Summarise EVTX channel, provider and event-ID coverage, including missing metadata.

Runs native analysis and a streamed dump pass. The inline per_file list is a bounded preview; page handle for full files, coverage_handle for identity counts, and diagnostics.handle for all runner messages. Missing Channel in ETW is not evidence of corruption, and successful exit does not establish complete parsing.

Detect chronological or EventRecordID discontinuities for investigation.

Curated or filtered samples naturally contain gaps; these are not proof of deletion. Correlate with acquisition history and Security 1102 / System 104.

Build an execution timeline from the shimcache with optional Amcache enrichment.

Wraps chainsaw analyse shimcache. Output is CSV stored under a result handle; the preview holds the first rows. Use chainsaw_result_export for the full file.

Analyse the System Resource Usage Monitor (SRUM) database.

Wraps chainsaw analyse srum. Output is stored under a result handle; use chainsaw_result_export for the complete text.

Delete a custom rule. Bundled Chainsaw and Sigma rules cannot be deleted.

Convert every record in the evidence to JSON under a result handle.

Wraps chainsaw dump. Use it when a hunt or search has narrowed the scope to one or two files and you need the complete record stream; page through the handle.

Describe a Sigma-to-event-log mapping file: groups, filters, field translations.

Mappings decide which Sigma logsources apply to which Windows events. Read this when a Sigma rule you expect is not firing.

Read one rule's YAML and parsed summary, or list a rule directory.

Hunt evidence with Sigma and Chainsaw detection rules.

Runs chainsaw hunt over the given paths, stores every detection as JSONL under a server-minted result handle, and returns aggregate counts (by rule, level, host, channel, event ID, hour) with a small preview. Prefer this over reading raw events.

Send selected result rows to TypeSafe Jev for advisory classification and priority.

EXTERNAL DATA TRANSFER: sends the selected evidence fields to api.typesafe.ai. Requires CHAINSAW_JEV_ENABLED=true and credentials. One bounded API request per call, no retries. Returns source row indexes, probabilities and confidence; invalid answers fail only their source row, with both scores null and a named error; invalid response containers reject the batch. Each assessment lists all uncertain_reasons: insufficient_context, low_classification_confidence, low_priority_confidence or validation_failed. uncertain is true when reasons exist. Scores are model judgments, not confirmed findings. Review the original evidence before acting. Evidence and stored results are unchanged.

Validate rules with chainsaw lint and report which files fail to load and why.

Run it after chainsaw_save_rule, or on a Sigma sub-tree to see unsupported modifiers.

List artefact files below an evidence path with sizes and types.

Use it to scope a hunt: pick directories or individual .evtx files instead of hunting an entire mount. Follow next_offset until null for a complete inventory; the evidence tree must remain unchanged between pages.

Pivot process GUIDs in explicitly scoped original evidence, including unmatched events.

Supply files from one investigation (not a shared evidence root) and an exact host. Each hop queries process/parent GUIDs; output is capped and reports incomplete traversal.

Read UTF-8 text chunks of a file or oversized JSON row. Resume next_byte_offset.

Delete a stored result and its metadata. Evidence files are never touched.

Page unique source-qualified events, retaining every associated rule match.

Render a stored result as CSV or JSONL text for reports or other tools.

Large results are capped by rows and encoded response bytes; resume next_offset. CSV pages repeat their header. For stored text files resume next_byte_offset; those UTF-8 chunks may split records and must be concatenated before parsing.

Discover the field paths present in a result so you can project or group on them.

Returns each dotted path with how many sampled rows carry it and an example value.

List stored result handles, newest first, with tool, inputs and row counts.

Read a page of rows from a stored result, optionally projected and filtered.

Rows are chainsaw detections (hunt) or raw documents (search, dump). Iterate with next_offset until it is null.

Aggregate a stored result without paging through it.

Use the default overview to understand a hunt, then group by specific event fields (users, processes, source IPs, logon IDs) to build pivots for chainsaw_search.

Count installed Chainsaw, Sigma and custom rules by level and status, plus mappings.

Also lists the Sigma collections present; pass those names to chainsaw_hunt's sigma_collections when you want threat-hunting or emerging-threat rules included.

Save an analyst-authored Chainsaw rule into the custom rules directory.

Saved rules are hunted with extra_rules=['custom']. The file is linted before the result is returned; a failing lint still leaves the file in place so it can be fixed with another save using overwrite=true.

Search evidence for keywords, regular expressions, or tau field expressions.

Runs chainsaw search; each matching document is stored under a result handle and summarised by host, channel, event ID and hour. Use tau expressions to pivot on a specific field (for example a LogonId, process GUID, or user) after a hunt.

Find detection rules by keyword, ATT&CK tag, level, status or logsource.

Use it to explain a detection name from a hunt, to check coverage for a technique, or to pick a sub-tree for a focused hunt. Returns rule URIs readable as resources.

Report server configuration, chainsaw version, rule counts and evidence roots.

Call this first to learn which evidence roots and rule sets are available, and whether the chainsaw binary is installed.