Sysmon Event Analyzer

Read Sysmon events with the event IDs explained, processes linked to their parents, and network, file and registry activity laid out as a timeline.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Drop exported Sysmon events

Microsoft-Windows-Sysmon/Operational exported as XML, CSV or JSON. Read in your browser only.

Or paste exported events

Sysmon, with the processes put back together

Sysmon's value is in its links. Every process creation (event 1) carries its own ProcessGuid and its parent's, so the analyzer rebuilds the process tree. A document opened by Word, which starts PowerShell, which drops and starts an executable, reads as one indented chain. It does not appear as three unrelated rows. A parent that started before the capture window appears as a placeholder built from ParentImage, so every child still has a place.

Every event ID, explained

All Sysmon event IDs, from 1 (process created) to 29 (executable file detected), are named, and their activity is grouped into panels:

network connections by destination, with the processes that made them;
DNS queries by name;
file creations and deletions;
registry changes;
a review list.

The review list flags patterns worth a second look:

Office applications starting script hosts;
encoded PowerShell commands;
executables running from Temp or Downloads;
processes opening lsass.exe, excluding the usual system and Defender callers;
Run-key persistence;
remote threads;
WMI subscriptions;
process tampering;
changes to Sysmon itself.

Reading it well

What Sysmon records depends entirely on its configuration. If your config excludes network events for browsers, the absence of those events means nothing. The review rules are deliberately few and explainable. They are a starting point for your own judgement, not a detection engine.

Frequently asked questions

Can it open .evtx files?

Not directly - the binary format is not readable in a browser. Export with wevtutil qe Microsoft-Windows-Sysmon/Operational /c:10000 /f:xml or Event Viewer's "Save as XML".

Are hashes or domains looked up anywhere?

No. Nothing leaves the page. Copy an indicator into a tool of your choosing if you want to look it up.

Why are some processes placeholders?

Their creation event is not in the export - they started earlier, or the config filtered them. The child's ParentImage and ParentCommandLine fill in what is known.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.