How to Export Windows Event Logs for Security Triage
Summary
A practical guide to exporting Windows event logs in EVTX format with Event Viewer, wevtutil, or PowerShell, and reviewing them for security investigations. It covers permissions, audit settings, filtering, remote collection, and log retention.
Key points
- EVTX preserves event fields, record IDs, and UTC timestamps; export logs with Event Viewer or wevtutil rather than copying live files from the Windows log directory.
- Security-log exports may require an elevated prompt; Event Log Readers can access most logs, but audit policy determines which events were recorded.
- Use wevtutil to export whole logs or filter by time and event IDs; filtered exports can reduce unnecessary data collection.
- PowerShell and wevtutil remote exports can collect logs from multiple machines, but remote exports are written to the target machine and require appropriate access and firewall rules.
- Relevant channels include Security, System, Sysmon, PowerShell, Defender, Task Scheduler, and Terminal Services; some require auditing or components to be enabled.
- Log size and overwrite settings limit how far back events are available; check retention and use forwarded events or a SIEM when local logs are insufficient.
- The guide says LogTotal reads EVTX files natively and sanitizes uploads, while advising users to follow their data-handling policies.
Article Details
- Defense Focus
- Export Windows event logs in EVTX format and review them with detection logic to investigate security activity.
- Detection Methods
- Run Sigma detection logic against uploaded EVTX files in LogTotal.
- Filter event exports by event ID and time range using Event Viewer or XPath queries.
- Review relevant event records, including logons, account changes, service activity, process creation, PowerShell script blocks, Defender detections, scheduled tasks, and RDP sessions.
- Data Sources
- Windows Security log
- Windows System log
- Sysmon Operational log
- PowerShell Operational log
- Windows Defender Operational log
- TaskScheduler Operational log
- TerminalServices-LocalSessionManager Operational log
- Rule Types
- Sigma rules
- XPath queries for filtering Windows events
- Platforms
- LogTotal
- Defensive Actions
- Export logs through Event Viewer or wevtutil rather than copying live files from the Windows event-log directory.
- Check audit policy before investigating events that may not have been recorded, including process creation and PowerShell script-block logging.
- Check log size, retention, and oldest-event timestamps; use SIEM or forwarded events when local logs do not cover the relevant period.
- Use filtered exports on busy domain controllers to reduce unnecessary data.
- For remote exports, confirm target permissions and Remote Event Log Management firewall rules, and retrieve the output from the remote machine.
- Apply data-handling policies before uploading logs containing usernames, hostnames, or IP addresses.
MITRE ATT&CK
T1070.001 · Clear Windows Event LogsThe article cites detections for attackers clearing logs and identifies Windows log-cleared events 1102 and 104.T1110 · Brute ForceThe article cites password-guessing detections among the Windows event-log Sigma rules.T1543.003 · Windows ServiceThe article cites detections for malicious services among the Windows event-log Sigma rules.
Vendors
Products
LogTotalBelow is how to export the right logs, sanitize them, and investigate them for free in LogTotal.Microsoft WindowsThe short answer: open Event Viewer, right-click the log you need (for example Windows Logs → Security), choose Save All Events As…, and keep the .evtx format.Windows DefenderMicrosoft-Windows-Windows Defender/Operational Detections (1116) and actions taken (1117)Windows SysmonMicrosoft-Windows-Sysmon/Operational Process creation with hashes and command lines, network connections, and more Only if Sysmon is installed