Home

Awesome

<div align="center"><img src="assets/logo.svg" width="300"/></div>

GitHub Workflow Status (with event) coverage GitHub tag (with filter) Documentation

Gene(sis)

A long long time ago (in 2017) after doing many responses to incidents, I realized I was always ending up doing the same thing to search inside Windows EVTX logs: writting a custom script to match log entries against our findings ! At that moment I decided to start coding this tool, not only to ease my daily work but also to be able to share detection rules between parties.

Since then, the tool has evolved and it can now be used to match against any kind of log (formatted in JSON) and has native support for Windows EVTX parsing.

Some use cases

Additional resources

Changelog

v2.0.0

v1.6.0

v1.5.0