python-evtx
evtx2es
Our great sponsors
| python-evtx | evtx2es | |
|---|---|---|
| 2 | 1 | |
| 670 | 78 | |
| - | - | |
| 1.6 | 6.9 | |
| about 1 year ago | 5 months ago | |
| Python | Python | |
| Apache License 2.0 | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
python-evtx
-
analyzing Windows Event Logs on Linux
python-evtx should do the trick for you: https://github.com/williballenthin/python-evtx
-
Searching Windows Event logs for fun!
To be able to read the logs, we converted them to XML using python-evtx:
evtx2es
What are some alternatives?
mimikatz - A little tool to play with Windows security
elasticsearch-py - Official Python client for Elasticsearch
Zircolite - A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
elasticsearch-dsl-py - High level Python client for Elasticsearch
evtx-hunter - evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.
TWINT - An advanced Twitter scraping & OSINT tool written in Python that doesn't use Twitter's API, allowing you to scrape a user's followers, following, Tweets and more while evading most API limitations.
prowler - Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes to do security assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more
haystack - :mag: LLM orchestration framework to build customizable, production-ready LLM applications. Connect components (models, vector DBs, file converters) to pipelines or agents that can interact with your data. With advanced retrieval methods, it's best suited for building RAG, question answering, semantic search or conversational agent chatbots.
mvt - MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
dev-setup - macOS development environment setup: Easy-to-understand instructions with automated setup scripts for developer tools like Vim, Sublime Text, Bash, iTerm, Python data analysis, Spark, Hadoop MapReduce, AWS, Heroku, JavaScript web development, Android development, common data stores, and dev-based OS X defaults.
WatchAD - AD Security Intrusion Detection System
eventlog-live