Winlog Mcp
About
A Model Context Protocol (MCP) tool for retrieving and analyzing Windows event logs (e.g. Sysmon). WinLog-mcp provides programmatic access to ingest and query Windows event logs, making it ideal for security monitoring, incident response, and log analysis automation.
Explore
- Ingest Windows Sysmon logs and store them as files in a user-defined directory
- Query logs by timestamp, returning recent event entries for analysis or troubleshooting
- Seamless interoperability with MCP tools and ecosystem
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Winlog McpCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Clone the repository and install dependencies:
pip install -r requirements.txt
Reference: Sysmon Installation Guideline
cd sysmon
install.bat
Run the tool as an MCP server:
python main.py --storage-path \\PATH\\TO\\logs\\
MCP configuration to run winlog-mcp tool.
{
"mcpServers": {
"winlog-mcp": {
"command": "python",
"args": [
"\\PATH\\TO\\main.py",
"--storage-path",
"\\PATH\\TO\\logs\\"
]
}
}
}
ingest_syslog
Ingests recent Sysmon logs and writes them to a file
query_syslog
Queries ingested logs by timestamp and returns recent events
- ingest_syslog: Ingests recent Sysmon logs and writes them to a file
- query_syslog: Queries ingested logs by timestamp and returns recent events
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"winlog mcp": {
"winlog-mcp": {
"command": "python",
"args": [
"\\PATH\\TO\\main.py",
"--storage-path",
"\\PATH\\TO\\logs\\"
]
}
}
}
}McpServers
{
"winlog-mcp": {
"command": "python",
"args": [
"\\PATH\\TO\\main.py",
"--storage-path",
"\\PATH\\TO\\logs\\"
]
}
}
A Model Context Protocol (MCP) tool for retrieving and analyzing Windows event logs (e.g. Sysmon). WinLog-mcp provides programmatic access to ingest and query Windows event logs, making it ideal for security monitoring, incident response, and log analysis automation.
---
✨ Features
- Ingest Windows Sysmon logs and store them as files in a user-defined directory
- Query logs by timestamp, returning recent event entries for analysis or troubleshooting
- Seamless interoperability with MCP tools and ecosystem
📄 Log files format
- Log files are named with the format <timestamp>_<log_type>.log in the chosen storage path
MCP Server (tool, prompts,...)
🛠️ Available Tools
- ingest_syslog: Ingests recent Sysmon logs and writes them to a file
- query_syslog: Queries ingested logs by timestamp and returns recent events
📋 Requirements
- Operating System: Windows
- Python: 3.7 or higher
- Dependencies:
- pywin32
- mcp.server.fastmcp (or your MCP server implementation)
💾 Installation
Clone the repository and install dependencies:
pip install -r requirements.txt
🚀 Usage
🖥️ Sysmon Installation
Reference: Sysmon Installation Guideline
cd sysmon
install.bat
▶️ Running Directly
Run the tool as an MCP server:
python main.py --storage-path \\PATH\\TO\\logs\\
🧑💻 Development Mode
You can inspect or debug using the MCP Inspector:
```sh
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
