How LogTotal Sanitizes Logs Before Analysis
Summary
LogTotal masks identifying values in plain-text, CSV and JSON uploads while preserving patterns needed for detection. EVTX files are not sanitized, so users should review data before uploading and follow their organization’s handling rules.
Key points
- LogTotal replaces identifying values such as usernames, hostnames and IP addresses with consistent placeholders before analyzing plain-text, CSV and JSON uploads.
- The service leaves behavioral details such as event IDs, process and file names, command-line structure, ports, protocols and timestamps intact.
- Users can review the sanitized result before analysis; the article says uploaded files are not kept after analysis.
- Automatic masking may miss secrets in free-text messages, custom fields, codenames in paths or hostnames, and personal data in URLs or query strings.
- EVTX uploads are analyzed without sanitization; the article recommends obtaining data-handling approval for production logs or converting EVTX to JSON lines with evtx_dump.
- Consistent placeholders are pseudonymization, not necessarily anonymization under GDPR.
Article Details
- Topic
- LogTotal's log-sanitization process and privacy considerations for uploaded logs