About LogTriage

LogTriage is an independent project, built by a security practitioner from incident response to make the first read of a security log fast and correct.

Why it exists

Most security logs are read in a hurry: a sign-in alert at night, a strange line in an access log, a firewall export someone has to make sense of before a meeting. LogTriage answers the first questions — what happened, which accounts and addresses were involved, what to do next — without a SIEM. Its detection logic and confirmed attacker infrastructure come from real incident investigations, alongside public feeds such as Spamhaus DROP and FireHOL.

What you will find here

• A reference library for investigators: Entra ID, Windows logon, Kerberos and NTSTATUS codes; Windows Security, AWS CloudTrail and CrowdStrike Falcon events; log formats field by field; and the sshd messages, web probes and scanner user agents that reach a real server.
• Free tools that run in your browser, so nothing you paste is uploaded: the log analyzer, the log line explainer, the error code lookup, the PowerShell decoder, the timestamp converter, the IP blocklist checker and the LLM log cost calculator.
• Original research from our own internet-facing server: a monthly report on what attacks it, and a monthly test of free IP blocklists against its real attackers. Published as totals only, never an IP address.
• Detection rules in Sigma format, each tested against a malicious and a benign sample log.
• The product: upload a log in any of 51 formats and get an incident report with threat intelligence, MITRE ATT&CK mapping and, when the file shows suspicious activity, an analysis written by AI. Ten analyses a month are free.

How the content is made

Reference pages are written with AI (Anthropic's Claude), from primary sources: Microsoft's, AWS's and CrowdStrike's documentation, the OpenSSH and Linux-PAM source code, NVD and CISA's catalog of exploited vulnerabilities. The official facts on a page — a code's description, an event's fields, a log line's format string — are copied from those sources by scripts, not written by the model. Before a page is published, scripts check it against the sources on every build, and a separate AI review checks the investigation advice; a page that fails either is not published. Each page names and links its sources.

Detection rules are drafted the same way and published only when they fire on their malicious sample log and stay silent on the benign one. The research reports are computed by scripts from our server's own logs, and their text is generated from the numbers.

If you find a mistake, write to [email protected]. We correct the page and, where we can, the check that missed it.

Your data

Uploaded log files are deleted 7 days after the analysis; your results stay until you delete them. We do not sell your data or use it to train AI models. The details are in the Privacy Policy, and the rules for using the service in the Terms of Service.

Open data and code