Overview

LogTotal is a tool for analyzing your security logs. Upload a log file, and LogTotal evaluates its events against the SOC Prime detection rule dataset, which contains tens of thousands of behavior rules. The events with rule hits are then correlated using the Higher Order Sigma rules associated with Active Threats items. These rules describe multi-event attack patterns, and when a sufficient portion of a pattern is matched, an Attack Chain is formed based on the corresponding Active Threat, helping you surface threats active in your logs. Each Attack Chain then goes through an additional AI-driven analysis step performed by our AI model, which filters out low-confidence results, surfacing only the Attack Chains verified with high confidence.

Before you run the analysis, you can sanitize the log file. Security logs can contain sensitive details such as hostnames, usernames, internal IP addresses, session tokens, file paths, and other sensitive information about your environment. LogTotal replaces those identifiers with anonymized equivalents, processed locally on your own machine. Your original, unsanitized log file is never uploaded or sent anywhere.

Customize the Interface Theme

LogTotal offers several visual themes. To change the theme, select the Theme dropdown at the top of the page and choose the one you prefer.

Provide Your Logs and Run Analysis

Provide your log data using one of the following options:

Upload a file: On the File tab, select Choose File, then select a log file from your device.

Paste log text: On the Text tab, paste your log data into the text field.

Then decide whether to sanitize your logs before analysis.

To sanitize your logs first, follow this section.
To analyze your logs as they are, follow this section.

Analyze without sanitization

Turn off Sanitize My Logs.
Select Start Analysis.

When the analysis is complete, the results open on the Results page. Go to this section for details.

Sanitize your logs

Keep Sanitize My Logs enabled. It is enabled by default and must remain enabled for sanitization to be applied.
Select Configure Sanitization.
In the modal, choose what gets replaced in logs by selecting the corresponding checkboxes.
Configure a Sanitization key. A key is generated automatically. You can leave the generated key or enter your own.
Select Sanitize & Preview.
Review the sanitized logs. Drag the divider to compare the original and sanitized versions.
Select Details to view and customize the replacements made during sanitization.

In the modal:
- Clear the checkboxes for any sanitized entities that you want to exclude from sanitization.
- Add additional values that you want to sanitize.
Select Re-run Sanitization to apply the updated replacement settings and generate a new sanitized result, or select Save to save the current sanitized result as a file.
Start the analysis in one of two ways:
- Select Download Mapping and Run Analysis to save the map of replaced values and start the analysis.
- Select Run Analysis to start the analysis without saving the map.
Optional: Before you run the analysis, select View Sanitized File to download the sanitized file.

Supported file types: .log, .json, .jsonl, .evtx (only analysis, but not sanitization), .txt

Maximum size: 3 GB or 3,000,000 events

The file is processed locally, using a Web Worker and Origin Private File System. Once the logs are sanitized, you can download the sanitized copy.

What Sanitization Removes

Identifiers are replaced rather than deleted. Each one becomes a stable pseudonym – the same host is the same token everywhere in the file, so sequences still correlate into attack chains and the timeline stays intact.

LogTotal replaces:

Hostnames and FQDNs
Usernames, email addresses and domain accounts
IPv4 and IPv6 addresses, both internal and external
Bearer tokens, API keys and anything shaped like a credential
User home directories and any path underneath them
Payment, government and health identifiers when those rules are enabled

Browser requirements

Local sanitization runs in the tab, so your browser has to support streaming gzip and Origin Private File System:

Chrome 113+, Edge 113+, Firefox 113+ or Safari 16.4+.
A regular window — private/incognito windows cannot keep the working copy.
Free browser storage of about 1.2× the file size.
A desktop browser. Mobile devices do not have enough memory or CPU for a gigabyte-scale pass.

Review Event Analysis Results

The top of the Event Analysis Results page shows overall statistics on the inferred threats:

Attack Chains – Total number of attack chains built
Monitored Threats – Total number of Active Threats items that are currently used for correlation out of all Active Threats items available for correlation
Affected Hostnames – Total number of unique hosts related to the correlated events
Tagged Logs – Total number of logs that were used for correlation
Rules – Total the number of rules that hit (had a match) on the events analyzed out of total number of rules checked against the file

To run a new analysis, click New Analysis at the top of the Event Analysis Results page. This takes you back to the log upload flow, where you can provide a new file and start a new analysis.

Attack Chains

Attack Chains represent potential threats identified by correlating events from your file that matched rules in the SOC Prime detection rule dataset. These events are evaluated against Higher Order Sigma rules, which describe multi-event patterns representing potential attack sequences. When a sufficient portion of a sequence is matched, an Attack Chain is formed. Then an AI agent enriches the chain with contextual data, analyzes the sequence of events, and classifies the chain as a confirmed detection or a likely false positive.

The Attack Chains tab includes the following details on each item:

Severity – Severity of the Attack Chain (according to the corresponding Active Threats item)
Name – Name of the Attack Chain (according to the corresponding Active Threats item)
Hostname – Host primarily associated with the detected activity
Match – Percentage of sequences from Higher Order Sigma rule that match the events sequence
Rule Hits – The number of rules that matched the events
First/Last Seen – Timestamp of the first and last correlated event included in the Attack Chain

Use the search bar to search Attack Chains by name, hostname, or username.

