Claude AI MITRE ATT&CK SOC 2 · PCI DSS · HIPAA mapped automatically
Turn a raw log file into an incident report.
Drop any API or infrastructure log. LogTriage enriches it with threat intelligence, finds the attack patterns, maps them to MITRE ATT&CK and writes the report an analyst would, with step-by-step remediation.
10 analyses a month free. Can't upload logs to a third party? The free in-browser analyzer reads your file without sending it anywhere.
- 51log formats
- <60 sper analysis for a typical file
- MITRE ATT&CKtechniques mapped
- SOC 2 · PCI DSS · HIPAAcontrols auto-mapped
Credential stuffing against /api/v1/auth/login
One Tor exit node made 19 login attempts: 17 failed, 2 succeeded, and one of the compromised accounts then called the user export endpoint.
- HIGH 2 successful logins after 17 failures from the same address
POST /api/v1/auth/login - HIGH A compromised account called the user export endpoint
GET /api/v1/users/export - MEDIUM Scripted client on the login API
python-requests/2.28.0 - INFO Source address is a Tor exit node
203.0.113.45
- 01Block the address at the WAF and end the active sessions of the two compromised accounts.
- 02Force a password reset and MFA re-enrolment for both users.
203.0.113.45 Tor exit node - AbuseIPDB
- 100% confidence
- AlienVault OTX
- 40+ pulses
- ThreatFox
- no match
51 log formats, auto-detected on upload
No configuration needed
Web & Proxy
5- nginx / Apache Combined
- HAProxy
- Traefik
+ 2 moreShow fewer
- IIS W3C Extended
- Cloudflare Logs
Cloud IAM & SaaS
10- Azure AD Sign-In Logs
- Okta System Log
- GCP Cloud Audit Log
+ 7 moreShow fewer
- Duo Security
- JumpCloud Directory
- Microsoft 365 Unified Audit Log
- Google Workspace
- GitHub Audit Log
- Slack Audit Log
- Azure ARM Activity Log
AWS Cloud
8- AWS CloudTrail
- AWS GuardDuty
- AWS VPC Flow Logs
+ 5 moreShow fewer
- AWS ALB / ELB
- AWS S3 Server Access Logs
- AWS Config
- AWS Security Hub
- AWS Inspector v2
Network Security
8- Cisco ASA / FTD
- PAN-OS Native CSV
- CEF (Common Event Format)
+ 5 moreShow fewer
- FortiGate
- Juniper SRX
- F5 BIG-IP ASM
- AWS WAF
- Azure NSG Flow Logs
EDR & Endpoint
7- CrowdStrike Falcon
- SentinelOne
- Microsoft Defender for Endpoint
+ 4 moreShow fewer
- Carbon Black
- Sysmon
- Windows Event Log
- Wazuh
Infrastructure & OS
4- Syslog (RFC 5424 / 3164)
- Linux auth.log / secure
- Kubernetes Audit Log
+ 1 moreShow fewer
- Linux audit log (auditd)
Databases & Generic
4- MySQL
- PostgreSQL
- Generic JSON / NDJSON
+ 1 moreShow fewer
- Generic CSV
Underlined formats have a field reference. Missing one? Tell us.
Everything you need to investigate a threat
From raw log bytes to actionable intelligence in one upload.
Deep threat intelligence
GeoIP and ASN data, ASN blocklists, AbuseIPDB, AlienVault OTX, ThreatFox, MalwareBazaar and URLScan.io, plus confirmed indicators from real SOC investigations. Each distinct address, file hash and domain is looked up once per file.
AI-written reports
Claude Sonnet writes the analyst narrative, with the evidence, for high-risk files and Claude Haiku for standard ones; quiet files get a rule-based report. Indicators the AI names are checked against your data, and log text is never treated as instructions.
Attack pattern detection
Credential stuffing, password spraying, brute force, API scraping, recon sweeps, port scans and impossible travel, each mapped to MITRE ATT&CK techniques, across all 51 formats.
51 log formats
nginx, Entra ID, CloudTrail, CrowdStrike, SentinelOne, Suricata, Cisco ASA, PAN-OS, FortiGate, Sysmon, Elastic ECS, Duo, Slack, GitHub and 37 more, recognised from the records rather than the file name. Pretty-printed JSON, NDJSON and grep output all work.
Automatic compliance mapping
Every report maps its findings to SOC 2, PCI DSS, HIPAA, NIST CSF and ISO 27001 controls, with the control IDs and why each one applies: audit-ready evidence without extra work.
Same checks, nothing uploaded
Can't send logs to a third party? The free browser analyzer runs the same detection checks on your own machine, and the file never leaves it.
How it works
Three steps from upload to remediation, in about a minute.
- 01 Upload
Drop any log file up to 100 MB. The format is recognised from the records across 51 sources — nginx, CloudTrail, CrowdStrike, CEF, Suricata and the rest. No configuration needed.
- 02 Triage
Every address, hash and domain goes through the enrichment pipeline: GeoIP, ASN, AbuseIPDB, OTX, ThreatFox, MalwareBazaar and URLScan.io. Events are risk-scored 0–100, grouped into sessions and mapped to ATT&CK.
