Event2Timeline is a free tool based on D3js to graph Microsoft Windows sessions events. It parses both EVTX event logs from post Vista systems (Vista, Windows 7, Windows 8), and CSV exports of the legacy EVT log files.
-
Clone the git repository
-
Create a virtual environment with virtualenv and activate it (optional)
-
Install requirements with
pip install -r requirements.txt
Alternatively:
-
Install python-dateutil (from pip:
pip install python-dateutil) - http://labix.org/python-dateutil -
Install python-evtx (from pip:
pip install python-evtx) - http://www.williballenthin.com/evtx/ -
You need to modify a variable in the tool because of the language localisation of the event logs
For old EVT files:
-
Convert your eventlogs to CSV format. You can use the free Microsoft Log Parser 2.2.
-
Run
event2timeline.py -c -f csv_filename.csv -
Open
timeline/timeline-sessions.htmlin your favorite browser
The timeline is divided into two parts: a large timeline, and a smaller one. You can select what events to display on the large timeline by dragging your mouse on the smaller timeline. Events encompassed in the selected timespan will be displayed on the bigger timeline.
Post-Vista EVTX files are supported. Just run event2timeline.py -e -f Security.evtx
This work is licensed under the GPL License http://www.gnu.org/licenses/gpl.txt