Sysmon event analyzer

Add a Sysmon export and press Analyse. The sample events show the process tree, the event reference, and every review pattern on safe fake data.

This is a reading tool, not a detection engine. The review rules are few and each one names why it is worth a look; nothing is looked up online, no hashes, no domains, no VirusTotal. A clean result only means nothing on the rule list appeared in the events you loaded, and the output depends on the Sysmon config used at capture time.