Install

EventHawk runs from a source checkout with Python. The repository also contains scripts for building a standalone Windows installer and a portable build.

Requirements

Requirement	Minimum
Operating system	Windows 10 or 11, 64-bit
Python	3.10 or newer, standard build
pip	22.0 or newer
Git	Any recent version
Memory	4 GB; 8 GB or more for large datasets

Caution:

Free-threaded Python builds (for example 3.13t or 3.14t) are not supported by the evtx parser wheel. The bundled install.bat refuses to continue on one.

Install from source on Windows

Clone the repository:

> git clone https://github.com/Mihir-Choudhary/EventHawk.git> cd EventHawk

Install the dependencies, either with the bundled script:

> install.bat

or with pip directly:

> py -3 -m pip install -r requirements.txt

Then check that it starts:

> py -3 evtx_tool.py --version> py -3 evtx_tool.py gui

--version prints the installed version. gui opens the desktop application; py -3 evtx_tool.py --help lists the command-line commands.

What gets installed

requirements.txt pulls in the parser and the libraries behind each feature:

Package	Used for
evtx (pyevtx-rs)	EVTX parsing
PySide6	Desktop GUI
duckdb, pyarrow	Juggernaut Mode
click, rich	Command line and terminal dashboard
psutil	CPU and RAM monitoring during parsing
lxml, reportlab, openpyxl	XML, PDF and Excel output
PyYAML, orjson	Profile support and fast JSON

Linux and macOS

Source mode works anywhere PySide6 and pyevtx-rs are available. The repository’s run.sh creates a project virtual environment in .venv, installs the requirements into it on first run, and then starts EventHawk:

$ ./run.sh            # launch the GUI$ ./run.sh --cli --help   # run the command line

Note:

On first run, run.sh downloads pip’s bootstrap script from bootstrap.pypa.io to set up the virtual environment.

Standalone Windows build

TODO (author):

The repository’s installation guide describes a pre-built installer (EventHawk-1.3.0-Setup.exe) and portable builds on the GitHub Releases page, but the repository has no published releases yet. Add the download link and file names here once a release is published.

To build the standalone yourself, see build_standalone.ps1 and docs/21-building-standalone.md in the repository.

Optional extras

• Sentinel has its own dependencies: py -3 -m pip install -r sentinel/requirements.txt (adds python-evtx and, optionally, pySigma for rule tagging).
• Hayabusa is not bundled. Install it separately and point EventHawk at the binary to add its Sigma detections.
• GPU acceleration with RAPIDS cuDF is detected automatically on Linux or WSL2 with an NVIDIA GPU. It is not available on Windows.

Troubleshooting

• evtx fails to install. The parser ships as a compiled wheel. Use a standard 64-bit Python 3.10 or newer. On unusual Python builds, install Rust and build it from source with pip install evtx --no-binary evtx.
• PySide6 is not installed when running gui: install it with py -3 -m pip install PySide6.
• Live logs are unreadable. Windows restricts read access to active logs in C:\Windows\System32\winevt\Logs\. Run as administrator or copy the files first. Parsing copies you already have needs no administrator rights.