grokevt

Scripts for reading Microsoft Windows event log files

Platforms: Linux · Last verified September 6, 2026

GrokEVT is a collection of scripts built for reading Microsoft Windows NT/2000/XP/2003 event log files.

Only use this tool against systems you own or are explicitly authorized to test — see the disclaimer.

Getting started

See the official Kali tool page and upstream homepage linked above for installation and usage details.

Debian-based distribution built for penetration testing and security auditing