Incident responders and blue teams have a new tool called Chainsaw that speeds up searching through Windows event log records to identify threats. The tool is designed to assist in the first-response stage of a security engagement and can also help blue teams triage entries relevant for the investigation. F-Secure says that Chainsaw is specifically tailored for quick analysis of event logs in environments where a detection and response solution (EDR) was not present at the time of compromise. It uses the Sigma rule detection logic to quickly find event logs relevant to the investigation.”]