Log Analytics with LogTotal

What Is Log Analytics?

Log analytics is the practice of collecting, parsing, normalizing, and querying machine-generated event records to answer an operational or security question. In a SOC, that question is usually narrow: did this account authenticate from an unexpected source, did this host spawn an unusual child process, which API calls preceded the data transfer.

The raw material is heterogeneous: Windows Security and Sysmon channels in .evtx files, Linux auth.log and journald output, firewall and proxy events in CEF, and cloud audit trails such as AWS CloudTrail or Microsoft Entra ID sign-in logs exported as JSON.

A working log analytics pipeline has four stages:

1. Collection. Export events from the source without losing fields or timestamps.
2. Normalization. Map src_ip, IpAddress, and sourceIPAddress to one common schema.
3. Detection. Run Sigma or vendor rules and tag every hit with MITRE ATT&CK techniques.
4. Correlation. Group related hits into a timeline or attack chain that an analyst can validate.

Why Log Analytics Matters for Detection and Response

Logs are often the only record that survives an intrusion. EDR telemetry rolls over, memory is lost on reboot, and packet capture is rarely running when you need it. Windows Event IDs 4624, 4672, and 4688, or CloudTrail calls such as ConsoleLogin and CreateAccessKey, are typically the primary evidence for scoping an incident.

Three pressures make log analytics a core SOC skill rather than a SIEM feature:

• Volume. A single incident can produce millions of events, and grep only finds what you already know to look for.
• Coverage gaps. Contractor laptops, OT segments, and SaaS tenants nobody connected are not in the SIEM, but their logs still need analysis.
• Data handling. Logs carry usernames, hostnames, IPs, session cookies, and bearer tokens. Under GDPR much of that is personal data, and a leaked token is a live access path.

Every log attached to a vendor ticket or pasted into an AI chat widens the circle of people and jurisdictions that can read the original values. Good log analytics answers the question fast without creating a second incident.

A Short History of Log Analytics

Syslog, written by Eric Allman for Sendmail in the early 1980s, was later standardized in RFC 3164 (2001) and RFC 5424 (2009). For two decades, log analysis meant grep and awk on a central syslog server.

Windows went structured. Windows Vista replaced the legacy .evt format with the XML-based .evtx format and the channel model still used today, and Sysmon (2014) added high-fidelity process and network telemetry.

The mid-2000s brought SIEM. ArcSight, QRadar, and later Splunk made centralized search and correlation a product category, and ArcSight’s CEF is still emitted by most network appliances. The 2010s added open stacks such as ELK and cloud audit trails such as CloudTrail (2013).

In 2017, Sigma gave defenders a vendor-neutral rule format. The same year, SOC Prime began tagging Sigma rules with MITRE ATT&CK techniques and applied the approach to the public NotPetya investigation. ATT&CK mapping has since become a default expectation for detection content.

Where Log Analytics Is Heading

Detection moves upstream. Teams run Sigma rules on streaming events in the pipeline before data reaches the SIEM, cutting storage cost and shrinking mean time to detect from hours to minutes.

Correlation beats single alerts. Isolated low-fidelity matches are noise. Higher-order logic that links techniques across hosts and time windows into attack chains gives analysts something to confirm or close.

AI triage meets data-handling limits. LLMs explain process trees and summarize timelines well, but sending raw telemetry to a model provider raises privacy and contractual questions, and frontier models may refuse security content outright. During the July 2026 HuggingFace incident response, an attempt to send about 17,000 events to frontier models was blocked by guardrails.

Pseudonymization becomes a pipeline stage. Static masking destroys correlation, and plain hashes can be reversed by dictionary guessing. Keyed HMAC tokens keep relationships intact while removing the values. Expect this step in front of every external destination: AI services, vendor support, MSSPs, and shared data lakes.

Benefits of Log Analytics

• Faster scoping for incident responders. A correlated timeline answers “which hosts, which accounts, since when” in minutes, which drives containment and shortens dwell time.
• Validated detections for engineers. Replaying logs against rule logic shows which Sigma rules fire, which are noisy, and which ATT&CK techniques have no coverage.
• Compliance evidence. PCI DSS Requirement 10, ISO/IEC 27001 control A.8.15, and NIS2 all expect security events to be logged and reviewed.
• Root cause for administrators. The journalctl output that explains a failed service often reveals a misconfiguration an attacker could abuse.
• Lower SIEM cost. You can analyze a short-lived source once without onboarding it.
• Safer collaboration. Pseudonymized logs let a retainer, MSSP, or vendor TAC cluster hosts and users without seeing real identities.

Use Cases for Log Analytics

Unmanaged host triage. A contractor laptop without EDR is suspected of compromise. Export Security, Sysmon, and PowerShell logs and check LogTotal findings for credential access (T1003), PowerShell execution (T1059.001), and scheduled tasks (T1053.005) before reimaging.

