Windows EVTX Event Log Viewer & CSV Exporter
WINDOWS EVENT LOG FILE (.EVTX / .XML / .TXT)
| Timestamp (UTC) | Event ID | Level | Provider / Channel | Computer | User / Details |
|---|---|---|---|---|---|
| No EVTX logs loaded. Upload a file or click "Load Sample Security Log". | |||||
Windows EVTX Event Log Forensic Analysis Guide
Windows Event Logs (`.evtx`) record critical security auditing events, authentication attempts, process launches, and service state changes across Windows workstations and Domain Controllers.
Critical Windows Security Event IDs
- Event ID 4624 — Successful Account Logon (Type 2 Interactive, Type 3 Network, Type 10 RDP).
- Event ID 4625 — Failed Account Logon (Brute-force authentication detection).
- Event ID 4688 — New Process Created (Command-line logging and malware analysis).
- Event ID 7045 — New Service Installed (Persistence & privilege escalation).
- Event ID 1102 — Security Audit Log Cleared (Anti-forensic tampering).
Related Security & Developer Tools
Generate CSP headers with the CSP Header Generator, decode JWT payloads with the JWT Encoder, or format SQL queries with the SQL Formatter.
Frequently Asked Questions
Common questions about this tool.
What is a Windows EVTX file? ▼
EVTX (`.evtx`) is the proprietary binary log file format used by Microsoft Windows Vista/10/11 and Windows Server to store System, Security, and Application event logs.
Are my Windows Security event logs uploaded to external servers? ▼
100% private and secure. All binary parsing, XML extraction, and CSV conversion run locally in your web browser. Zero security log data ever leaves your computer.
What common Windows Security Event IDs are analyzed? ▼
Common Event IDs include: 4624 (Successful Logon), 4625 (Failed Logon), 4688 (Process Creation), 7045 (Service Installed), 1102 (Audit Log Cleared), and 4720 (User Account Created).
Can I export parsed EVTX logs to Excel or SIEM tools? ▼
Yes! Export parsed event logs as standardized CSV spreadsheets for Excel analysis, formatted TXT files for SIEM ingestion, or structured JSON objects.
What file formats are supported? ▼
Supports raw Windows `.evtx` binary logs, exported Windows Event `.xml` files, and `.txt`/`.log` event text dumps.
Related Free Utilities
View all tools →ChatGPT Ad Blocker
Block ChatGPT upgrade banners, upsell promo cards, and partner app ads with a lightweight, privacy-first Manifest V3 Chrome extension.
JSON diff
JSON diff. Use this privacy-first json diff directly in your browser.
Base64 encoder
Base64 encoder. Use this privacy-first base64 encoder directly in your browser.
URL parser
URL parser. Use this privacy-first url parser directly in your browser.