How LogTotal Sanitizes Logs Before Analysis

Before LogTotal runs any detection logic on a plain text, CSV or JSON upload, it replaces identifying values with placeholders: usernames, hostnames, IP addresses and similar. It then shows you the result to review before analysis starts. Uploaded files aren’t kept after analysis. EVTX files are the exception for now: they’re analyzed as uploaded, without the sanitize step.

The objection to online log analysis is a fair one. Logs are full of internal names, addresses and occasionally things nobody meant to log at all. This page explains what LogTotal masks, what it deliberately leaves alone, and what you should still check yourself.

Get Started For Free

What stays as-is, and why

Detection logic looks at behavior, not names. To spot a password spray or an encoded PowerShell payload, rules need event IDs, process and file names, the structure of a command line, ports, protocols and timestamps. Masking those would blind the analysis without protecting much.

Same value, same placeholder

Masking only works for investigation if it’s consistent. If jane.doe becomes user_1 on every line, you can still see that user_1 failed 40 logins from one address and then succeeded. If every username became a different random string, that pattern would vanish. Consistent placeholders keep the story intact while taking the names out of it.

Your part: review before you continue

Automatic masking catches the common shapes. It can’t know your environment. Before you continue past the sanitize step, look for:

• secrets inside free-text messages, such as passwords typed into command lines or API keys in error messages;
• custom fields that hold names, such as ticket_owner or approved_by;
• project or customer codenames hidden in hostnames or paths;
• personal data inside URLs and query strings.

If you spot something, clean it in the file before uploading. A sed one-liner handles most cases:

sed -E 's/(password|token|apikey)=[^&[:space:]]+/\1=REDACTED/Ig' in.log > clean.log

EVTX: not sanitized yet

EVTX files are analyzed as uploaded, without the sanitize step. Use EVTX uploads freely for test machines. For production hosts, get approval from whoever owns data handling first. If you need sanitization today, convert the file to JSON lines with the open-source evtx_dump and upload that:

evtx_dump -o jsonl Security.evtx > Security.jsonl