Cloud account takeover. After an unfamiliar ConsoleLogin, pull 72 hours of CloudTrail and Entra ID sign-ins and look for new access keys, MFA changes, and IAM policy edits.

External IR retainers and vendor TAC. Sanitize the evidence with a key you keep. The third party still clusters hosts and users by token, and you map tokens back internally.

Detection engineering. Replay Atomic Red Team or Caldera logs to confirm which rules fire, then sanitize the fixtures before they reach Git or CI artifacts.

Privacy reviews. Keyed pseudonymization is a documentable technical measure under GDPR Article 32: what was replaced, how tokens were generated, who holds the key.

How to Perform Log Analysis: Locate and Export Logs by Platform

Every procedure below ends in a format LogTotal reads natively: EVTX, CEF, JSON/NDJSON, or syslog. Fix the UTC time window and scope first, and hash each export (Get-FileHash or sha256sum) for chain of custody.

Windows (EVTX). Requires an elevated shell as local Administrator. Live .evtx files under %SystemRoot%\System32\winevt\Logs\ are locked by the Event Log service, so export them with wevtutil:

wevtutil epl Security C:\IR\Security.evtx

wevtutil epl “Microsoft-Windows-Sysmon/Operational” C:\IR\Sysmon.evtx

Add /q:”*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]” to limit the export to 24 hours. GUI path: eventvwr.msc → Windows Logs → Security → Save All Events As…

Linux (syslog or NDJSON). Requires root or membership in adm / systemd-journal. Copy /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL). For journald:

sudo journalctl –since “2026-10-20” –until “2026-10-21” –utc -o json > host01.ndjson

AWS CloudTrail (JSON). Requires cloudtrail:LookupEvents. CloudTrail → Event history → Download events → Download JSON covers 90 days of management events. From a trail bucket (s3:GetObject, kms:Decrypt), flatten the records into NDJSON:

zcat ./ct/*.json.gz | jq -c ‘.Records[]’ > cloudtrail.ndjson

Microsoft Entra ID and Microsoft 365 (JSON). Entra admin center → Identity → Monitoring & health → Sign-in logs → Download → JSON (Reports Reader role). For Purview audit data, skip the CSV export and pull the JSON directly (Audit Logs role):

Search-UnifiedAuditLog -StartDate 2026-10-20 -EndDate 2026-10-21 -ResultSize 5000 |

  Select-Object -ExpandProperty AuditData | Out-File .\m365.ndjson -Encoding utf8

Network devices (CEF). Switch the device to CEF (on FortiGate: config log syslogd setting → set format cef) and export lines containing CEF:0| from the syslog collector.

SOC Prime Offerings for Log Analytics

• Threat Detection Marketplace: 1,000,000+ Sigma-native detection rules, translated to SIEM, EDR, and data lake languages and tagged with ATT&CK.
• Prime Hunt: scans historical SIEM, EDR, and data lake data with relevant rules and infers Attack Chains from the results.
• Prime Detect: runs Sigma rules on streaming events before the SIEM and correlates them into Attack Chains in real time.
• Uncoder.IO: translates Sigma and Roota rules into native queries.
• LogTotal: free, no-sign-up analysis of exported log files with in-browser sanitization.
• logtotal-sanitizer: the Apache 2.0 engine behind LogTotal, as a Node.js library and CLI for on-prem or air-gapped use.

LogTotal covers the case this guide is about: a file from a source outside your SIEM, or one you cannot share raw. Each analysis runs on a disposable, dedicated instance of SOC Prime’s DetectFlow engine and is deleted afterward.

How Log Analytics with LogTotal Works

LogTotal is free, needs no account, and sanitizes files in your browser before anything is uploaded. SOC Prime does not retain logs after analysis or train on them.

1. Open logtotal.com in a current Chromium, Firefox, or Safari build.
2. Load the export. Drop the .evtx, .log, .json, or .ndjson file. The format is detected automatically.
3. Review sanitization. Secrets, cookies, payment IDs, IPs, hostnames, usernames, and home-directory paths become keyed HMAC-SHA-256 tokens such as <USER:…> or <IP:…>. Identical values get identical tokens, so ten sprayed accounts still look like ten users.
4. Download the sanitized copy for your case file. It is exactly what was analyzed.
5. Run the analysis. Events are checked against roughly 1,000,000 detection rules and 13,000 labels, then correlated with Higher-Order Sigma rules and agentic AI. SOC Prime cites up to 1.7 million events in under a minute.
6. Read the findings. Detections are mapped to ATT&CK, grouped into attack chains, and explained by AI. A token that appears in both credential-access and lateral-movement findings is your account to reset.

For several hosts, or when browser uploads are off-limits, sanitize locally with the open-source CLI (Node.js 20+) and reuse one key so tokens match across files:

npm install -g @socprime/logtotal-sanitizer

logtotal-sanitize ./dc01.log -o ./dc01.sanitized.log –print-key

logtotal-sanitize ./ws17.log -o ./ws17.sanitized.log –key “$KEY”