Sysmon Event Analyzer

Paste Sysmon log lines and see counts by EventID plus the images mentioned.

Runs in your browser. Nothing is uploaded — your input is processed on this device and discarded when you close the tab.

Sysmon Event Analyzer

How to use this tool

  1. Enter your values in the fields above.
  2. Press Generate to see the result.
  3. Use Load sample to try the worked example, Copy result to copy it, or Clear to start again.

Worked example

Two EventID 1 lines and one EventID 11 line give a total of 3 events analysed, with EventID 1 counted as 2 and EventID 11 as 1.

What this tool does not do / Limits

This analyzer only counts the log lines you paste. It does not connect to a live computer, verify events, or explain what caused them.

Frequently asked questions

Does this read logs from my computer?

No. Only the text you paste into the box is analysed, in your browser.

What EventIDs does it recognise?

Any EventID number in the pasted lines is counted, so the counts adapt to whatever you paste.

Related tools

JSON Studio

Format, validate, minify, query and compare JSON in your browser, with precise line-and-column errors.

Live

Regex Tester

Test patterns against sample text with match highlighting, capture groups and a safe one-second timeout.

Live

Security Header and DNS Checker

Check HSTS, CSP and other security headers, TLS details, and DNS/email authentication records (SPF, DKIM, DMARC).

Live