EventHawk

EventHawk is a Windows Event Log analysis tool for digital forensics and incident response. It parses .evtx files in parallel with a Rust-backed parser (pyevtx-rs), loads the results into a Qt desktop GUI, and gives you filtering, threat analysis, IOC extraction and timeline correlation in one place. A command-line interface covers parsing, filtering, analysis and export without the GUI.

When a dataset is too large for memory, Juggernaut Mode keeps RAM usage flat: raw event data is written to Parquet on disk and queries run through DuckDB against a compact in-memory Arrow table.

Note:

EventHawk reads the EVTX format used from Windows Vista onwards. Legacy .evt files from Windows XP and earlier use a different format and are not supported.

What it does

• Two parsing modes. Normal Mode keeps matched events in memory for everyday datasets. Juggernaut Mode stores events in Parquet shards and loads only metadata columns into an Arrow table; event XML is loaded from disk when you open a row.
• 20 built-in DFIR profiles. Filter at parse time by investigation type, for example Logon/Logoff Activity, RDP Activity, PowerShell Execution, Lateral Movement Indicators or Defender and AV Alerts. Custom profiles can be created, imported and exported.
• Readable events. Built-in plain-English descriptions for common Windows event IDs, shown alongside the raw XML.
• Layered filtering. Event ID, level, time range, computer, provider, user, channel and free-text filters, combinable and clearable in one step.
• Threat analysis. MITRE ATT&CK tagging, IOC extraction (IPs, hashes, users, commands, paths) and rule-based attack-chain correlation.
• Hayabusa integration (optional). Point EventHawk at a Hayabusa binary to run its Sigma rules against the loaded files and merge the results into the ATT&CK view.
• PowerShell history extraction. Rebuilds PowerShell sessions, commands and script blocks (event IDs 400, 403, 600, 800, 4103 and 4104), reassembling multi-part script blocks.
• Session views. Logon session reconstruction and a missing EventRecordID check that flags gaps in record sequences.
• Sentinel (optional). A separate baseline engine that learns normal process behaviour from known-good logs and scores a suspect capture against it.
• Exports. JSON, CSV, XML, HTML and PDF for events; STIX 2.1, MISP event JSON and YARA for extracted IOCs.

TODO (author):

The upstream README also lists OpenIOC export and quotes “273+” event descriptions. Neither could be confirmed in the source on main (the IOC exporters are STIX 2.1, MISP and YARA), so both are left out above. Confirm and update.

Ways to run it

Interface	Start it with	Use it for
Desktop GUI	py -3 evtx_tool.py gui	Interactive triage, filtering and analysis
Command line	py -3 evtx_tool.py parse …	Scripted parsing, filtering and export
Interactive wizard	py -3 evtx_tool.py interactive	Picking profiles and filters step by step
Sentinel	python -m sentinel.cli …	Baseline building and anomaly scoring

A first run from a source checkout:

> py -3 -m pip install -r requirements.txt> py -3 evtx_tool.py parse C:\Logs\Security.evtx --output results.json

Requirements

Item	Requirement
Operating system	Windows 10 or 11, 64-bit
Python (source install)	3.10 or newer, standard (not free-threaded) build
Memory	4 GB minimum; 8 GB recommended for Juggernaut Mode on large captures
Disk	Free space for Juggernaut Mode’s Parquet shards, roughly 40% of the raw EVTX size

Source mode can also run on Linux and macOS where PySide6 and pyevtx-rs are available; the repository includes a run.sh launcher that sets up a virtual environment.

Next steps

• Install EventHawk from source.
• Usage: the GUI, every CLI command and its options, and Sentinel.
• Changelog: what changed in each version.

Source and license

EventHawk is open source under the Apache License 2.0. Source code, issues and pull requests are on GitHub.