1. Conduid
  2. Developer Tools
  3. Eventsight
MCP server · Developer Tools

Eventsight

by · github.com/jonny-jhnson/EventSight

AI-powered Windows Event Log analyzer that learns from your feedback. Uses Claude AI with RAG to detect suspicious activity, improve accuracy over time, and share learnings across your team. CLI and MCP server interfaces.

Unclaimed MIT last commit 10 months ago devtools
InstallView source
58Fair

Scored 5 months ago · breakdown

About Eventsight

Eventsight is an MCP server published by jonny-jhnson in the Developer Tools category: aI-powered Windows Event Log analyzer that learns from your feedback. Uses Claude AI with RAG to detect suspicious activity, improve accuracy over time, and share learnings across your team. CLI and MCP server interfaces.

The repository has 38 stars and 10 forks, with the last commit 10 months ago. Six months or more without a commit doesn't mean the server is broken, but check the open issues before depending on it in production.

Install

From source
git clone https://github.com/jonny-jhnson/EventSight

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about Eventsight

Powered by Claude · Grounded in docs

I know everything about Eventsight. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

Static checks derived from the repository 5 days ago. Heuristics on the source, not an audit.

  • ✓README presentThe repository ships documentation.
  • ✓License declaredUsable under a stated license.
  • !Tests presentNo tests found. Behaviour changes may go unnoticed between versions.
  • ✓Dependencies pinnedA lockfile pins dependency versions.
  • !No dynamic code executionSource scan found eval or shell execution. Review how tool inputs reach it before granting credentials.
  • !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.

README

EventSight

AI-powered Windows Event Log analyzer that learns from analyst feedback.

Project Structure

This repository contains two related projects:

EventSight/
├── Eventsight/          # Standalone CLI tool
│   └── data/learnings/  # Shared learnings database
└── Eventsight-MCP/      # MCP server for Claude Code integration
    └── .mcp.json      # MCP configuration

Why Two Projects?

Eventsight Eventsight-MCP
Interface Command-line (CLI) MCP Server (Claude Code)
RAG Type Standard RAG Agentic RAG
Use Case Direct analysis & reporting Interactive analysis with Claude
Feedback Manual commands Natural language via Claude

Shared Resources

Both projects share the same learnings database, meaning:

  • Learnings created in either project benefit both
  • Correlation rules are shared
  • Analysis improvements compound over time

The shared data lives in Eventsight/data/learnings/:

  • learnings.db - Analyst learnings, correlation rules, and analysis history
  • events.db - Stored events from analyses (indexed by Event ID, timestamp, provider)
  • embeddings.npy - 384-dimensional vector embeddings for semantic search
  • event_embeddings.npy - Event embeddings for semantic event search

Eventsight (CLI)

The standalone command-line tool for Windows Event Log analysis.

Features:

  • Parse and analyze EVTX files
  • Batch processing with streaming output
  • Continuous monitoring mode with live HTML report (auto-refreshing dashboard)
  • Standard RAG for fast, deterministic learning retrieval
  • Interactive feedback mode
  • HTML/Markdown report generation

Quick Start:

cd Eventsight
uv sync
uv run eventsight evaluate Security.evtx --event-ids 4624,4688

See Eventsight/README.md for full documentation.

Eventsight-MCP (Claude Code Integration)

MCP server that brings EventSight capabilities into Claude Code with Agentic RAG.

Features:

  • All EventSight analysis capabilities via 16 MCP tools
  • Agentic RAG for intelligent feedback processing
  • Natural language interaction ("Finding #2 is our EDR, mark as benign")
  • Semantic event search
  • Export/import learnings for sharing between instances

Quick Start:

# From the Eventsight-MCP directory with Claude Code
cd Eventsight-MCP

# Then use tools like:
# - evaluate_evtx to analyze EVTX files
# - feedback to process analyst input using Agentic RAG
# - search_stored_events to find specific activity
# - export_learnings_package to share learnings

See Eventsight-MCP/README.md for full documentation.

RAG Approaches

Standard RAG (Eventsight)

Direct vector similarity search for learning retrieval:

  1. Query → Embedding → Similarity Search → Top-K Results
  2. Fast O(1) lookup by Event ID when available
  3. Deterministic, efficient for batch processing

Agentic RAG (Eventsight-MCP)

LLM-driven tool selection for intelligent processing:

  1. Query → LLM analyzes intent → Selects appropriate tools
  2. Can search events, create learnings, mark findings autonomously
  3. Better at understanding nuanced natural language feedback
  4. Creates higher-quality, generalizable learnings

License

MIT

README fetched from the repository 5 days ago. The original is authoritative.

Questions

About Eventsight

How do I install Eventsight?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Eventsight safe to use with an AI agent?

Its trust score is 58 out of 100 (fair). It passes 3 of the 6 static security checks run so far; the failures are listed above. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Eventsight still maintained?

The last commit was 10 months ago. That's long enough that you should check whether the maintainer is responding to issues before depending on it.