Security Log Analyzer: attack detection for 50+ log formats

Security Log Analyzer

Paste a security log, or give a link to one, and get the attacks in it: what happened, which addresses and accounts were involved, how many events, and the MITRE ATT&CK techniques.

The format is detected for you. More than 50 are supported, including Entra ID (Azure AD) sign-in logs, Windows Security events and Sysmon, Linux auth.log and auditd, nginx, Apache and IIS access and error logs, AWS CloudTrail, VPC Flow Logs and WAF, Okta, Google Workspace, Microsoft 365, Kubernetes audit logs, CrowdStrike, SentinelOne and Defender exports, and firewalls (PAN-OS, FortiGate, Cisco ASA, CEF and LEEF).

What it finds

• Brute force, password spraying and logins that succeed after failures (SSH, Windows, Entra ID, Okta and more)
• Web scanning, probes for secrets such as .env files, SQL injection and path traversal
• Privilege changes and logging being turned off in cloud audit logs
• Suspicious command lines, LSASS access and encoded PowerShell on endpoints
• Port scans, host sweeps and exposed management ports in network logs
• Many mailbox aliases behind one inbox, and other account-abuse patterns

Every finding is deterministic: the same log gives the same answer, with no AI and no external lookups. The same checks run in LogTriage's free in-browser log analyzer.

Input

• Log text: the log itself.
• Or a link to the log file: a URL to download (up to 25 MB), which takes precedence over Log text. Gzip files and binary Windows event logs (.evtx) are read as well.
• File name (optional): helps identify the format.

Output

One dataset item per finding: severity, title, headline, facts (addresses, accounts, time window and counts), mitreAttack, eventsInvolved and format. The OUTPUT record summarizes the formats read, the event counts and the findings by severity.

Pricing

You pay per analyzed log; Apify's own platform usage is included.

Want the full incident report?

LogTriage also enriches every address, user agent and hash with threat intelligence and writes the incident report: timeline, impacted users, indicators and remediation steps. The field-by-field log format reference explains what each record means.