Windows Event Log Analyzer

Load exported Windows security events as XML, CSV or JSON and get the logon, account and privilege events summarised, filtered and placed on a timeline.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Drop exported Security events

XML (Event Viewer "Save as XML", wevtutil /f:xml), Event Viewer CSV, or Get-WinEvent | ConvertTo-Json. .evtx must be exported first - see below.

Or paste exported events

Flag repeated failures from

Include computer and service account logons

The Security log, summarised

The analyzer reads the event's own fields - EventData for XML, and the "Account Name:" style lines of the rendered message for CSV exports. From those it builds:

logons by account, logon type and source address;
failed logons with the NTSTATUS sub-status decoded into plain language (wrong password, no such user, locked out, outside allowed hours);
account and group changes, in order;
a list of events that deserve a closer look.

Computer accounts and the built-in service identities are left out of logon counts unless you ask for them.

What gets flagged, and why

Security log cleared (1102) and audit policy changed (4719): both remove the evidence you are reading.
Additions to privileged groups: recognised by well-known SID (Administrators, Backup Operators and others) or by RID (Domain Admins 512, Enterprise Admins 519, Schema Admins 518), not just by name.
New accounts, services (4697/7045) and scheduled tasks (4698): common persistence points.
Many failures from one source across many accounts: the shape of password spraying. The threshold is yours to set.
RDP and runas /netonly logons: listed for context, not as alarms.

Getting events out of Windows

In Event Viewer, select the Security log, choose "Filter Current Log" to narrow it, then "Save Filtered Log File As" in XML or CSV format. From PowerShell, Get-WinEvent -LogName Security -MaxEvents 5000 | ConvertTo-Json -Depth 3 or wevtutil qe Security /c:5000 /f:xml both work. A binary .evtx file cannot be read in the browser, so convert it with one of those commands first.

Frequently asked questions

Does this connect to my domain controller?

No. It only reads the file you give it, in your browser. It never queries a machine, a directory or a SIEM.

Why are some CSV fields empty?

Event Viewer CSV only has the rendered message; fields are recovered from its labelled lines. Localised (non-English) messages cannot be read this way - export XML instead, which carries the raw field names.

Is a flagged event an incident?

Not by itself. Administrators clear logs and add group members for good reasons. Each flag is a question to answer with context, and the export gives you the evidence to do it.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.