Buy it on the Lemon Squeezy checkout. A download link arrives by email at the address you give there, within a minute. No LogTriage account is needed.

Is this the same as the incident pack?

No. The incident pack is 25 analyses of your own log files by LogTriage. The kit is a download for your own tools: the queries and rules you run in your SIEM yourself.

Each download is rebuilt from the current site, so the same link gives you the newer pages and rules later.

Yes, on request within 14 days of purchase; the refund disables the download link. See the terms.

One-time download

Incident Response Kit

Name: LogTriage Incident Response Kit
Brand: LogTriage
Price: 29 USD
Availability: InStock

Everything an investigator copies from this site, in one download: 229 investigation queries from 138 reference pages and guides, 32 validated Sigma detection rules, and a cheat sheet of every code, event, log message, scanner probe and user agent the library explains. Each query names the page that explains it.

Buy the kit — $29 once Link by email within a minute · no account needed · refundable for 14 days

What is inside

Part	What you get
KQL (Microsoft Sentinel, Defender)	112 queries, one file per language and one Markdown file per family with each page's link
bash	57 queries, one file per language and one Markdown file per family with each page's link
nginx	26 queries, one file per language and one Markdown file per family with each page's link
CQL (CrowdStrike Falcon)	18 queries, one file per language and one Markdown file per family with each page's link
SPL (Splunk)	9 queries, one file per language and one Markdown file per family with each page's link
SQL	6 queries, one file per language and one Markdown file per family with each page's link
PowerShell	1 queries, one file per language and one Markdown file per family with each page's link
Sigma rules	32 rules, each validated to fire on a malicious sample log and stay silent on a benign one (the rule library)
Cheat sheet	PDF and HTML: every Entra ID, NTSTATUS and Kerberos code, Windows, CloudTrail and CrowdStrike event, SSH message, scanner probe and user agent in the library, one line each, linked to its page

Why a download if the pages are free?

The pages stay free. The kit is for the moment you are in your SIEM and need the query now, offline, or for a whole team: every KQL query for Sentinel and Defender, every CrowdStrike CQL and Splunk SPL search, and the rules, already gathered, deduplicated and labelled with where they came from.

How delivery works

After payment, Lemon Squeezy confirms the order to LogTriage and a download link goes to the email address of the order. The kit is built from the current site each time you download it, so the link keeps giving you the newer pages. Analyzing your own log files is a different product: 10 analyses a month are free, and the incident pack adds 25 more.

Questions

How do I get it?: Buy it on the Lemon Squeezy checkout. A download link arrives by email at the address you give there, within a minute. No LogTriage account is needed.
Is this the same as the incident pack?: No. The incident pack is 25 analyses of your own log files by LogTriage. The kit is a download for your own tools: the queries and rules you run in your SIEM yourself.
Does it get updated?: Each download is rebuilt from the current site, so the same link gives you the newer pages and rules later.
Can I get a refund?: Yes, on request within 14 days of purchase; the refund disables the download link. See the terms.

Refunds and use: terms.