Log Parser Studio is a great tool for searching Microsoft Event View Logs.

#LogParserStudio4IR

Adding custom queries created during Incident Response cases

Name		Name	Last commit message	Last commit date
Latest commit History 13 Commits
CSIRT Failed logon events RDP.sql		CSIRT Failed logon events RDP.sql
CSIRT Failed network logins..sql		CSIRT Failed network logins..sql
CSIRT New User Created .sql		CSIRT New User Created .sql
CSIRT New User Created.sql		CSIRT New User Created.sql
CSIRT Password change attempt.sql		CSIRT Password change attempt.sql
CSIRT Successful Login.sql		CSIRT Successful Login.sql
CSIRT Successful logons RDP ver. 3.sql		CSIRT Successful logons RDP ver. 3.sql
CSIRT SysMon Event Log Process Creation.SQL		CSIRT SysMon Event Log Process Creation.SQL
CSIRT TSC Local Session Manager - RDP Logins.sql		CSIRT TSC Local Session Manager - RDP Logins.sql
README.md		README.md