Home

Winnow is a local viewer for the very large CSV and log exports DFIR triage produces: filter a table down, tag the rows that matter, and read the findings back across the case.

Your first triage

With an EvtxECmd export as the example:

1. Install and start it. pip install -r requirements.txt, then python server.py. (Installation)
2. Make a case. + New case, name it, Create case. Pick KAPE triage on the left to also get a dashboard and a starter watchlist. (Cases and importing)
3. Import. Import files…, Add from this machine…, then Import 1 file. For a whole KAPE output, Import a whole folder….
4. Filter. Filters ▾ → EVTX — Logons, then narrow it by typing under any column: !svchost, =4624, ^C:\Users. (Filtering and searching)
5. Tag. Select rows and press 1 for TA, 2 for Suspicious, 3 for Benign. Shift+1 tags the whole view; Ctrl+Z undoes. (Tagging and notes)
6. Read it back. The Timeline tab lists every tagged row from every table in time order. Search all (s) sweeps the case for a list of indicators. (Timeline, Search all and the Watchlist)
7. Hand it on. Case ▾ → Export… writes the tagged rows to Excel. The case itself is one .db-winnow file you can copy. (Sessions and export)

Pages

Getting set up

• Installation: install, launch, update, uninstall.
• Cases and importing: case files and every import format.

Working a case

• Filtering and searching: filter syntax, saved filters, time ranges, search.
• Working with tables: columns, sorting, grouping, merging.
• Tagging and notes: tags, keys, undo, notes.
• Timeline, Search all and the Watchlist: reading across every table.
• Derived columns: timestamps from raw values, fields out of JSON and XML.

Going further

• Dashboards: boards, widgets, profiles.
• SQL pane: read-only queries over the case.
• Sessions and export: snapshots, hand-offs, exports.
• Plugins: the plugin manager and the bundled plugins.

Reference

• Settings and shortcuts: every setting and key.
• Troubleshooting: common problems and the log.
• Contributing: changing Winnow itself.
• Writing plugins: the plugin developer guide.

Good to know

• The evidence is never modified. Tags, notes and derived columns live beside the imported rows.
• One case, one Winnow. Open a case in one Winnow at a time, from a local disk. Two analysts work in separate cases and swap session files.
• Closing the window stops Winnow a couple of minutes later, unless it was started with --no-idle-shutdown.
• Nothing reaches the network unless you check for an update or turn on a plugin that uses it, such as claude_assistant.