Your files stay on your device

Sysmon event analyzer

Rebuild process trees keyed by ProcessGuid from pasted or uploaded Sysmon exports in XML, CSV, JSON, JSONL, or plain text, explain event IDs 1 through 29, draw an activity timeline, and flag a short list of explainable review patterns, with no hash or domain lookups.

Add a Sysmon export and press Analyse. The sample events show the process tree, the event reference, and every review pattern on safe fake data.

This is a reading tool, not a detection engine. The review rules are few and each one names why it is worth a look; nothing is looked up online, no hashes, no domains, no VirusTotal. A clean result only means nothing on the rule list appeared in the events you loaded, and the output depends on the Sysmon config used at capture time.
OptionsAnalyse

More regex & cron tools

- CloudTrail analyzer (/network/aws-cloudtrail-log-analyzer)
- Checksum manifest (/crypto/hash-manifest)
All regex & cron tools (/dev)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/dev/sysmon-event-analyzer
Markdown version: https://nutter.tools/dev/sysmon-event-analyzer.md
Plain-text version: https://nutter.tools/dev/sysmon-event-analyzer.txt
Agent index: https://nutter.tools/llms.txt