Convert Windows Event Log .evtx to .csv

In my day job doing incident response, I find myself looking at a lot of Windows event logs. And I don’t know about the rest of you, but I do not find eventvwr.msc to be very user friendly to navigate and filter large files. If you are a XPATH master then sure, it’s probably just fine for you. I, however, am not.

I instead prefer to use the best incident response tool ever created – Microsoft Excel. Sorting, filtering, and searching is a snap!

The problem is in converting the binary XML .evtx files to csv. All the existing libraries and tools I have ever tried only break out the major fields in the event logs, leaving all the fields in the “Message” part of the events lumped together. All the good stuff I want to filter and search on is in locked away in there!

So I create a little script that breaks out every field in an event log into its own column. It iterates over the whole file to pull out the unique fields names from the sum of all events. So you end up with a column for every single field.

The script is on my github here: https://github.com/dewoodruff/evtx_to_csv

If you find it works for you please leave a comment. Or if there are improvements to be made, please submit a pull request!

Leave a Reply

Your email address will not be published. Required fields are marked *