AppCompatProcessor - AppCompatProcessor has been designed to extract additional value from enterprise-wide AppCompat / AmCache data beyond the classic stacking and grepping techniques.
APT Hunter - APT-Hunter is Threat Hunting tool for windows event logs.
Chainsaw - Chainsaw provides a powerful ‘first-response’ capability to quickly identify threats within Windows event logs.
Event Log Explorer - Tool developed to quickly analyze log files and other data.
Event Log Observer - View, analyze and monitor events recorded in Microsoft Windows event logs with this GUI tool.
Hayabusa - Hayabusa is a Windows event log fast forensics timeline generator and threat hunting tool created by the Yamato Security group in Japan.
Kaspersky CyberTrace - Threat intelligence fusion and analysis tool that integrates threat data feeds with SIEM solutions. Users can immediately leverage threat intelligence for security monitoring and incident report (IR) activities in the workflow of their existing security operations.
Log Parser Lizard - Execute SQL queries against structured log data: server logs, Windows Events, file system, Active Directory, log4net logs, comma/tab separated text, XML or JSON files. Also provides a GUI to Microsoft LogParser 2.2 with powerful UI elements: syntax editor, data grid, chart, pivot table, dashboard, query manager and more.
Lorg - Tool for advanced HTTPD logfile security analysis and forensics.
Logdissect - CLI utility and Python API for analyzing log files and other data.
LogonTracer - Tool to investigate malicious Windows logon by visualizing and analyzing Windows event log.
Sigma - Generic signature format for SIEM systems already containing an extensive ruleset.
StreamAlert - Serverless, real-time log data analysis framework, capable of ingesting custom data sources and triggering alerts using user-defined logic.
SysmonSearch - SysmonSearch makes Windows event log analysis more effective and less time consuming by aggregation of event logs.
WELA - Windows Event Log Analyzer aims to be the Swiss Army knife for Windows event logs.
Zircolite - A standalone and fast SIGMA-based detection tool for EVTX or JSON.