log-forensics

What problem does it solve?

Log data from multiple sources is often scattered, making forensic investigations slow and error-prone. This Skill provides a unified approach to parsing, normalizing, and analyzing logs to reconstruct events and detect indicators of compromise.

Core Features & Use Cases

• Windows Event Log Analysis: Parse EVTX files and extract security-relevant events.
• Syslog and web/server log integration: Correlate across sources and build timelines.
• IOC and anomaly detection: Identify indicators, unusual patterns, and cross-source correlations.
• Use Case: Investigate a security incident by aligning events from EVTX, Syslog, and web logs to determine attacker steps and affected hosts.

Quick Start

Load logs with the LogForensics parser and generate a timeline to start an investigation.