DeepDig – Windows Event Log Analyzer
Windows already records everything that happens on a machine — DeepDig makes sense of it. It reads the event logs your PC already keeps and turns thousands of cryptic entries into clear, plain-English security and stability incidents, each with a readable story and concrete remediation steps. Everything runs on your PC: no cloud, no account, no telemetry.
Download Version 1.4.0
Available on the Microsoft Store — no subscription, no ads.
Or view the listing at apps.microsoft.com.
From raw logs to real answers
Instead of leaving you to scroll through Event Viewer, DeepDig correlates related alerts into incidents — each with a plain-English narrative, severity, recommended actions and a MITRE ATT&CK mapping. On a local scan it also runs a read-only Registry Security Audit, surfacing persistence, privilege-escalation and defense-evasion risks with evidence and fixes. It reads only Windows’ own logs and registry, processes everything locally, and never uploads your data.
Changelog — what's new in each release
Full release history through 1.4.0 — whole-log scans about four times faster on a quarter of the memory, hides that expire, eight new detections (password spraying, encoded PowerShell, Defender tampering, lockouts and more), and a security audit that now reaches into Startup folders and unquoted service paths.
View the full changelogUser Guide — every step explained
A plain-English walkthrough of scanning this PC or an offline .evtx file, reading incidents and trends, the security audit, live monitoring, timed hides and exporting your findings.
Read the User GuideFeatures
🧩 Plain-English Incidents
Related alerts are correlated into incidents with a readable narrative, severity and recommended fixes — not just a wall of raw event IDs.
🛡️ Built-in Threat Detection
Detection rules covering credential access (brute force, password spraying, account lockouts), persistence, privilege escalation, lateral movement (including RDP logons), defense evasion (Defender switched off, exclusions added, threats it couldn’t remove, security services disabled, any log cleared), encoded PowerShell launches decoded and scored, execution, stability and performance.
🗂️ Live Scan or Offline .evtx
Scan this PC live, or import an exported .evtx file from another machine — one detection engine handles both. Drag-and-drop a log straight onto the window.
📡 Real-Time Live Monitoring
Flip on Live to stream new alerts as they happen, with continuously updated correlation so incidents stay current.
📊 Trends & Charts
Built-in charts show activity over time, top event types and category breakdowns. Click any bar to drill straight into the underlying events.
🔁 Last-Reboot Card
See your last boot time and reason, and whether it was planned or unexpected — click through for the full startup and shutdown history.
🧬 Security Audit
A read-only audit of startup keys (including Group Policy and 32-bit ones), Startup-folder shortcuts resolved to what they really run, Winlogon and per-user logon shells, IFEO and SilentProcessExit hijacks, unquoted service paths with real folder-permission checks, UAC-bypass artifacts, Defender disabling/exclusions, PowerShell policy, suspicious services, remote-access tools, and USB/RDP history — each with evidence, remediation and a MITRE ATT&CK mapping. A What was checked list proves a clean result really ran every check.
🧹 Noise Control & Export
Recurring detections collapse into a single “seen N×” card, anything you trust can be marked expected for 7, 30 or 90 days or for good (Critical items for at most 90 days), and a hidden item that changes resurfaces. Findings export to CSV or JSON. An expected-items manager lets you review everything you have hidden and restore items one at a time rather than all at once.
🔎 Triage Controls
Search and filter by severity across the incident list, with a live “X of Y” count. Narrow a scan to the last 24 hours, 7 days or 30 days — live channels are filtered at the source, so a narrower window is genuinely faster rather than read-then-discarded. A Cancel button stops a scan already under way.
⚡ Fast Whole-Log Scans
“All available” reads default-size logs in full — Security included. On a test machine a scan of all 70,000+ events takes about 7 seconds and under 90 MB, because event text is only formatted when you actually look at it. If a very large log hits the safety cap, the status line says which and how far back it reached.
🗃️ Several Files, One Timeline
Open several .evtx files at once — multi-select or drop a batch — and DeepDig analyses them as a single correlated timeline. A corrupt or locked file in the batch is skipped without costing you the rest. For an imported file, a time range is anchored on that file’s own newest event, so “last 7 days” of a months-old export still means its last 7 days.
.evtx file, which needs no admin.
Latest Release
Version 1.4.0 — October 14, 2026
Faster, lighter scans that read whole logs — a full scan went from 28 s to under 7 s on a quarter of the memory — and Mark as expected can now expire after 7, 30 or 90 days. It caps a run of releases (1.1.1–1.3.0) that added eight new detections including password spraying and decoded encoded-PowerShell launches, a Security audit tab covering Startup folders and unquoted service paths, and a long list of fixes that stop “expected” from hiding more than you meant.