Incident Analyzer

Authorized logs only

Review authentication, web-server and application security logs you are authorized to inspect. Secrets are redacted, findings separate observed facts from heuristic assessment, and nothing is stored, blocked or changed.

Log input

0 lines · 0 B / 1.91 MB

CtrlEnter in the editor

Accepted input

Auth / SSH — syslog auth.log, secure, sshd lines
Web access — nginx / Apache combined log format
App & firewall — JSON array, NDJSON, or CSV with a header row
Anything else — best-effort IP and keyword extraction

Up to 1.91 MB and 50,000 lines. Files: .log .txt .csv .json .ndjson .jsonl (rotated .1/.2 suffixes and extension-less system logs work too). Content is processed in memory and never saved.

Detection thresholds

Failed logins per sourceFlag an IP after this many failures

Failed logins per accountFlag an account after this many failures

Accounts per sourceCredential-stuffing signal

Sign-in addresses per accountSuccessful logins from distinct IPs

Burst size (events)Events from one IP within the window

Logins per account in windowUnusual login frequency

Window (seconds)Used by burst and login-frequency checks

Client errors per source4xx responses (scanning signal)

No analysis yet

Paste log lines, upload a log file, or load the example, then select Analyze logs. The report shows findings, a timeline, top sources and every parsed event.