EIDVault

Browse Windows Event IDs (EIDs) with ATT&CK mappings, investigation notes, and detection guidance - on-device, no network required.

EIDVault is a comprehensive reference for Windows® EVTX log channels relevant to cybersecurity and DFIR. Event IDs (EIDs) are enriched with investigative notes, detection rules (KQL, Sigma, and more), and MITRE ATT&CK® mappings for fast, context-rich lookups. The Scenarios tab takes it further - describe an attack technique or investigation scenario and on-device intelligence surfaces the relevant EIDs with context. Share EID details as plain text or formatted Markdown for easy documentation or collaboration.