I built an offline threat-hunting CLI in python because spinning up a SIEM for one log file is overkill

so here's the situation i kept running into while studying for security+ and messing with sample log sets. i'd have a single evtx export or a json dump from some lab, and i wanted to know "is there anything bad in here" without standing up elastic or splunk or wazuh just to look at one file. every t