EvtxECmd to convert events logs into csv for timeline analysis

 EvtxECmd - this tool will help us to convert event logs into csv format. Later we can use timeline analysis tool to analysis the csv data more efficiently. 

This tool also help us to convert logs into json format. 

Download the tool first.

https://ericzimmerman.github.io/#!index.md

Command:

evtxecmd --sync

evtxecmd -f E:\C\Windows\System32\winevt\logs\Security.evtx --csv g:\Labs\event-logs --csvf security.csv

evtxecmd -f "e:\C\Windows\System32\winevt\logs\Microsoft-Windows-TaskScheduler%40Operational.evtx" --csv G:\Labs\event-logs --csvf taskscheduler.csv

Windows have so many event logs and so many event id's. Not all the event id's are important. Of course you can use your own but Mark Hallman created a script that will parse all the important event id's that is discussed in SANS FOR508 course.

You can use mark hallman's Process-EventLogs.ps1 tool that will parse important event id's from bulk event logs leveraging evtxecmd tool. 

https://github.com/mark-hallman/Process-EventLogs

Unblock-File .\Process-EventLogs.ps1

.\Process-EventLogs.ps1 -source E:\c\Windows\system32\winevt\logs\ -dest G:\Labs\event-logs\

The above command will create csv file. Check this book SANS FOR508 2025 Workbook and Labs Section 1-2.pdf 181 page and SANS FOR508 2022 @EthicalHackX_FOR508_2022.pdf page 935 for more info. 

The reason for using this tool is evtxecmd can process only one file at a time. But this tool can parse multiple log files with multiple event id's at a time.  

Avi