Your incident workflow

Turn event data into clear analysis.

Choose a use case, update the field values, and your incident analysis refreshes automatically—ready to copy into your case notes.

Available playbooks ▤

4

Reusable analysis templates

Fields in selected playbook ⌘

5

Values you can customise

Output status ✓

Live

Updates as you type

Playbook selection

Pick a detection or policy

04 templates

Analysis builder

Fill in the case-specific values below

● Auto-generated

Suspicious PowerShell Execution

Endpoint · Incident analysis template

PB-001

Use case description

Incident fields

5 values

Field keyValue

✧ Generated incident analysisLIVE PREVIEW

Incident context & handoff

Add case details to create a consistent shift handover note.

LOCAL

Case / ticket ID

Severity

Alert source / SIEM

Analyst

Current disposition

Assessment confidence

Key findings / actions taken

Pending actions / next shift

Case details are saved in this browser on this device. Avoid entering credentials, secrets, or unnecessary personal data.

Investigation checklist

Track common triage steps before closing or escalating.

0 / 7 complete

Validate the alert
Confirm rule logic, severity, event time, and affected asset. Identify impacted entities
Review user, host, source/destination, and business owner. Review surrounding activity
Correlate related events and establish a timeline. Check indicator reputation
Validate relevant IPs, domains, URLs, or hashes using approved tools. Compare with expected behaviour
Check known-good activity, allowlists, and change records. Record evidence and rationale
Document findings and why the disposition is appropriate. Set next action and ownership
Escalate when needed and record pending follow-up.

Complete the relevant steps; not every alert requires every check.

IOC quick handoff

Extract likely indicators from the selected playbook fields.

No likely indicators detected yet. Add indicator values to fields such as SourceIP, Domain, URL, or FileHash.

The scanner opens separately. Nothing is automatically uploaded; copy the detected indicators and paste them into your scanner intentionally.

Security-first investigation

Common Log Parser

Paste or load local security logs, normalize common fields, search events, and extract likely indicators. Parsing runs locally in this browser tab.

Local processing

Data handling: Log contents are processed in this page only. They are not uploaded to a server or sent to threat-intelligence services. Review sensitive data before exporting or copying it.

1. Provide log data

Choose a field profile for email, firewall, network, web, endpoint, identity, VPN, cloud, or mixed SIEM logs. All parsing remains local.

TXT · LOG · JSON

Log type / field profile

Choose the log type to prioritize its key fields; remaining parsed metadata and candidate IOCs stay available under Other fields / IOC. Auto-detect uses a focused layout when one type dominates; mixed datasets use a general layout.

Raw logs

↑ Load local file No file selected

Files are read locally using your browser. Large files may take a moment; avoid uploading secrets to any external service.

Input events ≋

0

Log records detected

Parsed events ✓

0

Structured records

Likely indicators ⌕

0

Unique values found

2. Parsed events

Run the parser to see normalized events here.

Time	Category	Event / Action	Source IP	Destination IP	User	Host	Event ID	Enriched context
Paste logs and select Parse logs to begin.

0 events

Likely indicators

Validate before taking action

No indicators extracted yet.

Admin tools

Build a reusable use case.

Define the policy description, required field keys, and analysis template once. Analysts can then reuse it for every new incident.

Create a new use case

Fields marked with * are required

Template setup

Use placeholders like {{UserName}} in the analysis template. Matching field keys are replaced automatically, with safe text handling.

Threat intelligence toolkit

Apps

Open your approved threat-indicator tools from one place. Choose an app based on the indicator type and your investigation workflow.

Manual handoff: These links open external services in a new tab. This page does not automatically send indicators or case data. Check your organisation's policy before submitting sensitive indicators.

▦

Your tool

Bulk IOC Scanner

Bulk-check a list of IP addresses, domains, URLs, and file hashes using your existing scanner.

Bulk IOCReputationTriage

Open Bulk IOC Scanner ↗

⌖

External service

AbuseIPDB

Check IP addresses for reported abusive activity and review community-submitted reputation reports.

IP reputationAbuse reports

Open AbuseIPDB ↗

◉

External service

VirusTotal

Review file hashes, URLs, domains, and IP addresses using multi-engine reputation and analysis.

FilesURLsDomains / IPs

Open VirusTotal ↗

⌁

External service

AlienVault OTX

Explore Open Threat Exchange pulses and community-shared threat intelligence for indicators.

Threat pulsesIOC context

Open AlienVault OTX ↗

⌕

External service

urlscan.io

Investigate URLs and review website scan results, page behaviour, and related infrastructure.

URL analysisWeb infrastructure

Open urlscan.io ↗

＋

Coming next

More threat apps

This hub can be expanded with your other GTI tools, internal apps, and approved investigation utilities.

Custom linksFuture integrations

Template library

Your playbook library.

Review, select, edit, or remove your incident analysis templates.

Saved playbooks

Built-in templates and custom use cases

How it works

Simple template lifecycle

1. Define the policyAdd a title, category, and analyst-friendly description.

Setup

2. Add field keysSet the values analysts need to fill for each event.

Fields

3. Write your templateInsert placeholders such as {{HostName}} and {{UserName}}.

Output

4. Reuse for every caseChoose the use case and update values; output changes live.

Ready

Important for shared access

With the shared API configured, playbook definitions are saved centrally in the project repository and become available on other devices. Export JSON for a separate backup.