Skip to content

Winnow

separate the signal from the noise

Get started Your first triage
Winnow filtering an EvtxECmd table with a shipped filter, narrowing it to one user, tagging four rows and opening the Timeline

Winnow is a local viewer for the very large CSV and log exports DFIR triage produces: filter a table down, tag the rows that matter, and read the findings back across the case.

Features

Saved filters

Saved once, offered on every table with the same columns. 28 ship for EvtxECmd, RECmd and MFTECmd output, and [ ] step through them.

See it in action
The Filters menu on an EvtxECmd table, listing the shipped EVTX triage filters

Timeframe filter

Kept apart from the other filters: clearing them or stepping through saved ones leaves it on. One range for the whole case, or one per table.

See it in action
The Timeframe filter dialog with a start and end time across all datetime columns

Histogram

When the rows in view happened, colored by tag, by one value or by group. Drag across it to set the timeframe.

See it in action
The histogram above the grid, coloring one user's logons among all the logons

Derived columns

Sortable times from epochs and FILETIMEs, fields out of JSON and XML, regex captures, decodes, and lookups into another table. The original column is never changed.

See it in action
The Add derived column dialog lifting a field out of each row's JSON payload, with a preview

SQL pane

Read-only SQL over every table in the case, with its tags, notes and derived columns. Tag the rows a query returns, export them, or save them as a table.

See it in action
A query counting failed logons per user and host, with its results

First and last plugin

Thousands of events down to the first and last of each group, per host or per user, as a new table you can tag and export.

See it in action
The first_last plugin grouping logons by host, listing the first and last event of each

Pivot tables plugin

A cross-tab of any table, merged ones included: drag fields into rows, columns and values, and filter by tag.

See it in action
The pivot plugin counting events per host and user against event IDs

Your first triage

With an EvtxECmd export as the example:

  1. Install and start it. pip install -r requirements.txt, then python server.py. (Installation)
  2. Make a case. + New case, name it, Create case. Pick the KAPE triage profile to also get a dashboard and a starter watchlist. (Cases and importing)
  3. Import. Import files…, Add from this machine…, then Import 1 file. For a whole KAPE output, Import a whole folder….
  4. Filter. Filters ▾ → EVTX — Logons, then narrow it by typing under any column: !svchost, =4624, ^C:\Users. (Filtering and searching)
  5. Tag. Select rows and press 1 for TA, 2 for Suspicious, 3 for Benign. Shift+1 tags the whole view; Ctrl+Z undoes. (Tagging and notes)
  6. Read it back. The Timeline tab lists every tagged row from every table in time order. Search all (s) sweeps the case for a list of indicators. (Timeline, Search all and the Watchlist)
  7. Hand it on. Case ▾ → Export… writes the tagged rows to Excel. The case itself is one .db-winnow file you can copy. (Sessions and export)

Pages

Good to know

  • The evidence is never modified. Tags, notes and derived columns live beside the imported rows.
  • One case, one Winnow. Open a case in one Winnow at a time, from a local disk. Two analysts work in separate cases and swap session files.
  • Closing the window stops Winnow a couple of minutes later, unless it was started with --no-idle-shutdown.
  • Nothing reaches the network unless you check for an update or turn on a plugin that uses it, such as claude_assistant.