INCIDENT INVESTIGATION WORKSPACE

Make sense of scattered logs.

Import multiple system logs, normalize their timestamps, and investigate what happened first. Relationships are clues, not proof of causation.

1. Add evidence

Up to 8 MB per text file · 30,000 parsed events per file

⇧Choose log files.log .txt .csv (timestamp-first rows)

Or paste timestamped log lines

Source timezone when absent Display timezone Cluster gap (seconds)

No log sources loaded.

Parsed events0

Errors + critical0

Sources0

Event clusters0

2. Unified timeline

0 events

Normalized time	Severity	Source	Event / evidence
Load a demo or import logs to investigate.

Page 1

3. Event clusters

Temporal proximity

No clusters yet.

4. Shared identifiers

Cross-event linkage

No repeated request/session IDs yet.

Advanced Investigation v5

0 advanced records

Import timestamped text or Windows Event Viewer XML exports for multiline reconstruction and advanced analysis. Raw binary EVTX is not supported.

Advanced evidence filesSource filename for clock correctionClock adjustment, seconds

Analyst investigation notes

Advanced event timeline (first 150)

UTC	Source	Level	Evidence

5. Evidence exports

Review before sharing — logs may contain sensitive data

Exports preserve source names and original line numbers. Filtering affects the timeline CSV, while JSON preserves the full project.

Limitations: supported text logs with ISO, YYYY/MM/DD, US MM/DD/YYYY, and common syslog timestamps; syslog without year assumes the current UTC year. No multiline reconstruction, full Windows EVTX parsing, PCAP analysis, or live device collection. Verify original timestamps and system clock accuracy.