Tidewatch
Windows event logs (.evtx)
Open, search and threat-hunt .evtx event logs natively on a Mac.
- Millions of events searched in milliseconds
- Built-in detections mapped to MITRE ATT&CK
- Runs the Sigma rule library
macOS 11+ · Apple Silicon & Intel
Visit Tidewatch →
Sediment
$MFT · USN journal · Prefetch
Explore NTFS and execution artifacts, with the links between them.
- Folder tree, deleted entries and timestomping from the
$MFT - USN journal history for every file
- Prefetch with known attacker tools flagged
Windows · macOS · Linux
Visit Sediment →