Winlog Mcp

What is Winlog Mcp?

Winlog Mcp is a Model Context Protocol (MCP) tool for retrieving and analyzing Windows event logs (e.g., Sysmon). It provides programmatic access to ingest and query logs, making it useful for security monitoring, incident response, and log analysis automation.

How to use Winlog Mcp?

Install dependencies with pip install -r requirements.txt, then run the server using python main.py --storage-path \\PATH\\TO\\logs\\. Configure MCP clients (e.g., Claude Desktop) by adding the command and arguments to the appropriate configuration file. Two tools are available: ingest_syslog for ingesting recent Sysmon logs and query_syslog for querying logs by timestamp.

Key features of Winlog Mcp

• Ingest Windows Sysmon logs and store as files
• Query logs by timestamp for recent events
• Seamless interoperability with MCP tools and ecosystem
• Log files named <timestamp>_<log_type>.log

Use cases of Winlog Mcp

• Security monitoring and incident response via Sysmon analysis
• Automated log analysis and troubleshooting
• Querying recent event entries for investigation

FAQ from Winlog Mcp

What are the system requirements?

Windows operating system, Python 3.7 or higher, and the pywin32 dependency are required.

How are logs stored?

Logs are stored as files named <timestamp>_<log_type>.log in a user-defined storage directory.

What tools does Winlog Mcp provide?

Two tools: ingest_syslog ingests recent Sysmon logs and writes them to a file; query_syslog queries ingested logs by timestamp and returns recent events.

How do I integrate Winlog Mcp with Claude Desktop?

Add the configuration to %APPDATA%\Claude\claude_desktop_config.json with the command python and arguments including the path to main.py and the --storage-path flag.

Does Winlog Mcp require Sysmon to be installed?

Yes, the README provides a Sysmon installation guideline and an install.bat script, indicating Sysmon should be installed before using the tool.