EventWhisper는 MCP(Model Context Protocol) 서버를 통해 Windows .evtx] 로그에 빠른 스크립트를 제공합니다. 그것은 순수 파이썬 ([T1]] 라이브러리를 사용), 대신 PowerShell 래퍼와 호스트에 명령을 실행하지 않습니다 - 사건 응답에 대한 더 안전한, 디지털 법의, 및 위협 사냥.

서버는 두 가지 기본 도구를 노출:

• 어떤 디렉토리에 EVTX 파일 (선택적으로 recursive) 목록.
• 특정 레코드에 대한 직접 검색 필터 이벤트.

IR/DFIR & hunting에 특히 내장되어있어 이벤트 ID를 매일 볼 필요가 없습니다. Claude와 Windows에서 설계, 개발 및 테스트 - 모든 MCP 클라이언트에서 사용 가능.

---

특징

-Targeted filtering: time window, EventID(s), case-insensitive 키워드(include/exclude) -Field projection: 필요한 dotted 경로만 반환합니다(huge output reduce) -Input normalization: 유연한 입력 형식을 허용하므로 타입/format이 완벽하지 않은 경우도 여전히 작동합니다.

• MCP-ready: Claude Desktop에 플러그(다른 MCP 클라이언트)

---

데모

https://github.com/user-attachments/assets/e1878c86-56f6-466b-bbc4-04d1edeeb36b https://github.com/user-attachments/assets/e1878c86-56f6-466b-bbc4-04d1edeeb36b]] [T2]] [T2]] [T2]] [T2]] [T2]] [T2]] [T2] [T2]] [T2] [T2]] [T2]] [T2]] [T2] [T2]] [T2]] [T2] [T2]] [T2]] [T2] [T2]] [T2]] [T2]] [T2] [T2]] [T2] https://github.com/user-attachments/assets/e1878c86-56f6-466b-bbc4-04d1edeeb36b]] https://github.com/user-attachments/assets/e1878c86-56f6-466b-bbc4-04d1edeeb36b]]] [[https://github.com/user-attachments/assets/e1878c86-56f6-466b-bbc4-04d1edeeb36b]]]]]]]]]]]] [[[[[[[[[https://github.com/user-attachments/assets/e1878c86-56f6-466b-bbc4-04d1edeeb36b]]]]]]]]]]]]]]]] [[[[[[[[[[[[[https://github.com/user-attachments/assets/e1878c86-56f6-466b-bbc4-04d1edeeb36b]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]

---

요구 사항 (Windows)

EventWhisper — A Windows Event Log MCP

EventWhisper exposes fast, scriptable access to Windows .evtx logs via an MCP (Model Context Protocol) server. It’s pure Python (uses the evtx library), instead of a PowerShell wrapper and does not execute commands on the host — safer for incident response, digital forensics, and threat hunting.

The server exposes two primary tools:

• List EVTX files (optionally recursive) for any directory.
• Filter events to directly search for specific records.

Built specifically for IR/DFIR & hunting so you don’t need to look up Event IDs all day. Designed, developed, and tested on Windows with Claude — and usable from any MCP client.

---

Features

• Targeted filtering: time window, EventID(s), and case-insensitive keywords (include/exclude)
• Field projection: return only the dotted paths you need (huge output reduction)
• Input normalization: accepts flexible input formats so it still works if types/format aren’t perfect.
• MCP-ready: plugs into Claude Desktop (and other MCP clients)

---

Demo

https://github.com/user-attachments/assets/e1878c86-56f6-466b-bbc4-04d1edeeb36b

---

Requirements (Windows)

EventWhisper can be set up with Poetry, whether you run it inside Claude or standalone. On Windows, make sure Poetry is on your PATH.

Install Poetry (PowerShell):

(Invoke-WebRequest -Uri https://install.python-poetry.org -UseBasicParsing).Content | py -

Add Poetry to PATH (user install):

C:\Users\\AppData\Roaming\Python\Scripts

Verify:

poetry --version

---

Install & Run

Primarily developed for use with Claude, but you can run the MCP server standalone and plug it into other LLMs.

Clone and install:

git clone https://github.com/hexastrike/eventwhisper
cd eventwhisper
poetry install

Run the MCP server:

poetry run python -m eventwhisper.mcp.server
# (or) plain Python if deps are installed globally:
python -m eventwhisper.mcp.server

---

Claude MCP configuration

Add this to Claude Desktop’s MCP config (e.g., %AppData%\Claude\claude_desktop_config.json):

{
  "mcpServers": {
    "EventWhisper": {
      "type": "stdio",
      "command": "poetry",
      "args": [
        "-C",
        "C:\\Path\\To\\eventwhisper",
        "run",
        "python",
        "-m",