microsoft/EventLogExpert v26.7.23.1393

v26.7.23.1393

Repository: microsoft/EventLogExpert

Tag: v26.7.23.1393

Published: 2026-07-23T23:39:34Z

Prerelease: yes

Release notes: All changes since the last stable release (v26.7.10.1209).

Highlights

• Event timeline histogram — a toggleable timeline strip above the event table plots event volume over time and doubles as a navigator: WPA-style cursor-anchored zoom and pan, a Scope lens that drills the table into the visible time window (with undo), and Group by dimensions that split each bar into stacked bands — severity, source, event ID, task category, opcode, log, Logon Type, Ticket Encryption Type, process image, and an update/servicing Error Code dimension with curated HRESULT labels. In-view Find (Ctrl+F) matches show as markers along the top. It's hidden by default, update scenarios turn it on, and your choice is remembered. See Event Timeline Histogram below.
• Channel readiness & in-app channel enablement — scenarios and the live-logs menu now show each channel's real state — present, enabled, or access-denied (detected via a native Win32 channel-access probe) — so a scenario that needs an unreadable channel is flagged instead of failing on launch. When EventLogExpert is already running elevated, a required-but-disabled channel gets an Enable channel button that turns it on in place; non-elevated users get an honest "restart as administrator" hint. See Channel Readiness below.
• Find in the current view with Ctrl+F — an incremental, in-view Find bar searches the events you're already looking at and highlights matches as you type, with an inline match count, prev/next navigation (buttons, Enter / Shift+Enter, F3 / Shift+F3, with wrap-around), and Match case / Match whole word options. It searches the visible columns plus the always-on Description, scrolls the current match into view, and in grouped mode expands a collapsed group to reveal a hidden match (then re-collapses it once you move on). See Find in View below.
• Details Pane reader view — the Details Pane gains a Details | XML tab strip. The Details tab decodes an event's structured Event Data / User Data into named fields (arrays one per line, a hex preview for binary, muted placeholders for empty values), adds inline explanations for common values (a Logon Type decoder and a small curated Security-Auditing glossary), and offers per-field, per-section, and whole-event copy. The pane was re-laid-out into a metadata rail — identity, Level severity, and a correlation block — beside the message and data payload, and its header and tab bar were merged into a single row. See Details Pane below.
• Severity shown by shape, not just color — every level now has a distinct icon shared by the event table and the Details Pane (Critical = filled octagon, Error = circle, Warning = triangle, Information = info-circle, Verbose = hollow circle), so severity stays legible for color-vision differences and in Windows high-contrast / forced-colors mode. See Details Pane below.
• Filter lenses — transient, reversible narrowing — a new lens stack layers temporary narrowing on top of your filters *without* touching the saved filter or exports. From an event's right-click menu: Show Related by Activity ID, Show Events Sharing Related Activity ID, Show Parent Activity, and Show Events Near This Time (a centered ±30s … ±1h window). Active lenses appear as removable breadcrumb chips above the table, Esc pops the top lens, and a lens clears itself automatically when you close the log it came from. See Filter Lenses below.
• Launch a scenario against a folder of exported logs — point a scenario at a folder of exported .evtx files and it opens the files whose channels the scenario targets, matched by channel name — so a curated triage scenario works against logs collected from another machine, not just the channels present on the local host. See Scenarios below.
• Opcode and Related Activity ID event fields — events now expose their Opcode (resolved to its name, matching Event Viewer's precedence) and Related Activity ID. Both show in the reader view and are available as filter properties with value suggestions in the Basic filter editor. See Opcode & Related Activity ID below.
• Multi-value filtering (any-of / none-of) — Basic filter rows gain operator-aware multi-select matching, so one row can match any of several values or exclude all of them, including on named Event Data and User Data fields via Contains-Any. Empty values are handled safely so a stray blank can't quietly turn a filter into a match-all, and several built-in scenarios were refactored onto these collapsed multi-value rows. See Multi-Value Filtering below.
• Redesigned status bar — the status bar was rebuilt into a structured left / right layout: the active source and thousands-separated counts ("1,234 events", "200 of 1,234 shown" when narrowed, "3 selected" for a multi-select) plus a read-only Filtered indicator on the left; transient loading / failed / live-channel / resolver activity on the right. It also fixes a screen-reader defect where the entire bar re-announced on every count tick. See Status Bar below.
• Sharper threat-hunting and update-triage scenarios — the built-in LOLBin and encoded-PowerShell scenarios were moved off brittle Description-text matching onto precise Event Data fields (NewProcessName, CommandLine), and the Windows Update / servicing triage scenarios were fixed and extended (servicing outcomes, reboot/crash correlation). See Scenarios below.

Features

• An event timeline histogram above the table (View → Timeline) with cursor-anchored zoom, pan, a Scope drill-down lens, undo, and Group by dimensions — see Event Timeline Histogram below.
• Group the timeline by severity, source, event ID, task category, opcode, log, Logon Type, Ticket Encryption Type, process image, or update/servicing Error Code (labeled with the hex HRESULT plus a curated CBS/WU symbol when known).
• Channel readiness in the scenario detail view, the empty-state dashboard, and the live-logs menu — per-channel present / enabled / access-denied status tags, with an inline "requires elevation" hint on denied live channels — see Channel Readiness below.
• **Enable a disabled channel in...