Too much noise. Too little context.
Security events, process launches, new services, and persistence changes are spread across different Windows views. Manually finding the important activity slows down response.
WINDOWS INCIDENT INVESTIGATION & FORENSIC TRIAGE
Investigate Windows events.Connect the evidence.
TraceQuell helps turn Windows security logs into focused investigations. Start with Event Investigation to identify activity worth reviewing, follow its chronology in Attack Timeline, and examine verified relationships in Event Correlation—all while keeping source event details within reach.
Built for security engineers, SOC analysts, incident responders, DFIR professionals, and security consulting teams.
Investigate firstSource-backed Windows eventsFollow the timelineActivity in chronological contextCorrelate with careVerified multi-event relationships
WHY TRACEQUELL
Go beyond isolated Windows event alerts.
Windows investigations can involve thousands of events across multiple sources. TraceQuell helps reveal suspicious activity and related evidence so analysts can spend less time hunting through raw logs.
Prioritized events. Clear next steps.
TraceQuell guides your investigation from individual findings to the timeline and supported event correlations, helping you focus on evidence rather than assumptions.
THREE CORE INVESTIGATION VIEWS
From individual events to the bigger picture.
Investigate the original event, trace what happened next, and validate relationships across supporting records.
Event Investigation
Surface noteworthy Windows security events and understand their priority—INFO, REVIEW, HIGH, or CRITICAL. Inspect the original event and why it deserves attention.
Attack Timeline
Explore activity in chronological order. Follow notable events and supporting context to see how an incident may have unfolded, without assuming that nearby events are related.
Event Correlation
Review multi-event findings only when source records satisfy the relevant identity, host, and timing requirements. Jump back to the evidence behind each supported relationship.
Processes, Services & Persistence
Examine running processes, service registrations, startup persistence, network context, file hashes, and digital signatures where available.
Offline EVTX Investigation
Analyze previously collected Windows EVTX files and reconstruct historical activity without collecting new live events. Available in Professional Business.
Investigation Cases & Reports
Organize reviewed findings and share investigation results through structured cases, reports, and exports with a Professional license.
EVIDENCE-FIRST SECURITY TRIAGE
The event is the starting point, not the conclusion.
TraceQuell keeps the source record visible while helping you assess significance, follow the chronology, and inspect supported event relationships.
Original Event
Begin with the recorded Windows event, including its host, channel, time, Event ID, and original record identity.
Explainable Finding
Review the matched behavior, investigation priority, and what the event does—and does not—establish.
Event Correlation
Examine linked records only when evidence meets the applicable relationship checks; a single noteworthy event is not a multi-event correlation.
Attack Timeline
Explore what happened and when, while keeping related findings separate from independent observations.
One consistent severity model
INFO, REVIEW, HIGH, and CRITICAL are investigation priorities. CRITICAL does not, on its own, prove a system was compromised.
INFOREVIEWHIGHCRITICAL
Live and Offline Evidence use the same detection criteria for comparable event data. Differences in available logs, permissions, timestamps, collection scope, or endpoint context can still change the findings. Offline Evidence and Offline Timeline require Professional Business.
HOW TRACEQUELL WORKS
A guided workflow for Windows investigations.
Choose when to scan, examine the event evidence, build the chronology, and evaluate correlations before reaching a conclusion.
Start on Your Terms
Open Event Investigation, choose Quick Scan or Full Scan, and select Run Scan. No heavy scan starts automatically on launch.
Event Investigation
Prioritize Windows event findings and review recorded details behind the assessment.
Attack Timeline
Reconstruct activity by time and inspect notable events in context.
Event Correlation
Investigate verified multi-event relationships. Use Professional case and reporting tools to document conclusions.
EXPLORE THE WORKSPACE
Explore TraceQuell beyond the first scan.
Event Investigation is featured above. See how Attack Timeline, Event Correlation, endpoint visibility, offline analysis, and professional reporting support the next steps.
Product screenshots should reflect the current TraceQuell 1.0.0 interface. Investigation Case and reporting require Professional; Offline Evidence and Offline Timeline require Professional Business.
INCIDENT RESPONSE USE CASES
Investigate threats hiding in everyday Windows activity.
TraceQuell helps surface noteworthy activity and links supporting context where the evidence is available.
Investigate suspicious service installations
Spot unusual service registrations and inspect executable paths, file signatures, and related evidence.
