zip or a folder: unzip first, then select all the .evtx files. Times are shown in UTC by default (toggle to local time in the viewer).
- Security
- System
- Sysmon
- PowerShell
- RDP
- Defender
- Task Scheduler
- WMI
- Application
What is an EVTX file?
An .evtx file is a Windows Event Log — the binary format Windows has used since Vista to record security, system and application events. They live in C:\Windows\System32\winevt\Logs (Security.evtx, System.evtx, Application.evtx…) and are not plain text, so Notepad can't read them. Drop one above to view it. Full guide to the EVTX format →
From raw .evtx to findings in minutes
Everything a DFIR analyst reaches for, without installing Event Viewer, Python or a SIEM.
Hunts and Sigma rules on open
86 built-in hunts plus 2395 SigmaHQ Sigma rules — Kerberoasting, log clearing, PowerShell cradles, new services, brute force — run the moment a file loads.
A query language analysts expect
Field:value, wildcards, quotes and negation across every EventData field, with instant facets and rare-value sorting.
One-click pivots
Jump from any event to the same logon ID, process GUID, parent process or a ±5 minute window.
Logon sessions, reconstructed
Who logged on, how, from where, with which privileges and what they did — 4624 to 4634, one row per session.
Notes and a Markdown report
Bookmark events, annotate them and export a clean report, or share a filtered view as a link.
Offline and open source
Runs air-gapped in Docker, Elastic License 2.0, Rust parser you can audit on GitHub.
$ docker run --rm -p 3000:3000 evtx-parser
- built-in hunt rules
- 86
- bytes uploaded
- 0
- parser, compiled to WebAssembly
- Rust
- languages
- 8
Where to find .evtx files
On the source host each event log channel is its own .evtx file, all in one folder. Paths assume the default Windows folder, C:\Windows (%SystemRoot%).
- Logs folder — all channelsWindows Vista / Server 2008+
C:\Windows\System32\winevt\Logs\ - Security
C:\Windows\System32\winevt\Logs\Security.evtx - System
C:\Windows\System32\winevt\Logs\System.evtx - Application
C:\Windows\System32\winevt\Logs\Application.evtx - Sysmon
C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx - PowerShell (4103/4104)
C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx - Windows PowerShell (400/600/800)
C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx - RDP — LocalSessionManager
C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx - RDP — RemoteConnectionManager
C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx - Task Scheduler
C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx - Defender
C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx - Archived logs (Archive-<channel>-<timestamp>.evtx, if auto-backup is on)
C:\Windows\System32\winevt\Logs\Archive-Security-*.evtx - Legacy .evt (also AppEvent.Evt, SysEvent.Evt) — not supported hereWindows XP / Server 2003
C:\Windows\System32\config\SecEvent.Evt
How to get it
- The EventLog service keeps live logs open, so a plain copy fails. From an admin shell,
wevtutil epl Security C:\triage\Security.evtxexports a clean copy (active log only — Archive-* files are skipped). - To grab the whole folder as-is: KAPE (
--target EventLogs), FTK Imager or RawCopy — or read it offline from a mounted E01 image or a Volume Shadow Copy. - Each .evtx is self-contained, no companion files needed. Channels can be redirected: confirm the real path with
wevtutil gl <channel>(logFileName).
Featured guides
- Windows Event ID Cheat Sheet (Security, Sysmon, PowerShell)Windows Event ID cheat sheet for DFIR and threat hunting: the Security, System, Sysmon and PowerShell IDs that matter, grouped by attack phase, each with a one-line meaning.
- Event ID 4624 explained: Windows successful logon and LogonType referenceWhat a 4624 record actually contains, why the LogonType field matters more than the event itself, and how to read them at scale.
- Event ID 4688: A new process has been created (command line)Event ID 4688 logs every process creation in the Security log. How to enable command-line auditing, the fields that matter, how it compares to Sysmon Event ID 1, and triage patterns.
- Event ID 4769: Kerberos service tickets and kerberoastingEvent ID 4769: A Kerberos service ticket was requested. Which fields reveal kerberoasting (RC4 0x17 tickets), how to separate it from normal TGS noise, and how it pairs with 4768.
A free online EVTX viewer that runs in your browser
EVTX parser is an online EVTX viewer and Windows Event Log parser. Open a .evtx file — Security.evtx, System.evtx, Application.evtx, Sysmon or PowerShell channels — and read every record without Event Viewer, without installing anything, and without a Windows host.
Parsing runs entirely client-side via a Rust parser compiled to WebAssembly, so your logs never leave the browser. Filter by Event ID, provider, channel or time, inspect the raw event XML, and export the results to CSV, JSON or XML in a couple of clicks. You can now open several .evtx files at once and triage them in one combined view.
