EVTX
- 12 Jun 2025
- 2 Minutes to read
- Print
- Dark
EVTX
- Updated on 12 Jun 2025
- 2 Minutes to read
- Print
- Dark
Article summary
Did you find this summary helpful?
Thank you for your feedback!
Overview
This Adapter allows you to ingest and convert a .evtx
file into LimaCharlie. The .evtx
files are the binary format used by Microsoft for Windows Event Logs. This is useful to ingest historical Windows Event Logs, for example during an Incident Response (IR) engagement.
For real-time collection of Windows Event Logs, see the Windows Event Logs documentation.
Configurations
Adapter Type: evtx
client_options
: common configuration for adapter as defined here.file_path
: path to the.evtx
file to ingest.
Infrastructure as Code Deployment
API Doc
See the unofficial documentation on EVTX.
Was this article helpful?