Trace suspicious process execution
Follow unusual PowerShell commands and related processes to understand how activity started and what followed.
Review security protection changes
Identify important Defender configuration events and check their outcomes alongside related system activity.
Find signs of persistence
Examine startup entries, service registrations, and other persistence indicators that may warrant closer review.
Investigate Windows Server activity
Review relevant Active Directory, DNS, Hyper-V, and cluster events when investigating changes or disruption on Windows Server.
Reconstruct incidents after the fact
With Professional Business, analyze previously collected EVTX logs and reconstruct offline event timelines. Use Professional case and report tools to document the findings.
CHOOSE THE RIGHT EDITION
From live triage to complete offline investigations.
Free includes core live findings. Individual adds professional case management and export. Business adds Offline Evidence and Offline Timeline.
| Investigation capability | Free | Professional Individual | Professional Business |
|---|---|---|---|
| Live Event Investigation and Security Findings | ✓ | ✓ | ✓ |
| Event Correlation (verified multi-event findings) | ✓ | ✓ | ✓ |
| Processes, Services, Network, and Live Visual Timeline | ✓ | ✓ | ✓ |
| Live Attack Timeline and Visual Investigation | ✓ | ✓ | ✓ |
| Investigation Case | — | ✓ | ✓ |
| HTML / Word Reports and CSV Export | — | ✓ | ✓ |
| Full Copy / Context Menu Actions | — | ✓ | ✓ |
| Offline Evidence (saved EVTX investigation) | — | — | ✓ |
| Offline Timeline (historical event reconstruction) | — | — | ✓ |
Free retains the core detection results, including HIGH and CRITICAL findings. Professional Individual includes live investigation, case management, reports, export, and copy tools. Offline Evidence and Offline Timeline require Professional Business.
TRACEQUELL FREE · Rp0 / US$0
Start investigating Windows activity for free.
Explore Event Investigation, Attack Timeline, Event Correlation, and Process Explorer with TraceQuell Free. All four severity levels remain visible, with no paid license required.
PROFESSIONAL LICENSING
Choose your investigation depth.
Professional Individual delivers a complete live investigation and reporting workflow. Professional Business adds advanced offline evidence analysis for security teams and organizations.
Rp0
US$0
Free edition · No paid license
Try explainable Windows security triage and live investigation before deciding whether professional reporting or offline EVTX analysis is needed.
- Live Windows Event Investigation
- Attack Timeline and Event Correlation
- Process Explorer and available live context
- INFO, REVIEW, HIGH, and CRITICAL findings retained
Case management, report export, and offline EVTX analysis are paid-edition features.
Request Free DownloadNo payment needed. Available as a direct download after the official installer is published.
Rp1.990.000
≈ US$110 estimated
Per year · One named investigator
For security engineers, independent incident responders, and DFIR consultants who need faster live endpoint investigations and professional deliverables.
- Automated security triage and evidence correlation
- Live attack and visual investigation timelines
- Investigation Case and professional reports
- CSV export and unrestricted copy tools
- Licensed to one named investigator, including commercial client work
Offline Evidence and Offline Timeline are not included.
Contact Sales — IndividualMention “TraceQuell Individual” when contacting us.
Rp7.990.000
≈ US$442 estimated
Per year · One licensed legal entity
For security operations teams, corporate incident response, and organizations investigating live systems and previously collected Windows evidence.
- Everything in Professional Individual
- Offline Evidence for collected Windows EVTX files
- Offline Timeline for historical event reconstruction
- Company-held license for authorized internal use within one legal entity
- Company invoicing and purchasing documentation
Complete TraceQuell investigation capabilities, including offline workflows.
Contact Sales — BusinessPermitted users and devices are specified in the written license terms before purchase.
Pricing and tax: TraceQuell Free costs Rp0 (US$0). Professional prices are annual base prices in Indonesian Rupiah (IDR), excluding any tax that must legally be charged. USD amounts are approximate reference conversions based on the Bank Indonesia midpoint of IDR 18,094 per USD on 6 November 2026; they are not fixed USD quotations. Exchange rates may change. If applicable, tax will be itemized in a written quotation. The final payable amount and currency, licensing scope, renewal terms, and invoice details are confirmed before payment.
PURCHASING
Request a license directly from Aulap Software.
