Your files stay on your device

# Sysmon event analyzer

Rebuild process trees keyed by ProcessGuid from pasted or uploaded Sysmon exports in XML, CSV, JSON, JSONL, or plain text, explain event IDs 1 through 29, draw an activity timeline, and flag a short list of explainable review patterns, with no hash or domain lookups.

Add a Sysmon export and press Analyse. The sample events show the process tree, the event reference, and every review pattern on safe fake data.

This is a reading tool, not a detection engine. The review rules are few and each one names why it is worth a look; nothing is looked up online, no hashes, no domains, no VirusTotal. A clean result only means nothing on the rule list appeared in the events you loaded, and the output depends on the Sysmon config used at capture time.
OptionsAnalyse

## More regex & cron tools

- [CloudTrail analyzer](/network/aws-cloudtrail-log-analyzer)
- [Checksum manifest](/crypto/hash-manifest)
[All regex & cron tools](/dev)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/dev/sysmon-event-analyzer
Markdown version: https://nutter.tools/dev/sysmon-event-analyzer.md
Plain-text version: https://nutter.tools/dev/sysmon-event-analyzer.txt
Agent index: https://nutter.tools/llms.txt