Use the available controls to filter the visibility of Attack Chains:

Show Filtered Out – This button toggles the visibility of Attack Chains that the AI Agentic flow marked as false positives or low priority. By default, these chains are hidden to keep the view focused on high‑priority detections. Click to show or hide the filtered chains as needed
Group by – Group the Attack Chains by hostname or chain name
All Severities – Filter Attack Chains by severity level

Click the Attack Chain name to view details.

Attack Chain Details

General Tab

This page displays information about the Attack Chain, including:

Key details:
- Severity – According to the Associated Active Threat item
- Status – The current lifecycle stage of the Attack Chain, indicating the progress of the incident
- Hostname – Primary host associated with the detected activity
- Rule Hits – The number of rules that matched the events associated with Attack Chain
- Tagged Logs – The number of log events associated with the Attack Chain
AI Summary – Provides a contextual overview of the detected activity.
Tags:
- Techniques and sub-techniques – MITRE ATT&CK techniques used by adversaries in this threat context
- Threat Actors – Threat actors related to the threat
- First Seen – Timestamp of the first correlated event included in the Attack Chain
- Last Seen – Timestamp of the last correlated event included in the Attack Chain
Chain (techniques over time). Displays the sequence of techniques identified throughout the Attack Chain timeline. Green items refer to detected techniques. The grey ones refer to techniques associated with the Active Threats item that have not been detected yet
List of detected techniques, where each technique has the following details:
- Name and ID
- Matched Rules
- First Seen
- Last Seen
List of rules within the detected technique. Click the technique to open the list of rules that have the following details:
- Name
- Log Source
- Hits
- First Seen
- Last Seen
- View Tagged Logs – Click the button to see the raw events that matched this rule. For details, see Tagged Logs Page.

Tagged Logs Tab

The Tagged Logs tab shows the raw events from your file that were used to build this Attack Chain. Use it to see exactly which events stand behind the detected activity.

For the description of the page elements, see Tagged Logs Page.

Tagged Logs Page

The Tagged Logs page lets you explore raw events from your file. It opens in two ways:

From the Tagged Logs tab of an Attack Chain, where it shows the events used to build the chain.
From the View Tagged Logs button next to a rule on the Rule Hits, Stealth Techniques, and Suspicious Findings tabs, and in the list of rules on the General tab of Attack Chain Details.

The page includes:

Search bar – Search within the displayed events using Lucene query syntax. For example, you can search by field name and value to narrow the results to the events you need
Export – Click Export to download the displayed events. This option is available only when the page is opened from a rule, not from the Tagged Logs tab of an Attack Chain
Columns – Choose which columns appear in the events table
Events list – Lists each event with the following columns:
- Timestamp – When the event occurred
- Value – A preview of the event’s raw content, shown as JSON
Click an event to open the full event data. Use the toggle at the top right of the expanded view to switch between two formats:
- Default – A table of field names and values
- JSON – The raw event in JSON format

Rule Hits

Events in your file are evaluated against the SOC Prime detection rule dataset. The Rule Hits tab lists the rules that matched the events in your file.

The tab includes the following details on each item:

Severity – Severity of the rule
Name – Name of the rule
Author – Author of the rule
Hits – The number of events this rule matched
First Seen – The timestamp of the first event that hit the rule
Last Seen – The timestamp of the first event that hit the rule
View Tagged Logs – Click the button to see the raw events that matched this rule. For details, see Tagged Logs Page

Use the search bar to search for rules by name.

Clicking a rule opens its detail page:

Rule Code – A rule body which you can Copy or Download.
Overview – A description of what the rule detects, plus its key properties: severity, status, release and update dates, category, product, service, and actors. The related MITRE ATT&CK technique is listed on the right.

Stealth Techniques

The Stealth Techniques tab shows the list of techniques from the Stealth tactic that are covered by rules with hits on the events from your log file.

This tab includes the following details on each item:

Matched Rules – Number of rules mapped to this technique
First Seen – Timestamp of the earliest event that had hit on a rule mapped to this technique
Last Seen – Timestamp of the earliest event that had hit on a rule mapped to this technique

Click a technique to view the rules within it. Each rule item shows its number of hits, first seen, and last seen.

Click View Tagged Logs next to a rule to see the events that matched it. For details, see Tagged Logs Page.

Suspicious Findings

The Suspicious Findings tab shows techniques whose rules have an unusually high hit count compared to the rest of the rules that had hits on the events from your log file. This is a strong signal that something worth a closer look is happening in your logs.

How the threshold is calculated:

If fewer than 5 rules had hits, there isn't enough to compare, and the Suspicious Findings tab is not displayed.
The system calculates the median hit count. This means: sort all the hit counts from lowest to highest, and take the one in the middle. This represents the typical number of hits for a rule in this analysis.
The threshold is 20× the median. Any rule at or above this becomes a candidate.
The system then checks the candidates against the threshold's edge: the candidate with the fewest hits must have at least 10% more hits than the closest rule that didn't qualify. If not, that candidate is removed, and the check runs again.
The remaining rules are grouped by MITRE technique.

The Suspicious Findings tab includes the following details on each item:

Rules – Number of rules mapped to this technique
First Seen – Timestamp of the earliest event that had hit on a rule mapped to this technique
Last Seen – Timestamp of the earliest event that had hit on a rule mapped to this technique