Purchase through our Contact page. Tell us whether you need Individual or Business—including offline EVTX investigations—and we will confirm payment and delivery details.
Choose Individual for live investigation, reporting, and case management, or Business for those tools plus Offline Evidence and Offline Timeline.
Share your name, email, selected license type, and company details where applicable. We confirm license scope, any applicable tax, the final amount payable, and invoice details before payment.
After payment confirmation, receive your Individual or Business license and setup instructions. Review the license duration, authorized usage, renewal conditions, and feature access in your agreement.
For purchasing questions, license terms, or a quotation, visit our official Contact page. Our sales team will guide you through the order.
FREQUENTLY ASKED QUESTIONS
Everything you need to get started.
How do I get TraceQuell Free?
Use the Free Download section. When the official direct installer is published, you can download it there; otherwise request a copy via our Contact page. No purchase is required.
Is TraceQuell an antivirus or EDR replacement?
No. TraceQuell helps analysts investigate suspicious Windows activity and correlate evidence alongside existing antivirus, EDR, and SIEM tools.
What do INFO, REVIEW, HIGH, and CRITICAL mean?
They describe investigation priority, not certainty of compromise. Findings explain the recorded activity, while analysts verify context, authorization, and any missing evidence before reaching a conclusion.
Are the detection rules the same in Live and Offline?
TraceQuell applies the same detection logic to comparable event evidence. Results can differ when log coverage, permissions, collection boundaries, or available endpoint context differ. Offline Evidence and Offline Timeline are Business features.
What is the difference between Attack Timeline and Event Correlation?
Attack Timeline shows when activity occurred. Event Correlation focuses on supported multi-event relationships that meet source identity and rule requirements. Events appearing close together do not automatically form a confirmed connection.
Does TraceQuell scan automatically on startup?
No. Event Investigation opens in a ready state. Choose Quick Scan or Full Scan and select Run Scan when you want to collect and analyze live Windows events.
Does TraceQuell work on Windows Server?
TraceQuell includes Windows Server-oriented event investigation for available AD DS, DNS, Hyper-V, and Failover Clustering logs. Actual coverage depends on installed roles, audit policy, permissions, retention, and supported channels. Test it in your environment before operational deployment.
Will it read every historical Windows event?
Not necessarily. Events must still exist and be accessible. Live collection can apply per-source limits to protect performance, and unavailable or truncated evidence should be treated as a coverage limitation.
What is the difference between Individual and Business?
Individual is licensed to one named investigator and includes live investigation, Investigation Case, reporting, exports, and copy tools. Business includes all Individual capabilities plus Offline Evidence and Offline Timeline, and is licensed for authorized internal use within one legal entity.
Which plan should I choose for incident response?
Choose Individual if your work focuses on investigating live Windows endpoints and delivering case reports. Choose Business if your team also needs to analyze collected EVTX files and reconstruct offline event timelines.
Can TraceQuell investigate offline EVTX files?
Yes, with Professional Business. Offline Evidence and Offline Timeline are not included in Free or Professional Individual. Analysis is limited to the EVTX files and event data available.
Does an expired license delete investigation data?
No. An expired Individual or Business license returns the application to Free mode; existing evidence files are not deleted by license expiration. Renewal restores the features included in your plan.
What currency are TraceQuell prices listed in?
Prices on this page are listed in Indonesian Rupiah (IDR). Contact Aulap Software for a written quotation, payment instructions, and an invoice with the final payable amount.
Are taxes included in the listed prices?
The Professional amounts shown are annual base prices, excluding any tax that must legally be charged. If applicable, tax is itemized and the final payable total is confirmed in writing before payment.
How many users and devices does Business include?
Professional Business is licensed to one legal entity. The permitted users, device count, deployment scope, support arrangements, and renewal terms are confirmed in the written license agreement before purchase.
How do I buy TraceQuell Professional?
Use our Contact page and specify Individual or Business. If you need offline EVTX investigation, request Business. We confirm payment details and provide the license after verification.
TRACEQUELL · FREE & PROFESSIONAL
Find the signal. Follow the timeline. Validate the evidence.
Start with the Free edition or contact Aulap Software for Individual and Business licensing.
TraceQuell supports evidence-led investigations. Severity expresses investigation priority, not proof of compromise. Findings and correlations depend on available logs, event identity, source coverage, and endpoint context. Terms of Use · Privacy Policy · Software Library