DeepDig

1. Getting started

1. Launch DeepDig. It starts as a normal app (no prompt). If it isn’t running as administrator, a hint appears with a Restart as administrator button — admin rights unlock the live Security log and a few machine-wide registry checks. (You can also just open an exported .evtx file, which needs no admin.)
2. Pick how far back to look with Range — Last 24 hours, 7 days, 30 days, or All available (the default). A narrower range scans considerably faster, because the event log itself does the filtering rather than DeepDig reading everything and discarding most of it. All available reads ordinary logs in full — up to the newest 50,000 events per log on this PC, and 200,000 per .evtx file. If a very large log is cut short, a Partial scan line appears under the status; hover it to see which logs were affected and how far back each reached.
3. Click Scan This PC to analyze this machine, or Open .evtx to analyze exported logs from other machines. You can select several .evtx files at once, or drag a batch onto the window — they are analyzed and correlated as a single timeline. A file that turns out to be unreadable is skipped without losing the rest of the batch.
4. Results appear in seconds. For a local scan, a security audit then runs automatically.

The top cards summarize Critical / High / Medium / Low incidents and the number of events scanned.

A long scan can be stopped at any time with the Cancel button on the progress overlay.

2. Incidents

The default view. The left list shows correlated incidents (related alerts grouped together); select one to read its detail on the right:

• What happened — a plain-English narrative.
• Per-alert detail — explanation, recommended actions, and MITRE ATT&CK mapping.
• Triggering events — the raw Windows events behind the incident.

Use the search box and the severity dropdown above the list to narrow it down; the header shows how many of the total are currently visible, and Clear restores the full list.

Mark as expected hides an incident, and future identical ones, and is remembered across runs. The picker beside the button sets for how long — 7, 30 or 90 days (the default), or Always — after which the item reappears for another look. Critical items can be hidden for at most 90 days.

“Identical” means the same content: a different script, a changed registry value or a newly added exclusion shows up again even if you hid an earlier one.

• Evidence tampering can’t be hidden. An event log being cleared or Defender protection being switched off stays visible every time it happens (repeats still collapse into one card with a count).
• Encoded PowerShell launches are decoded and checked. One with no red flags is shown as Low and can be marked as expected for the tool that ran it; one that downloads code, bypasses antimalware scanning, changes Defender or hides its window is always shown on its own.

When anything is hidden, the header shows a count with two actions:

• Manage — review everything you have hidden, see whether each came from an event detection or a registry finding, and restore them one at a time. Each entry shows when its hide ends.
• Reset — stop hiding everything at once.

3. Trends & last reboot

Click Trends to see charts built from your results:

• Over time — a histogram of when things occurred.
• Top event types — the most frequent events (click any bar to see those events, newest first).
• By category / Top channels — a breakdown by attack category or log channel.
• Category detail — pick a category or channel from the dropdown to see its top event types (also clickable).

Use the Detections | All events toggle to switch every chart between active detections only and the entire scanned log.

Last reboot card

Above the tabs, a full-width card shows your last reboot (time, reason, and whether it was planned or unexpected). Click it for the full startup & shutdown history.

4. Security audit

After a Scan This PC, DeepDig runs a read-only security audit of the registry and Startup folders and adds a Security audit tab. (This is local-only — it does not run for imported .evtx files.) It checks for:

• Startup programs — Run / RunOnce keys (64- and 32-bit), Group Policy Run keys, and the Startup folders for all users and each user; shortcuts are resolved to what they actually run
• Logon shell and Userinit tampering, machine-wide and per user
• Program hijacks — IFEO debuggers (64- and 32-bit) and SilentProcessExit monitors
• UAC-bypass artifacts; Windows Defender switched off or given exclusions, including by Group Policy
• PowerShell execution-policy / logging weakening
• Services running from suspicious locations, and unquoted service paths — rated Critical if a hijack file already exists, High if ordinary users could plant one, Low if every folder on the way is protected
• Installed remote-access tools (AnyDesk, TeamViewer, etc.)
• USB device history and outbound RDP history (forensic / informational)

Each finding shows its location — a Registry path, or a File path for Startup-folder items — the evidence found, an explanation, a recommended action, and its MITRE ATT&CK ID. The location and evidence are selectable and each has a Copy button; file findings also have Show in Explorer. Use Mark as expected to silence authorised findings on future scans — if the value later changes, the finding comes back.

What was checked, at the bottom of the list, shows every check and its result, so a clean result is visibly a real one.

5. Live monitoring

Flip the Live toggle to stream new alerts in real time. DeepDig seeds a baseline scan, then updates the incidents as new events arrive. Turn it off (or close the app) to stop watching.

6. Export

Click Export to save the current incidents as CSV (spreadsheet) or JSON.

7. Tips & FAQ

Why restart as administrator?

The live Security event log and a few machine-wide registry checks require admin rights. Everything else — .evtx import, Application/System logs, most registry checks, USB history — works without admin. (The Microsoft Store build can’t elevate, so use the .evtx path there for full coverage.)

Nothing notable was found

That’s good news — it means no rules matched your logs.

A finding looks legitimate (e.g. a remote-access tool you installed)

Use Mark as expected to hide it on future scans.

The Security audit tab is missing

It only appears after a local Scan This PC, not for imported .evtx files.

Where are the logs?

DeepDig keeps a local log on your PC (last few days only) — handy if you ever need to report an issue. Nothing is sent anywhere.

A scan is taking too long

Press Cancel on the progress overlay, then narrow Range and try again.

I see more (older) incidents than before

Since version 1.4.0, All available reads default-size logs in full instead of only their newest few thousand events, so older activity now shows up too. Narrow Range if you only want recent events.

DeepDig is already open

Only one window runs at a time — launching it again simply brings the open window to the front.

“No events found”

The selected Range may be narrower than how long your PC keeps its logs — widen it to All available.

An incident I hid hasn’t come back

Open Manage next to the hidden-item count and remove it there; DeepDig rescans so it reappears. Hides set for 7, 30 or 90 days also lapse on their own.

8. Appearance

DeepDig follows your Windows light / dark setting automatically, including when you change it while the app is running (Settings → Personalization → Colors). There is nothing to configure.