EVTX viewer: open Windows event logs in your browser

What the viewer shows

Each event's time (UTC), event ID with Microsoft's title, result (audit success or failure), the account it is about, where it came from, and the fields that matter for that event: logon type, failure reason and codes, process and command line, Kerberos service and encryption, group changes, Sysmon images and targets. Click a row for every field with its meaning and decoded value. Click an event ID that has a page in the reference library, such as 4625 or 4688, for what it means and what to check next. The detections come from the same Windows checks as the log analyzer: password spraying, brute force, logins that succeed after failures, cleared logs and new admin accounts, among others. The same file opens in the log analyzer too, which shows the evidence rows behind each finding.

How the file is read

A .evtx file is not text: it is Microsoft's binary event log format, a 4 KB header followed by 64 KB chunks of records written in a compact binary XML. The viewer reads that format in JavaScript and turns each record into the same event XML that Event Viewer's "Save as XML" produces. The reader is tested record by record against python-evtx, a widely used open-source parser, on a sample System log of 1,601 events.

Exporting an event log

:: whole Security log (administrator prompt)
wevtutil epl Security C:\temp\security.evtx

:: only failed logons, the last 7 days
wevtutil epl Security C:\temp\failed-logons.evtx /q:"*[System[(EventID=4625) and TimeCreated[timediff(@SystemTime) <= 604800000]]]"