- 03 Act
A full threat report: executive summary, technical narrative, indicators, impacted users and prioritised remediation steps, with SOC 2, PCI DSS, HIPAA, NIST CSF and ISO 27001 controls mapped for the auditor.
Built for regulated industries
Compliance evidence, auto-generated
Every threat report maps its findings to the controls your auditors ask about. No manual cross-referencing and no extra tools: copy the evidence straight into your audit evidence pack.
- SOC 2 CC6.1CC7.2CC7.4
- PCI DSS Req 8.3.4Req 10.2Req 12.10.1
- HIPAA §164.312(d)§164.308(a)(6)
- NIST CSF PR.AC-7DE.CM-1RS.CO-2
- ISO 27001 A.9.4.2A.12.4.1A.16.1.1
- Per finding
- Each detected attack pattern maps to specific control IDs. Credential stuffing, for example, maps to SOC 2 CC6.1, PCI DSS Req 8.6 and NIST CSF PR.AC-1.
- In every report
- A compliance section lists the triggered controls with their names and why each one applies, ready to attach as audit evidence.
- Export formats
- Download as JSON, Markdown, CSV or a STIX 2.1 bundle and import it into your GRC platform or SIEM. PDF on the Pro plan.
REST API
Automate analysis via REST API
Everything in the app is available over HTTP. Upload logs, poll for the result and receive the ThreatReport as structured JSON, ready for your SIEM, ticketing system or incident-response workflow.
- API keys
- Create a key (
ltk_…) under Integrations in the app and send it asAuthorization: Bearer. It does not expire with your session, and you can revoke it at any time. - Webhooks
- Get a POST when an analysis finishes, filtered by severity. With a secret set, each delivery carries an HMAC-SHA256 signature in
X-LogTriage-Signature.
Free for investigators, nothing uploaded
The reference explains the codes, events and log lines you meet in an investigation, in the vendor's own words. The tools run in your browser, and the research is measured on our own server.
- reference pages, checked against vendor documentation
- 81
- Sigma rules, each tested on a malicious and a benign log
- 28
- failed SSH logins on our own server, 6 Sep – 5 Oct 2026
- 239,750
- of the attack traffic was on one free blocklist
- 84%
Reference
Free tools
Recently published
- 2026-10-26Sigma ruleDetect SSH Brute Force Authentication Failures in Linux auditd Logs
- 2026-10-26Sigma ruleDetect Mimikatz Credential Dumping in Elastic Common Schema Process Logs
- 2026-10-25CloudTrail event AssumeRoleAssumeRole in CloudTrail: Following Role Sessions Across Accounts
- 2026-10-25CloudTrail event AttachUserPolicyAttachUserPolicy in CloudTrail: Who Granted Which Policy to Whom
- 2026-10-25CloudTrail event ConsoleLoginConsoleLogin in CloudTrail: Reading AWS Console Sign-In Events
- 2026-10-24Data reportWhich free IP blocklists stop real attacks? (2026-10)
- 2026-10-24Entra ID error AADSTS50055AADSTS50055 (InvalidPasswordExpiredPassword): The Password Has Expired
- 2026-10-24Entra ID error AADSTS50079AADSTS50079 (UserStrongAuthEnrollmentRequired): MFA Registration Required
Simple, transparent pricing
Start free. Upgrade when your team needs more. Every plan gets the full report, every format, threat intelligence and ATT&CK mapping.
Free
$0 forever
- 10 analyses / month
- AI threat reports with threat-intel enrichment
- MITRE ATT&CK and compliance mapping
- All 51 log formats · files up to 100 MB
Just one incident?
Incident pack: 25 analyses for $19, one payment. No subscription, and the credits never expire.
Need Enterprise?
2,000 analyses a month for $399, white-labelled reports, webhooks and API access for your own integrations, and volume contracts on request.
Start triaging today
No setup. No agents. Drop a file, get a report.
No credit card required · 10 free analyses per month
About
Built by practitioners, for practitioners
LogTriage was built to solve a problem we kept running into in incident response: too many log sources, not enough time, and no fast path from raw data to what actually happened.
The detection logic, risk weights and confirmed indicators come from real incident investigations, and the enrichment pipeline reflects what matters when you are triaging a live incident at 2 AM.
We read 51 log formats because security teams don't get to choose which sources an attacker touches. If yours is missing, tell us.
- Threat intelligence
- Indicators from confirmed true-positive Microsoft MDDR investigations — real attacker infrastructure — alongside public feeds such as Spamhaus DROP and FireHOL.
- AI analysis
- Powered by Anthropic Claude. The model is chosen per job by risk: Haiku for standard triage, Sonnet for high-severity incidents, and a rule-based report for quiet files.
- Compliance-first
- Every report maps to SOC 2, PCI DSS, HIPAA, NIST CSF and ISO 27001, so collecting evidence takes no extra work.
- Data privacy
- Uploaded log files are deleted after 7 days. We do not train on your data.
Get in touch
Talk to us
Questions about Team or Enterprise pricing, custom integrations, compliance requirements or a volume discount for your SOC? We respond within one business day.