Live lab · Detection engineering

EVTXplorer

Load a Windows event log and see which attack techniques it points to. This runs the same YAML rules as the CLI, including its threshold logic for brute-force and spray activity.

● Logs stay in this page
rules loading
MITRE ATT&CK mapped

Choose a log

Sample

Samples are synthetic test data. To use your own log, export it from Event Viewer as XML. The CLI handles binary .evtx files; this page doesn't.

Detections

Nothing analyzed yet.