drop evtx csvs from multiple channels · detect timestamp inconsistencies between channels that should be synchronized · identify events that contradict each other temporally · surface clock manipulation artifacts across log sources · runs locally
evtx csv
drop evtx csv (multi-file)
or click
7045↔4697 · 4624↔TS-21 · 4688↔Sysmon-1 · NTP 37 · Δ<2s normal · 2–30s suspicious · >30s critical
drop evtx csv exports from multiple channels