Usage

EventHawk has one entry point, evtx_tool.py, with a command for each mode. Run --help on any command for its full option list.

> py -3 evtx_tool.py --help> py -3 evtx_tool.py parse --help

Commands

Command	What it does
parse	Parse EVTX files or folders with profiles and filters, run analysis, export results
diff	Compare a baseline capture with an incident capture
profiles	List, inspect, create, import, export and delete DFIR profiles
benchmark	Measure parsing speed at different worker counts
interactive	Step-by-step wizard for choosing profiles and filters, then parsing
gui	Launch the desktop application

Desktop GUI

> py -3 evtx_tool.py gui

Pass files or folders to open them straight away: py -3 evtx_tool.py gui C:\Logs. The GUI is where Juggernaut Mode, the analysis tabs, Hayabusa, PowerShell history extraction, the logon session browser and the missing record ID check live.

parse

Parses one or more .evtx files or folders (folders are searched recursively), applies filters, runs analysis and writes the matched events.

# Parse a folder with a DFIR profile and save JSON> py -3 evtx_tool.py parse C:\Logs --profile "Logon/Logoff Activity" --output logons.json# Failed and successful logons in a time window, as CSV> py -3 evtx_tool.py parse C:\Logs -e 4624,4625 --date-from 2025-05-10T00:00:00 --date-to 2025-05-10T23:59:59 -o logons.csv# Extract IOCs and correlate attack chains into an HTML report> py -3 evtx_tool.py parse C:\Logs --ioc --correlate --output report.html

The output format follows the file extension (.json, .csv, .xml, .html, .pdf); unknown extensions fall back to JSON. Use --format to override it. While parsing, a live terminal dashboard shows progress unless you pass --no-tui.

Filters

Option	Description
-p, --profile NAME	DFIR profile by name. Repeat for several, or use all
-F, --filter-file FILE	Load a filter from a JSON file
-e, --event-id IDS	Event IDs: a list (4624,4625) or a range (4600-4650)
--exclude-id IDS	Event IDs to exclude
-l, --level LEVELS	critical, error, warning, info, verbose
--date-from DATETIME	Start of the time range (ISO 8601)
--date-to DATETIME	End of the time range (ISO 8601)
-u, --user TEXT	Username or SID (repeatable)
-c, --computer TEXT	Computer name (repeatable)
-s, --source TEXT	Source or provider (repeatable)
-q, --search TEXT	Free-text search terms (repeatable)
--search-mode MODE	How search terms combine: AND (default), OR or NOT

Timeline window

Option	Description
--timeline-anchor DATETIME	Pivot time; limits results to a window around it
--timeline-before MINUTES	Minutes before the anchor (default 5)
--timeline-after MINUTES	Minutes after the anchor (default 30)

> py -3 evtx_tool.py parse C:\Logs --timeline-anchor 2025-05-10T18:08:16 --timeline-before 30 --timeline-after 60 -o pivot.json

Output and analysis

Option	Description
-o, --output FILE	Output file; the extension selects the format
--format FORMAT	Force json, csv, xml, html or pdf
--save-filter FILE	Save the active filter configuration to JSON
--attack / --no-attack	MITRE ATT&CK tagging of matched events (on by default)
--ioc	Extract IOCs: IPs, hashes, users, commands and paths
--correlate	Run the attack-chain correlation rules
--limit N	Cap the output at N events

Engine

Option	Description
--max-threads N	Maximum worker processes (default: CPU count minus one)
--cpu-limit PERCENT	CPU usage ceiling for throttling (default 85)
--ram-limit PERCENT	RAM usage ceiling for throttling (default 90)
--priority LEVEL	Process priority: low, normal (default) or high
--no-recursive	Do not search folders recursively
--no-tui	Disable the live terminal dashboard
-v, --verbose	Verbose logging

TODO (author):

The repository’s CLI guide and README quick start use --juggernaut, --workers, --from, --to and --tui. None of these exist in evtx_tool/cli.py on main, which uses --date-from, --date-to, --max-threads and --no-tui instead and has no Juggernaut option. This page follows the source. Confirm whether Juggernaut Mode should be reachable from the CLI.

diff

Compares a baseline set of EVTX files with an incident set and highlights new event types, missing event types, and volume spikes and drops.

> py -3 evtx_tool.py diff C:\Baseline C:\Incident --profile all --output diff.html

Option	Description
-p, --profile NAME	Profiles applied to both sides (repeatable, or all)
-o, --output FILE	Output file (.html, .json or .csv)
--format FORMAT	Force the output format
--spike-factor N	Incident-to-baseline volume ratio counted as a spike (default 3.0)
--max-threads N	Maximum worker processes
-v, --verbose	Verbose logging

profiles

> py -3 evtx_tool.py profiles list> py -3 evtx_tool.py profiles show "RDP Activity"

Subcommand	What it does
list [--tag TAG] [--search TEXT]	List profiles, optionally filtered by tag or name
show NAME	Show one profile’s details
create	Create a custom profile (prompts for name, description, event IDs and sources)
delete NAME	Delete a custom profile (built-in profiles cannot be deleted)
export NAME DEST	Export a profile to a JSON file
import SRC [--overwrite]	Import a profile from a JSON file
export-all DEST_DIR	Export every profile to a folder

The 20 built-in profiles are: User Account Management; Logon/Logoff Activity; Privilege Escalation; RDP Activity; PowerShell Execution; Process Creation and Termination; Network Connections; File System Activity; Registry Modifications; Scheduled Tasks; Service Install and Changes; Defender and AV Alerts; Application Crashes; USB and Removable Media; Firewall Changes; Security Policy Changes; Lateral Movement Indicators; Web Browser Activity (EVTX sources); Windows Update and Patch Activity; System Boot and Shutdown Events.

benchmark

Parses the given files at several worker counts and reports time, records per second and MB per second. Without --threads, it tests 1, half the CPU count and the CPU count minus one.

> py -3 evtx_tool.py benchmark C:\Logs --threads 2 --threads 8

interactive

A prompt-driven wizard: choose profiles and filters, then parse. Pass a path or enter it when asked.

> py -3 evtx_tool.py interactive C:\Logs

Sentinel

Sentinel builds a baseline from known-good logs, then scores a suspect capture against it. Install its extra requirements first (see Install).

> python -m sentinel.cli build --evtx C:\Baseline --output baseline\ --sigma C:\sigma\rules\windows> python -m sentinel.cli analyze --evtx C:\Target\Security.evtx --baseline baseline\ --report findings.json

Command	Options
build	--evtx DIR (required) baseline logs · --output DIR (required) artifacts · --sigma DIR optional Sigma rules
analyze	--evtx FILE… (required) target logs · --baseline DIR (required) · --sigma DIR optional · --report FILE JSON report