map event IDs to ATT&CK techniques · 4624 logon · 4688 process · 7045 service · 4698 scheduled task · lateral movement
drop EVTX
Drop .evtx or exported XML event log
parses EVTX chunks and maps events to MITRE ATT&CK — runs locally
status
drop EVTX file or XML event export for deep analysis