Overview
LogTotal is a tool for analyzing your security logs. Upload a log file, and LogTotal evaluates its events against the SOC Prime detection rule dataset, which contains tens of thousands of behavior rules. The events that matched the rules are then evaluated against Higher Order Sigma rules, which describe multi-event attack patterns. When a sufficient portion of a pattern is matched, an Attack Chain is formed, helping you surface active threats.
Before you run the analysis, you can sanitize the log file. Security logs can contain sensitive details such as hostnames, usernames, internal IP addresses, session tokens, file paths, and other sensitive information about your environment. LogTotal replaces those identifiers with anonymized equivalents, processed locally on your own machine. Your original, unsanitized log file is never uploaded or sent anywhere.
Provide Your Logs and Run Analysis
Go to Prime Hunt > Event Analysis and provide your log data using one of the following options:
Upload a file: On the File tab, select Choose File, then select a log file from your device.
Paste log text: On the Text tab, paste your log data into the text field.
Then decide whether to sanitize your logs before analysis.
To sanitize your logs first, follow this section.
To analyze your logs as they are, follow this section.
Analyze without sanitization
Turn off Sanitize My Logs.
Select Start Analysis.
When the analysis is complete, the results open on the Results page. Go to this section for details.
Sanitize your logs
Keep Sanitize My Logs enabled. It is enabled by default and must remain enabled for sanitization to be applied.
Select Configure Sanitization.
In the modal, choose what gets replaced in logs by selecting the corresponding checkboxes.
Configure a Sanitization key. A key is generated automatically. You can leave the generated key or enter your own.
Select Sanitize & Preview.
Review the sanitized logs. Drag the divider to compare the original and sanitized versions.
Select Details to view and customize the replacements made during sanitization.
In the modal:
Clear the checkboxes for any sanitized entities that you want to exclude from sanitization.
Add additional values that you want to sanitize.
Select Re-run Sanitization to apply the updated replacement settings and generate a new sanitized result, or select Save to save the current sanitized result as a file.
Start the analysis in one of two ways:
Select Download Mapping and Run Analysis to save the map of replaced values and start the analysis.
Select Run Analysis to start the analysis without saving the map.
Optional: Before you run the analysis, select View Sanitized File to download the sanitized file.
Supported file types: .log, .json, .jsonl, .evtx, .txt
Maximum size: 3 GB or 3,000,000 events
The file is processed locally, using a Web Worker and Origin Private File System. Once the logs are sanitized, you can download the sanitized copy.
What Sanitization Removes
Identifiers are replaced rather than deleted. Each one becomes a stable pseudonym – the same host is the same token everywhere in the file, so sequences still correlate into attack chains and the timeline stays intact.
LogTotal replaces:
Hostnames and FQDNs
Usernames, email addresses and domain accounts
IPv4 and IPv6 addresses, both internal and external
Bearer tokens, API keys and anything shaped like a credential
User home directories and any path underneath them
Payment, government and health identifiers when those rules are enabled
Browser requirements
Local sanitization runs in the tab, so your browser has to support streaming gzip and Origin Private File System:
Chrome 113+, Edge 113+, Firefox 113+ or Safari 16.4+.
A regular window — private/incognito windows cannot keep the working copy.
Free browser storage of about 1.2× the file size.
A desktop browser. Mobile devices do not have enough memory or CPU for a gigabyte-scale pass.
Review Event Analysis Results
The top of the Results page shows overall statistics on the inferred threats:
Attack Chains – Total number of attack chains built
Monitored Threats – Total number of Active Threats items that are currently used for correlation out of all Active Threats items available for correlation
Affected Hostnames – Total number of unique hosts related to the correlated events
Tagged Logs – Total number of logs that were used for correlation
Rules – Total the number of rules that hit (had a match) on the events analyzed out of total number of rules checked against the file
To run a new analysis, click New Analysis at the top of the Event Analysis Results page. This takes you back to the log upload flow, where you can provide a new file and start a new analysis.
Details
This tab summarizes the analyzed file. It has three sections:
Basic properties
File name – The name of the uploaded file
File size – The size of the uploaded file
Log lines – The number of log lines in the file
Processing time – The time it took to analyze the file
Log period
First seen – The timestamp of the earliest log entry in the file
Last seen – The timestamp of the latest log entry in the file
Hashes
MD5
SHA-1
SHA-256
Rule Hits
The events in your file are evaluated against the SOC Prime detection rule dataset. If any rules produced hits on the events, the Rule Hits tab appears and lists them.
The tab includes the following details on each item:
Severity – Severity of the rule
Name – Name of the rule
Author – Author of the rule
LogSource – Log source the rule applies to
Hits – The number of events this rule matched
First Seen – The timestamp of the first event that hit the rule
Last Seen – The timestamp of the first event that hit the rule
Use the search bar to search for rules by name.
Click a rule to open it in a new browser tab in Prime Core.
