Security

Security Log Analyzer

A SIEM-style detection engine that turns raw authentication logs into ranked, MITRE ATT&CK-tagged alerts. This page runs the real detection rules over a sample day of synthetic log events. Adjust the threshold and the alerts recompute; click one to see the raw events behind it.

Python C# / .NET 9 Detection engineering MITRE ATT&CK Standard library only

How it works

01

Sliding-window rules

Brute force, spraying, and port scans are counted over sliding time windows. All the thresholds sit in one DEFAULTS block, so tuning them takes one edit.

02

Geo-velocity

Two logins for one user become a haversine distance over elapsed time. Anything faster than a plane is flagged as impossible travel.

03

Ranked and mapped

Each alert carries a severity and a MITRE ATT&CK technique ID, so the serious ones sort to the top and map onto a framework analysts already use.

Data source

How to export your own logs (Windows · macOS · Linux)

Triage summary

Lower = more sensitive (catches slower attacks, risks noise) · Higher = fewer alerts. This is real alert tuning.
all events

ATT&CK coverage

How it works: the same rules run here and in the Python CLI (analyze.py): brute force and its success (compromise), password spraying, port scanning, impossible travel (geo-velocity), and off-hours privileged access, each mapped to a MITRE ATT&CK technique. Logs are synthetic; no real data is involved. See the source and detection write-up.