Keep reading:EVTX to XMLEVTX to CSVEVTX to TXTEVTX to JSONEVTX on Mac & Linuxevtx_dump onlineOpen Security.evtxOpen System.evtxWindows Event ID encyclopediaEVTX tools compared
Related tools
- Registry ParserServices, Run keys and TaskCache in the registry confirm the persistence the event logs announce.
- Prefetch ParserPrefetch confirms that a process seen in 4688 or Sysmon 1 actually ran, even after the logs are cleared.
- USN ParserThe USN journal records file creates and deletes even when object-access auditing was off.
Event log FAQ
- What is an EVTX file?
- EVTX is the binary Windows Event Log format introduced with Windows Vista. Each .evtx file is a sequence of 64 KB chunks; every chunk holds an XML template table plus a stream of records that reference those templates. Parsing rebuilds the full XML for each event.
- Where do I find .evtx files on Windows?
- Live logs live under C:\Windows\System32\winevt\Logs. The big three for forensics are Security.evtx (logons, privilege use), System.evtx (drivers, services), and Application.evtx (app errors). Sysmon and PowerShell channels are typically the most valuable for incident response.
- Does this tool upload my .evtx anywhere?
- No. Parsing happens in a Web Worker using a Rust EVTX parser compiled to WebAssembly. The file is read into your browser's memory and never transmitted. Disconnect your network if you want to verify.
- Can it run Sigma rules on .evtx files?
- Yes. The Sigma tab runs about 2,400 SigmaHQ Windows rules (a pinned release bundled with the site) on the loaded events, inside the browser's Web Worker — like Hayabusa or Chainsaw, with nothing to install. Process-creation rules apply to both Sysmon Event ID 1 and Security 4688. You can also paste or drop your own Sigma YAML rules: they are validated and run locally, never uploaded. Matches and CSV/JSON exports credit each rule's author, as the Detection Rule License 1.1 requires.
- What does the Level column mean?
- EVTX levels are numeric: 1 Critical, 2 Error, 3 Warning, 4 Information, 5 Verbose. Microsoft maps a few well-known IDs (e.g. Security 4625 = failed logon at Information level) — severity alone is not a triage signal.
- Can it parse very large .evtx files?
- Parsing runs in a Web Worker thread. Memory scales with file size; a few hundred MB is comfortable in modern browsers. Larger collections can be exported with evtx_dump first and re-imported in slices.
- How do I read .evtx files without Windows?
- On Linux or macOS you have three practical options: evtx_dump (the Rust CLI from omerbenamram/evtx, MIT-licensed), python-evtx (libyal), or this site — which is the same Rust parser compiled to WebAssembly. All three rebuild the event XML offline; no Microsoft tooling needed.
- What is the difference between .evt and .evtx?
- .evt is the legacy binary log format used by Windows 2000/XP/2003 — fixed-size, flat record layout. .evtx replaced it in Windows Vista / Server 2008 with a chunked structure, XML template compression, and per-record provider GUIDs. .evt files are not readable by this parser; convert them with wevtutil first.
- Can I open .evtx in Notepad?
- No — .evtx is a binary format with chunked records and BinXML-compressed templates. Notepad will show mostly garbled text. Use Event Viewer (built into Windows), wevtutil, evtx_dump, or this in-browser parser.
- How do I parse .evtx in PowerShell?
- Use Get-WinEvent -Path 'C:\path\to\Security.evtx' on Windows; it accepts -FilterHashtable for ID/level/time filtering and -MaxEvents for sampling. For one-off triage on non-Windows hosts, evtx_dump --json (CLI) or this site is faster — Get-WinEvent needs a Windows runtime and the matching provider manifest to fully render messages.
- Where are Windows event logs stored?
- Active logs live in C:\Windows\System32\winevt\Logs as .evtx files; default channels are Application, System, Security, Setup and ForwardedEvents, plus per-application channels under Microsoft-Windows-* (e.g. Sysmon, PowerShell/Operational, TaskScheduler). Archived logs can be anywhere — KAPE and FTK Imager both pull the live directory by default.
- Which Event IDs should I monitor for security?
- The MITRE-aligned shortlist: 4624 (logon) and 4625 (failed logon) in Security, 4688 (process creation, with command-line auditing on), 4768/4769 (Kerberos TGT/TGS — kerberoasting), 4672 (special privileges), 4720/4726 (account created/deleted), 1102 (audit log cleared), 7045/7036 (service installation/state), and Sysmon 1/3/7/11 for process, network, image-load and file-create.
Your next investigation starts with a drop.
Free, open source and private by design. No account, no upload, no install.