Your files stay on your device

Windows event log analyzer

Drop exported Windows Security event files and read logon totals, failed logons with decoded NTSTATUS sub-statuses, account and group changes, and a flagged-events timeline.

Export your Security log from Event Viewer (Save All Events As, XML), drop it here, and press Analyse. The sample events exercise every table on fake data.

This is triage, not an investigation. A flagged event is a question, not an incident: service installs, group changes, and log clearing all have innocent explanations. The tool reads only the export you give it, so a clean result says nothing about events that were never exported or were cleared from the log. Localised (non-English) CSV messages carry the labels in another language; export XML instead for those.
OptionsAnalyse

More network tools

- CloudTrail analyzer (/network/aws-cloudtrail-log-analyzer)
- HTTP timing probe (/network/http-timing)
All network tools (/network)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/network/windows-event-log-analyzer
Markdown version: https://nutter.tools/network/windows-event-log-analyzer.md
Plain-text version: https://nutter.tools/network/windows-event-log-analyzer.txt
Agent index: https://nutter.tools/llms.txt