Windows event log analyzer

Export your Security log from Event Viewer (Save All Events As, XML), drop it here, and press Analyse. The sample events exercise every table on fake data.

This is triage, not an investigation. A flagged event is a question, not an incident: service installs, group changes, and log clearing all have innocent explanations. The tool reads only the export you give it, so a clean result says nothing about events that were never exported or were cleared from the log. Localised (non-English) CSV messages carry the labels in another language; export XML instead for those.