EventWhisper

EventWhisper is an MCP server that provides direct access to Windows EVTX log files through Claude and other MCP clients.

It delivers scriptable, filtered querying of Windows event logs without requiring PowerShell execution or command-line tools.

Features

• 🔍 Targeted filtering – Narrow results by time window, specific Event IDs, or case-insensitive keywords (with include/exclude options).
• 📦 Field projection – Return only the exact data fields you need using dotted paths, dramatically reducing output size.
• 🔄 Input normalization – Handles flexible input formats so minor formatting errors won’t break your queries.
• ⚡ MCP-ready integration – Plugs directly into Claude Desktop and other MCP clients for natural language analysis.
• 📁 Recursive directory scanning – List EVTX files across entire directory structures with a single command.

Use Cases

• When you’re hunting for evidence of PowerShell exploitation, you can filter Security.evtx for “powershell” and “Invoke-” in command lines without remembering the exact Event ID 4104 structure. EventWhisper handles the parsing so you get straight to the suspicious activity.
• During incident response, you need to quickly check if a specific user logged in during off-hours. Instead of digging through Event Viewer or crafting complex PowerShell commands, you ask Claude to use EventWhisper to find logon events (Event ID 4624) for that user between 2-5 AM.
• When analyzing a potentially compromised system, you want to see all process creation events (Event ID 4688) that occurred during a specific time window. EventWhisper lets you specify the exact time range and fields you need, skipping irrelevant data that would otherwise overwhelm your analysis.
• For routine monitoring, you’ve noticed suspicious patterns in Application.evtx logs. Rather than manually checking each day, you set up a script using EventWhisper’s API to automatically flag specific error patterns before they become critical issues.

How to Use It

1. Install Poetry on Windows using PowerShell:

(Invoke-WebRequest -Uri https://install.python-poetry.org -UseBasicParsing).Content | py -

2. Add Poetry to your PATH by including this directory:

C:\Users\<YourUser>\AppData\Roaming\Python\Scripts

3. Verify the installation works:

poetry --version

4. Clone and install EventWhisper:

git clone https://github.com/hexastrike/eventwhisper
cd eventwhisper
poetry install

5. Start the MCP server:

poetry run python -m eventwhisper.mcp.server

6. Configure Claude Desktop by adding this to %AppData%\Claude\claude_desktop_config.json:

{
  "mcpServers": {
    "EventWhisper": {
      "type": "stdio",
      "command": "poetry",
      "args": [
        "-C",
        "C:\\Path\\To\\eventwhisper",
        "run",
        "python",
        "-m",
        "eventwhisper.mcp.server"
      ],
      "env": { "PYTHONIOENCODING": "utf-8" }
    }
  }
}

7. The core function get_events_from_evtx() accepts these parameters:

• provider: Path to EVTX file or directory (string or Path object)
• start/end: Datetime objects or string representations for time filtering
• results_limit: Maximum number of events to return (default: 100)
• event_ids: Single or multiple Event IDs to filter on
• contains/not_contains: Keywords to include or exclude (case-insensitive)
• fields: Specific data fields to return using dotted paths (e.g., “Event.System.EventID”)

When running queries, remember Windows paths work best with raw strings in Python (r"C:\path\file.evtx"). If files appear blocked (common when downloaded), right-click → Properties → Unblock before analysis.

FAQs

Q: Why use EventWhisper instead of PowerShell for event log analysis?
A: EventWhisper doesn’t execute commands on the host system, making it safer during incident response. It handles the parsing complexity so you can focus on analysis rather than remembering PowerShell syntax. The MCP integration with Claude lets you use natural language queries instead of memorizing Event IDs.

Q: I’m getting incomplete results from large EVTX files. What’s happening?
A: EventWhisper caps results at 100 events by default (RESULTS_LIMIT) and scanning at 10,000 events (SCAN_LIMIT) to keep responses fast. If you need more data, refine your query with tighter time windows or specific Event IDs to get more relevant results within the limits.

Q: How do I handle EVTX files that show as “blocked” after downloading?
A: Right-click the file → Properties → check “Unblock” at the bottom of the General tab. This is a Windows security feature that affects files downloaded from the internet, not an EventWhisper issue.