Security Log Analyzer
A SIEM-style detection engine that turns raw authentication logs into ranked, MITRE ATT&CK-tagged alerts. This page runs the real detection rules over a sample day of … synthetic log events. Adjust the threshold and the alerts recompute; click one to see the raw events behind it.
How it works
Sliding-window rules
Brute force, spraying, and port scans are counted over sliding time windows. All the thresholds sit in one DEFAULTS block, so tuning them takes one edit.
Geo-velocity
Two logins for one user become a haversine distance over elapsed time. Anything faster than a plane is flagged as impossible travel.
Ranked and mapped
Each alert carries a severity and a MITRE ATT&CK technique ID, so the serious ones sort to the top and map onto a framework analysts already use.
Data source
How to export your own logs (Windows · macOS · Linux)
Triage summary
Alerts
Event stream
ATT&CK coverage
How it works: the same rules run here and in the Python CLI (analyze.py): brute force and its success (compromise), password spraying, port scanning, impossible travel (geo-velocity), and off-hours privileged access, each mapped to a MITRE ATT&CK technique. Logs are synthetic; no real data is involved. See the source and detection write-up.