{"id":13597733,"url":"https://github.com/EricZimmerman/evtx","last_synced_at":"2025-04-10T05:33:22.254Z","repository":{"id":38127223,"uuid":"176131345","full_name":"EricZimmerman/evtx","owner":"EricZimmerman","description":"C# based evtx parser with lots of extras","archived":false,"fork":false,"pushed_at":"2025-03-31T23:17:34.000Z","size":6575,"stargazers_count":297,"open_issues_count":4,"forks_count":63,"subscribers_count":24,"default_branch":"master","last_synced_at":"2025-04-01T00:23:35.023Z","etag":null,"topics":["event","eventlog","evtx","windows"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/EricZimmerman.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-03-17T16:50:07.000Z","updated_at":"2025-03-31T23:17:38.000Z","dependencies_parsed_at":"2023-02-06T08:46:31.561Z","dependency_job_id":"f4d111d9-e13b-4575-a89b-bd6ed591863a","html_url":"https://github.com/EricZimmerman/evtx","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EricZimmerman%2Fevtx","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EricZimmerman%2Fevtx/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EricZimmerman%2Fevtx/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EricZimmerman%2Fevtx/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/EricZimmerman","download_url":"https://codeload.github.com/EricZimmerman/evtx/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248163362,"owners_count":21057918,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["event","eventlog","evtx","windows"],"created_at":"2024-08-01T17:00:39.984Z","updated_at":"2025-04-10T05:33:17.239Z","avatar_url":"https://github.com/EricZimmerman.png","language":"C#","funding_links":[],"categories":["Tool-Related GitHub Repos","C# #"],"sub_categories":["EZ Tools"],"readme":"# EvtxECmd\n\nThis repo that contains all the Maps used by Eric Zimmerman's EvtxECmd.\n\n## Ongoing Projects\n\n * [EvtxECmd Maps Ideas](https://github.com/EricZimmerman/evtx/projects/1) - Development roadmap for EvtxECmd Maps. Please feel free to contribute by adding ideas or by finishing tasks in the `To Do` column. Any help is appreciated! \n\n\n## Command Line Interface\n\n    EvtxECmd version 0.6.5.0\n    \n    Author: Eric Zimmerman (saericzimmerman@gmail.com)\n    https://github.com/EricZimmerman/evtx\n    \n            d               Directory to process that contains evtx files. This or -f is required\n            f               File to process. This or -d is required\n    \n            csv             Directory to save CSV formatted results to.\n            csvf            File name to save CSV formatted results to. When present, overrides default name\n            json            Directory to save JSON formatted results to.\n            jsonf           File name to save JSON formatted results to. When present, overrides default name\n            xml             Directory to save XML formatted results to.\n            xmlf            File name to save XML formatted results to. When present, overrides default name\n    \n            dt              The custom date/time format to use when displaying time stamps. Default is: yyyy-MM-dd HH:mm:ss.fffffff\n            inc             List of Event IDs to process. All others are ignored. Overrides --exc Format is 4624,4625,5410\n            exc             List of Event IDs to IGNORE. All others are included. Format is 4624,4625,5410\n            sd              Start date for including events (UTC). Anything OLDER than this is dropped. Format should match --dt\n            ed              End date for including events (UTC). Anything NEWER than this is dropped. Format should match --dt\n            fj              When true, export all available data when using --json. Default is FALSE.\n            tdt             The number of seconds to use for time discrepancy detection. Default is 1 second\n            met             When true, show metrics about processed event log. Default is TRUE.\n\n            maps            The path where event maps are located. Defaults to 'Maps' folder where program was executed\n\n            vss             Process all Volume Shadow Copies that exist on drive specified by -f or -d . Default is FALSE\n            dedupe          Deduplicate -f or -d \u0026 VSCs based on SHA-1. First file found wins. Default is TRUE\n\n            sync            If true, the latest maps from https://github.com/EricZimmerman/evtx/tree/master/evtx/Maps are downloaded and local maps updated. Default is FALSE\n\n            debug           Show debug information during processing\n            trace           Show trace information during processing\n\n\n    Examples: EvtxECmd.exe -f \"C:\\Temp\\Application.evtx\" --csv \"c:\\temp\\out\" --csvf MyOutputFile.csv\n              EvtxECmd.exe -f \"C:\\Temp\\Application.evtx\" --csv \"c:\\temp\\out\"\n              EvtxECmd.exe -f \"C:\\Temp\\Application.evtx\" --json \"c:\\temp\\jsonout\"\n\n              Short options (single letter) are prefixed with a single dash. Long commands are prefixed with two dashes\n\n## Documentation\n\nThis project contains both the core parsing engine as well as a command line front end that uses it.\n\nFor documentation on creating maps, check out the [README](https://github.com/EricZimmerman/evtx/blob/master/evtx/Maps/!!!!README.md) in the Maps directory. \n\nUse the [Guide](https://github.com/EricZimmerman/evtx/blob/master/evtx/Maps/!Channel-Name_Provider-Name_EventID.guide) to learn how to make maps from the [Template](https://github.com/EricZimmerman/evtx/blob/master/evtx/Maps/!Channel-Name_Provider-Name_EventID.template) provided.\n\n[Introducing EvtxECmd!!](https://binaryforay.blogspot.com/2019/04/introducing-evtxecmd.html)\n\n[Introduction to EvtxECmd](https://www.youtube.com/watch?v=YvMg3p7O6ro)\n\n[Enhancing Event Log Analysis with EvtxEcmd using KAPE](https://www.youtube.com/watch?v=BIkyWexMF0I)\n\n# Download Eric Zimmerman's Tools\n\nAll of Eric Zimmerman's tools can be downloaded [here](https://ericzimmerman.github.io/#!index.md). Use the [Get-ZimmermanTools](https://f001.backblazeb2.com/file/EricZimmermanTools/Get-ZimmermanTools.zip) PowerShell script to automate the download and updating of the EZ Tools suite. Additionally, you can automate each of these tools using [KAPE](https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape)!\n\n# Special Thanks\n\nOpen Source Development funding and support provided by the following contributors: \n- [SANS Institute](http://sans.org/) and [SANS DFIR](http://dfir.sans.org/).\n- [Tines](https://www.tines.com/?utm_source=oss\u0026utm_medium=sponsorship\u0026utm_campaign=ericzimmerman)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FEricZimmerman%2Fevtx","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FEricZimmerman%2Fevtx","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FEricZimmerman%2Fevtx/lists"}