Attack Chains
If the matched rules can form a chain, the Attack Chains tab appears and lists those chains. At this stage, the events with hits are correlated and evaluated against Higher Order Sigma rules. These rules describe multi-event patterns that represent potential attack sequences. When a sufficient portion of a sequence is matched, an Attack Chain is formed. Then an AI agent enriches the chain with contextual data, analyzes the sequence of events, and classifies the chain as a confirmed detection or a likely false positive.
The Attack Chains tab includes the following details on each item:
Severity – Severity of the Attack Chain (according to the corresponding Active Threats item)
Name – Name of the Attack Chain (according to the corresponding Active Threats item)
Hostname – Host primarily associated with the detected activity
Match – Percentage of sequences from Higher Order Sigma rule that match the events sequence
Rule Hits – The number of rules that matched the events
First/Last Seen – Timestamp of the first and last correlated event included in the Attack Chain
Use the search bar to search Attack Chains by name, hostname, or username.
Use the available controls to filter the visibility of Attack Chains:
Show Filtered Out – This button toggles the visibility of Attack Chains that the AI Agentic flow marked as false positives or low priority. By default, these chains are hidden to keep the view focused on high‑priority detections. Click to show or hide the filtered chains as needed
Group by – Group the Attack Chains by Hostname or Type
All Severities – Filter Attack Chains by severity level
All Statuses – Filter Attack Chains by investigation status
Click the Attack Chain name to view details.
Attack Chain Details
Use The Attack Chain details page for the investigation of the detected Attack Chain. To manage the lifecycle of the Attack Chain, change its Status, which has the following values:
New
Investigating
Confirmed
False Positive
Resolved
Closed
Filtered Out – Attack Chains that the AI Agentic flow marked as false positives or low priority
This page displays information about the Attack Chain that is generated after it is processed by the AI agent and enriched with contextual data using an LLM.
Key details:
Severity – According to the Associated Active Threat item
Hostname – Primary host associated with the detected activity
Source – Indicates the name of the file where the detected activity came from
Rule Hits – The number of rules that matched the events
AI Summary – Provides a contextual overview of the detected activity.
Tags:
Techniques and sub-techniques – MITRE ATT&CK techniques used by adversaries in this threat context
Threat Actors – threat actors related to the threat
First Seen – Timestamp of the first correlated event included in the Attack Chain
Last Seen – Timestamp of the last correlated event included in the Attack Chain
Active Threat – The Active Threat that the attack chain is based on. The tile shows the threat's type and release date. Click the tile to open the Active Threat details page. On the Active Threat Details page.
Chain (techniques over time). Displays the sequence of techniques identified throughout the Attack Chain timeline. Green items represent techniques detected through standard detection rules. Detection Bypass item represents a fuzzy matching rule that detects similar, but not identical, activity patterns. The Detection Bypass item is marked with a dedicated icon and can be viewed in the related rule details on this page. Currently, this type of detections is supported only for Elastic Stack.
List of detected techniques, where each technique has the following details:
Name and ID
Matched Rules
First Seen
Last Seen
List of rules within the detected technique. Click the technique to open the list of rules that have the following details:
Name
Index
Tagged Events
First Seen
Last Seen
View in SIEM. Click the button to open the corresponding query in your SIEM and investigate the events associated with the selected detection.
Stealth Technique
The Stealth Technique tab shows the list of techniques from the Stealth tactic that are covered by rules with hits on the events from your log file.
This tab includes the following details on each item:
Rules – Number of rules mapped to this technique
First Seen – Timestamp of the earliest event that had hit on a rule mapped to this technique
Last Seen – Timestamp of the earliest event that had hit on a rule mapped to this technique
Click a technique to view the rules within it. Each rule item shows its number of hits, first seen, and last seen.
Suspicious Findings
The Suspicious Findings tab shows techniques whose rules have an unusually high hit count compared to the rest of the rules that had hits on the events from your log file. This is a strong signal that something worth a closer look is happening in your logs.
The Suspicious Findings tab includes the following details on each item:
Rules – Number of rules mapped to this technique
First Seen – Timestamp of the earliest event that had hit on a rule mapped to this technique
Last Seen – Timestamp of the earliest event that had hit on a rule mapped to this technique
Click a technique to view the rules within it. Each rule item shows its number of hits, first seen, and last seen.
Event Analysis History
On the Event Analysis page in Prime Hunt, you can view the list of all analyses you've previously run.
The page includes two tabs:
My – Analyses you've run yourself. By default, an event analysis is private and appears only on My tab.
Company – Event analyses that other users in your company have shared
Each item includes:
Rule Hits – Number of rules that had hits during that analysis
Attack Chains – Number of Attack Chains formed from that analysis
Created – Date and time the analysis was run
Status – Current state of the analysis
Actions:
Share to Company – Makes the analysis visible to other users in your organization
Delete – Removes the analysis and its results