LogTriage

Runs LogTriage's full analysis on a log: parsing (50+ formats), threat-intelligence enrichment of addresses, user agents and hashes, risk scoring, attack-pattern detection and an AI-written incident report with indicators, MITRE ATT&CK mapping and remediation steps. Needs a LogTriage API key sent as 'Authorization: Bearer ltk_...' (created in the app under Integrations on Pro or with the incident pack) and uses the account's analysis credits. Up to 10 MB of text. Returns a job id at once; call get_analysis with it after 30-90 seconds.

Checks IPv4 addresses against 12 free public blocklists (IPsum, FireHOL levels 1-3, Spamhaus DROP, blocklist.de, CINS Army, GreenSnow, DShield, ET compromised, Tor exits), the same lists as logtriage.app's IP blocklist checker. Accepts a list of addresses or any text containing them (log lines, CSV); private and other special-purpose ranges are labelled, not looked up. Up to 500 addresses per call. Lists are refreshed twice a day. Being on a list is evidence, not proof. Free; no API key needed.

Identifies the format of one log record (access-log line, syslog/auth.log line, Windows event XML, CloudTrail, Entra ID, CrowdStrike, firewall, CEF/LEEF and more) and lists every field with what it means and where that meaning comes from (LogTriage's reference pages or the vendor's published definition). Decodes values: timestamps, address ranges, HTTP statuses, ports, logon types, NTSTATUS and AADSTS codes, encoded PowerShell. Runs LogTriage's attack checks on the record too. Free; no API key needed.

Returns the status and, once complete, the incident report of an analysis started with analyze_log_file: severity, attack pattern, executive summary, detected patterns, indicators, MITRE ATT&CK techniques, remediation steps and a link to the full report in the app. Needs the same API key.

Explains Microsoft authentication error codes from Microsoft's official tables: Entra ID sign-in errors (AADSTS50126, or the bare 50126), Windows NTSTATUS codes as logged in events 4625/4776 (0xC000006A, C000006A, or decimal 3221225578 / -1073741718), Kerberos failure codes from events 4768/4769/4771 (0x18), and official names (IdsLocked, STATUS_ACCOUNT_LOCKED_OUT, KDC_ERR_PREAUTH_FAILED). Paste a whole error message or event to find every code in it, or give words to search names and descriptions. Returns the official name and description, where the code is logged, and LogTriage's investigation page when one exists. Free; no API key needed.

Detects the log format (50+ formats: web access logs, auth.log, Windows events, Sysmon, CloudTrail, Entra ID, Okta, Kubernetes audit, firewalls, EDR exports and more) and runs LogTriage's deterministic attack checks: brute force and password spraying, logins after failures, web scanning and injection, privilege changes in cloud logs, suspicious command lines, port scans and others, with MITRE ATT&CK techniques. Up to 5 MB of text; no threat-intelligence lookups and no AI (use analyze_log_file for those). The log is processed in memory and not stored. Free; no API key needed.

Finds LogTriage's reference pages for an investigation: Windows Security event IDs, Entra AADSTS, NTSTATUS and Kerberos codes, AWS CloudTrail events (ConsoleLogin, AssumeRole...), CrowdStrike Falcon events (ProcessRollup2...), sshd/PAM log messages, web scanner probes, scanner user agents, log format field references and the free tools. Each page explains what the entry means, the fields to read and queries (KQL, CQL, SPL, bash) to investigate it. Returns the best matches with links. Free; no API key needed.