Quickly search and reference Linux logs, journald and auditd records.
This tool processes your input in your browser.
The general system logging file for Ubuntu/Debian based systems (or /var/log/messages on RHEL). It captures logs from system daemons, kernel, and various services.
Useful Fields:Timestamp, Hostname, Daemon/Process, Message
Malicious Use:Detecting anomalous service stops/starts, crashes due to exploits, or attackers echoing empty strings to hide tracks.
Records the command line history of bash shell users. Located in each user's home directory.
Useful Fields:Command
Malicious Use:Tracking attacker actions post-compromise. Attackers often run 'history -c' or delete this file to evade detection.
Records all authentication-related events, including SSH logins, sudo executions, and PAM authentications (or /var/log/secure on RHEL).
Useful Fields:Timestamp, Hostname, Process, Message (User, IP, Success/Fail)
Malicious Use:Detecting SSH brute force attacks, unauthorized root access, or anomalous remote logins.
Generated by the Linux Audit Daemon when a process executes a new program (execve system call). It captures the full command line arguments.
Useful Fields:type=EXECVE, argc, a0, a1, a2 (Arguments), pid, uid
Malicious Use:Detecting the execution of malicious scripts, LOLBins (like curl, wget, python), and interactive reverse shells.
Generated when a user attempts to log into the system.
Useful Fields:type=USER_LOGIN, auid, uid, res (Success/Failed)
Malicious Use:Tracking successful and failed logins to identify brute force or compromised accounts.
Analyze and organize security indicators, logs, files, and timelines in one local workspace.
Design and execute structured security incident response workflows.
Create portable Sigma detection rules locally for SIEM and EDR workflows.
Inspect email headers locally for SPF, DKIM, DMARC and phishing indicators.