In this workshop, the participants are expected to bring their own interesting EVTX files (especially Security events) and analyze them with different tools and techniques. As an example analysis exercise, we will cover the triage and analysis phases of an incident response process on MS Windows environments, and see how UserLine (https://github.com/THIBER-ORG/userline) helps to improve your DFIR capabilities to focus the investigation. This tool automates the process of creating logon relations from MS Windows Security Events by showing a graphical relation among users domains, source and destination logons, session duration, who was logged on the systems in a given datetime, etc. It is able to integrate and provides different output modes such as CSV output, Neo4j, SQLite, Gephi and Graphviz.