EventWhisper
Provides fast, scriptable access to Windows `.evtx` logs through a Model Context Protocol server.
About
EventWhisper offers a pure Python solution for interacting with Windows Event Logs (`.evtx` files), specifically designed for incident response, digital forensics, and threat hunting. It functions as an MCP server, enabling clients like Claude Desktop to list EVTX files and apply targeted filters to search for specific event records. By avoiding PowerShell wrappers and direct command execution, EventWhisper enhances safety during investigations and streamlines the process of analyzing Windows event data.
Key Features
- List EVTX files (optionally recursive) for any directory
- Filter events by time window, EventID(s), and case-insensitive keywords (include/exclude)
- Project specific fields to return only necessary data
- Accepts flexible input formats for robust operation
- MCP-ready for seamless integration with Claude Desktop and other clients
- 17 GitHub stars
Use Cases
- Performing incident response and digital forensics on Windows systems
- Conducting threat hunting by efficiently sifting through event logs
- Scripting automated analysis of Windows `.evtx` log files
Advertisement