Repository navigation
Feature Request: Event Log ID / Sigma Summary #160
Description
Would be helpful if chainsaw could provide high level stats detailing the frequency of event code IDs observed in an Event Log, like Eric Zimmerman's evtxecmd tool. Potential usage would be chainsaw hunt --stats-only evtx_attack_samples.
Event ID Count
300 1
400 666
403 404
600 4,939
800 197
Another option --stats-only-sigma would produce a similar frequency table, but with a count of Sigma hits.
Thanks for this amazing tool!
Activity
dbissell6 commentedon Jan 10, 2024
I am creating a tool to plot this output, I was already planning on implementing this stats idea, i don't know if this helps anyone or not.
It also plots AWS logs and you can see how the stats output is looking for that.
https://github.com/dbissell6/Thundaga
Fuzzdkk commentedon Apr 27, 2026
Hi @ssnkhan, @alexkornitzer — flagging this in light of #228, just merged. That PR added a per-Channel preamble inside
chainsaw analyse gaps(record counts + time ranges per channel), which is adjacent to but not the same as what's asked here: this issue wants per-Event-ID and per-Sigma-hit frequency tables, not per-Channel.The single-pass walker that builds the counters is in place now though. Two possible directions if you'd still like the feature:
--stats-onlyproposal: e.g.chainsaw analyse stats <input>with--by-event-idand--by-rule(sigma hit counts) modes.analyse gapswith an--include-event-id-countsflag — smaller diff, but the feature lives inside an unrelated subcommand.Happy to PR whichever you prefer (or close this if it's no longer in scope).
alexkornitzer commentedon Apr 28, 2026
So I think
analyse evtxwould be the way to go for the first feature, as this would let us provide generic summary statistics aboutevtxfiles (can then add other files types as required) and strives to keep Chainsaw generic in commands where it makes sense.The Sigma count one would need to be added to hunt, so that would be about extending
huntwith a--statisticsflag, but I have a feeling that won't be a small lift as care has to be taken to ensure that it does not degrade performance.feat: add analyse evtx subcommand for per-Event-ID summary stats (#231)