Overview
LogTotal is a tool for working with security logs. It allows you to provide log data in different formats and sanitize sensitive information.
Currently, LogTotal supports log sanitization. Security logs can contain sensitive details such as hostnames, usernames, internal IP addresses, session tokens, file paths, and other sensitive information about your environment. LogTotal replaces those identifiers with anonymized equivalents, processed locally on your own machine. Your original, unsanitized log file is never uploaded or sent anywhere.
In future iterations, the sanitized logs will be checked against tens of thousands of behavior rules, with matches correlated around Higher Order Sigma rules to surface active threats.
Provide Your Logs
Go to Prime Hunt > Event Analysis and provide your log data using one of the following options:
Upload a file: On the File tab, select Choose File, then select a log file from your device.
Paste log text: On the Text tab, paste your logs data into the text field, and select Configure Sanitization.
Note: Make sure Sanitize My Logs is enabled. It is enabled by default and must remain enabled for sanitization to be applied.
After providing your logs:
In the modal, choose what gets replaced in logs by selecting the corresponding checkboxes.
Configure a Sanitization key. A key is generated automatically. You can leave the generated key or enter your own.
Select Sanitize & Preview.
Review the sanitized logs. Drag the divider to compare the original and sanitized versions.
Select Details to view and customize the replacements made during sanitization.
In the modal:
Clear the checkboxes for any sanitized entities that you want to exclude from sanitization.
Add additional values that you want to sanitize.
Select Re-run Sanitization to apply the updated replacement settings and generate a new sanitized result, or select Save to save the current sanitized result as a file.
Select View Sanitized File to download the sanitized file.
Supported file types: .log, .json, .csv, .txt
Maximum size: 1.7 GB or 1,700,000 events
The file is processed locally, using a Web Worker and Origin Private File System. Once the logs are sanitized, you can download the sanitized copy.
What Sanitization Removes
Identifiers are replaced rather than deleted. Each one becomes a stable pseudonym – the same host is the same token everywhere in the file, so sequences still correlate into attack chains and the timeline stays intact.
LogTotal replaces:
Hostnames and FQDNs
Usernames, email addresses and domain accounts
IPv4 and IPv6 addresses, both internal and external
Bearer tokens, API keys and anything shaped like a credential
User home directories and any path underneath them
Payment, government and health identifiers when those rules are enabled
Browser requirements
Local sanitization runs in the tab, so your browser has to support streaming gzip and Origin Private File System:
Chrome 113+, Edge 113+, Firefox 113+ or Safari 16.4+.
A regular window — private/incognito windows cannot keep the working copy.
Free browser storage of about 1.2× the file size.
A desktop browser. Mobile devices do not have enough memory or CPU for a gigabyte-scale pass.