v0.1 — investigative assistant for SOC analysts

Find the bump in the log.

Paste raw logs. Get a chronological narrative of what happened, the anomalies worth your attention, and prioritized pivots — built for analysts who already know what they're doing.

raw_logs.txt — 2,847 lines
2026-05-10T03:11:42Z ConsoleLogin user=alice    Failure
2026-05-10T03:11:48Z ConsoleLogin user=bob      Failure
2026-05-10T03:11:53Z ConsoleLogin user=carol    Failure
2026-05-10T03:12:01Z ConsoleLogin user=dave     Failure
2026-05-10T03:12:08Z ConsoleLogin user=evan     Failure
2026-05-10T03:12:14Z ConsoleLogin user=fiona    Failure
2026-05-10T03:12:41Z ConsoleLogin user=jsmith   Success  MFA=No
2026-05-10T03:13:02Z CreateAccessKey user=jsmith
2026-05-10T03:14:18Z ListBuckets    user=jsmith
2026-05-10T03:14:26Z DescribeInstances user=jsmith
2026-05-10T03:14:33Z GetAccountAuthorizationDetails …
bumpinthelog.timeline
03:11:42Password spray begins (8 users)
03:12:41jsmith — auth success, no MFA
03:13:02New access key created
03:14:18Recon: ListBuckets, DescribeInstances
03:18:12AssumeRole BillingAdmin → DENIED (MFA)
03:34:11IAM persistence: svc_backup_helper +Admin
2 bumps flagged. Probable credential compromise via password spray. T1110.003, T1098.001.

Multi-format ingest

CloudTrail, Azure Activity, GCP Audit, auth.log, Apache/Nginx, Windows Event, EDR alerts, syslog, JSON, firewall, VPN. Or paste anything and we'll auto-detect.

Narrative reconstruction

Plain-English story of what happened, in order, with timestamps. Severity and confidence are first-class — every finding tells you why.

Pivot suggestions

Prioritized investigative next steps. Specific data sources. Sample SPL, KQL, EQL, SQL. Mapped to MITRE ATT&CK where evidence supports it.

Built on three things

Parse, reconstruct, investigate. In that order.

The first 30 minutes of every investigation, automated. The verdict is still yours.

01

Confidence as a first-class output

Every finding carries a confidence rating with reasoning. A bump flagged 'Medium — could also be scheduled maintenance' is more useful than a binary alarm.

02

Line-number traceability

Every AI-generated finding traces back to the exact source lines. The raw log view is one click from any narrative element.

03

No log retention by default

Parse, analyze, discard. Logs may contain credentials in error messages, internal hostnames, PII. Opt in if you want to save for re-analysis.

04

Honest about blind spots

The product never says 'no bumps detected.' It says what it could and couldn't evaluate, and what data would resolve the open questions.