<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Analyzing Windows Event Logs

## wevtutil (Windows)

| Command | Description |
|---|---|
| `wevtutil qe Security /c:50 /f:text` | Query last 50 Security events |
| `wevtutil qe Security /q:"*[System[EventID=4625]]" /f:text` | Filter by Event ID |
| `wevtutil epl Security C:\export\security.evtx` | Export log to EVTX |
| `wevtutil gl Security` | Get log configuration |
| `wevtutil cl Security` | Clear log (caution) |

## PowerShell Get-WinEvent

| Command | Description |
|---|---|
| `Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624}` | Query by Event ID |
| `Get-WinEvent -Path .\Security.evtx` | Read exported EVTX |
| `Get-WinEvent -FilterXPath "*[System[EventID=4688]]"` | XPath filter |

## python-evtx

```python
import Evtx.Evtx as evtx
# Open and iterate EVTX records
with evtx.Evtx("Security.evtx") as log:
    for record in log.records():
        print(record.xml())
```

## Agent Script

```bash
# Parse EVTX file
node agent.js parse Security.evtx

# Parse specific Event IDs
node agent.js parse Security.evtx --event-ids 4624 4625

# Summarize logon activity
node agent.js summarize-logons Security.evtx

# List critical Event IDs
node agent.js list-eids
```
