#Basics

This page summarizes the behavior that applies across Stitch commands and documents the CLI arguments exposed by the current binary.

#Command Model

Common options are global. They may appear before or after the subcommand:

stitch -i Security.evtx --stats search --query 'event.id == 4625'
stitch search --query 'event.id == 4625' -i Security.evtx --stats

#Input Discovery

Inputs can be EVTX files, directories, or newline-delimited path lists. When no input path is supplied, Stitch behaves as if -i . was passed and scans the current directory.

Only files with an .evtx extension are processed. Extension matching is case-insensitive. Discovered inputs are sorted by path before processing so output order is stable.

Each result keeps source identity:

source.file_path
source.collection_root
channel
computer
record_id

#Global Execution Options

Use STQL for timestamp filtering:

stitch search -i case \
  --query 'timestamp >= "2026-03-21T00:00:00Z" and timestamp < "2026-03-22T00:00:00Z"'

#Parallel Execution

Concurrency is file-level. Stitch parallelizes only when there is more than one discovered input and the command mode can be merged safely.

Parallelized paths:

• search when --limit is not set.
• dump for JSONL, JSON, and projected CSV.
• hunt when correlation is disabled or no correlation rules are loaded.

Sequential paths:

• Single-file input.
• Explicit --jobs 1.
• search --limit, because early termination affects scan counts and output.
• Correlation-enabled hunt, because event-time watermarks and bounded state
  are order-sensitive.

Parallel search, dump, and non-correlation hunt preserve discovery order by buffering each input's output before merging. Use --jobs 1 for lower peak memory on large single streams or when debugging ordering-sensitive behavior.

#search

search requires exactly one query source:

Pretty search output includes source metadata. Without | keep or --fields, pretty output includes the full raw EVTX record. JSON and JSONL include either raw or projected fields.

#hunt

hunt requires at least one Sigma rule file or directory:

When --strict is not set, invalid Sigma files are skipped and counted. When --strict is set, invalid rule files fail the command.

Correlation output is sequential by design. See Sigma for supported rule shapes and correlation behavior.

#dump

dump serializes parsed EVTX records without applying STQL or Sigma rules:

CSV requires explicit --fields values. Stitch does not infer CSV schemas, because schema discovery would require buffering or an additional pass.

#Output Destinations

Default result output goes to stdout. Diagnostics go to stderr. Parse-error logs created by --errors are JSONL files.

When dump --output <FILE> is used, records are written to the file. If --stats is also supplied, stats are still written to stdout.

#Parse Errors

Recoverable record parse errors are skipped by default and counted in stats. Use --errors <FILE> to capture skipped record errors as JSONL. Use --strict or dump's --fail-fast when partial results are not acceptable.