#Getting Started

Build Stitch locally, point it at EVTX input, and run a query.

#Build

cargo build --release

Use the local binary directly when benchmarking or validating behavior:

target/release/stitch --help

#Search the current directory

When no path is supplied, Stitch recursively searches the current working directory as if -i . had been passed.

stitch search --query 'event.id == 4625'

#Search a specific collection

stitch search \
  -i cases/acme/windows \
  --query 'event.id == 4625 and Event.EventData.TargetUserName contains_ci "admin"'

#Hunt with Sigma rules

stitch hunt \
  -i cases/acme/windows \
  --rules rules/windows \
  --summary

#Dump records

stitch dump \
  -i cases/acme/windows/security.evtx \
  --format jsonl \
  --output /tmp/security.jsonl

Projected CSV requires explicit fields:

stitch dump \
  -i cases/acme/windows/security.evtx \
  --format csv \
  --fields timestamp \
  --fields event.id \
  --fields computer \
  --output /tmp/security.csv

#Next steps

• Read Basics for input and output behavior.
• Read STQL for query syntax.
• Read Sigma for supported rule behavior.