An independent reference
Clarity starts with context.
EventPeeker helps security analysts and IT professionals understand Windows and Sysmon events. The reference library explains fields, connects related events and offers practical investigation guidance.
An event is a starting point.
Event numbers can repeat across providers. Start with the source and channel, check the surrounding activity, and compare with your environment’s baseline. A query match or suspicious field is a lead to investigate, not proof of compromise.
How to use the reference
Use the field explanations and investigation steps alongside primary documentation and your local tools. Where provided, source links take you to Microsoft or MITRE documentation. Example queries require validation against your logging configuration and data schema.
A useful reference can be corrected.
Found an inaccurate explanation, missing context or a broken example? Send a correction with the relevant page and a sanitized description. Do not send sensitive event logs.
Inspect an event locally.
The XML decoder processes a single pasted event in your browser. Hosted file uploads and automated log analysis are no longer offered. See our privacy policy for analytics and data handling.