Generating Log Timelines

Generate timeline based on Windows Event logs using EvtxECmd.exe

EvtxECmd.exe -f "C:\path\to\single\log\security.etvx" --csvf "C:\output\folder" FileName

Or to generate a CSV based on multiple Evtx logs stored within a single directory (or recursive directories)

EvtxECmd.exe -d "C:\path\to\multiple\logs" --csvf "C:\output\folder" BigTimeline.csv

-f denotes single file
-d denotes directory to parse
-csv for directory, save file as default name (date/time format_Evtx_ECmd_Output.csv)
-csvf for directory and to set filename "BigTimeline.csv"

Review CSV using timeline explorer

Last updated