Event2Timeline is a free tool based on D3js to graph Microsoft Windows sessions events. It parses both EVTX event logs from post Vista systems (Vista, Windows 7, Windows 8), and CSV exports of the legacy EVT log files.
How to install
Clone the git repository
Create a virtual environment with virtualenv and activate it (optional)
Install requirements with
pip install -r requirements.txt
Install python-dateutil (from pip:
pip install python-dateutil) - http://labix.org/python-dateutil
Install python-evtx (from pip:
pip install python-evtx) - http://www.williballenthin.com/evtx/
You need to modify a variable in the tool because of the language localisation of the event logs
How to run
For old EVT files:
Convert your eventlogs to CSV format. You can use the free Microsoft Log Parser 2.2.
event2timeline.py -c -f csv_filename.csv
timeline/timeline-sessions.htmlin your favorite browser
The timeline is divided into two parts: a large timeline, and a smaller one. You can select what events to display on the large timeline by dragging your mouse on the smaller timeline. Events encompassed in the selected timespan will be displayed on the bigger timeline.
Post-Vista EVTX files are supported. Just run
event2timeline.py -e -f Security.evtx
This work is licensed under the GPL License http://www.gnu.org/licenses/gpl.txt