cyber.hendryadrian.com
Security Insights · socprime.com

Which Log Formats LogTotal Can Analyze

· Original article ↗

Summary

SOC Prime’s LogTotal analyzes EVTX, JSON/JSONL, syslog-style text and CSV logs. The guide explains which formats are sanitized, how to convert files, and how to handle encoding, timestamps and file size.

Key points

  • The guide lists EVTX, JSON/JSONL, syslog-style text and CSV as formats LogTotal can analyze.
  • Text and JSON uploads are sanitized before analysis; EVTX files are not currently sanitized.
  • For JSON, the guide recommends one event per line and provides jq commands to flatten common arrays and API envelopes.
  • It cautions that PowerShell 5.1 may write UTF-16 by default and recommends UTF-8 encoding.
  • ISO 8601 timestamps with a time zone help align findings; classic syslog timestamps omit the year and time zone.
  • The article gives conversion options for systemd journals, macOS log archives, EVTX and compressed logs.
  • The service says uploaded files are analyzed and not retained.

Article Details

Topic
LogTotal-supported log formats, sanitization, and conversion workflows

Vendors

SOC PrimeLogTotal is SOC Prime’s free service for running detection logic against a log file without setting anything up: upload, sanitize, review.

Products

LogTotalLogTotal accepts three kinds of files: Windows event logs in EVTX, JSON (one event per line works best), and syslog-style text.

Related Articles