EVTX Explorer
Triage a Windows event log in the browser.
Drop a .evtx file. SIGMA-lite matching, logon sessions, an Event ID knowledge base — parsed by a Rust→WASM engine on your device, nothing uploaded.
- .evtx
About EVTX Explorer
EVTX Explorer parses Windows Event Log (.evtx) files entirely in your browser via a Rust-to-WebAssembly engine, then adds the DFIR layer the free viewers don't: a SIGMA-lite matcher plus curated detection heuristics that flag suspicious events, logon-session reconstruction (4624/4634/4647), a built-in Event ID knowledge base with MITRE ATT&CK mapping, and faceted filtering by level, provider, channel, and Event ID. Records show in a list up top with full detail below. Nothing is uploaded — the log, which often contains internal hostnames, usernames, and indicators, never leaves your device.
What it does
- Parse Windows .evtx logs in-browser via a Rust→WASM engine (the MIT omerbenamram/evtx core)
- Records list on top, full per-record detail (System + EventData + raw) below
- SIGMA-lite matcher + curated heuristics: bundled rules flag suspicious events; paste your own single-selection SIGMA YAML
- Logon-session reconstruction from 4624/4634/4647 with logon type + account
- Built-in Event ID knowledge base (4624/4625/4672/4688/7045/1102 and more) with MITRE ATT&CK mapping
- Faceted filtering by level, provider, channel and Event ID, plus full-text search
- Export all events, filtered events, or detections to JSON
- Runs 100% in your browser — the event log never leaves your device