Guide Compares Log Analysis Tools and Demonstrates a LogTotal Investigation Workflow
Summary
A guide compares 10 log analysis tools and walks through exporting Windows and Linux logs, sanitizing them, and analyzing them with LogTotal. The vendor says LogTotal correlates findings into attack chains and does not retain logs.
Key points
- Explains how to export Windows EVTX logs with Event Viewer or wevtutil, and Linux journal or syslog data with journalctl or file copies.
- Compares SIEMs, log pipelines, offline DFIR utilities, and snapshot analyzers, highlighting parsing, normalization, detection content, correlation, speed, and data controls.
- Lists 10 tools, including LogTotal, Splunk, Microsoft Sentinel, Google Security Operations, Elastic Security, Wazuh, Hayabusa, and Chainsaw.
- Demonstrates LogTotal’s workflow: load logs, sanitize them locally, then analyze the sanitized snapshot for ranked attack chains and associated events.
- The article says LogTotal uses a disposable analysis instance, retains no data, and does not use logs for model training; these are vendor claims.
- Describes running the LogTotal sanitizer locally, including in air-gapped environments, and reusing an HMAC key to keep tokens consistent across files.
Article Details
- Defense Focus
- Analyze exported Windows and Linux logs offline or as a snapshot, correlate detection results into attack chains, and protect sensitive log data through sanitization.
- Detection Methods
- Apply maintained detection rules to exported event logs and correlate related events into attack chains.
- Use Sigma rules and built-in detection logic to hunt across EVTX files.
- Evaluate Windows event sequences, including failed and successful logons followed by service installation.
- Review Event ID 4769 events for RC4 encryption type 0x17 when investigating possible Kerberoasting.
- Use ranked findings with attached underlying events to validate detection results.
- Data Sources
- Windows EVTX Security, Sysmon Operational, and PowerShell Operational logs
- Linux systemd journal exported as JSON/NDJSON
- Linux syslog files, including /var/log/auth.log and /var/log/secure
- Cloud and SaaS audit trails in JSON format
- Rule Types
- Sigma rules
- Higher Order Sigma rules
- YARA-L
- SPL
- KQL
- EQL
- Platforms
- LogTotal
- SIEM platforms
- DFIR utilities
- Defensive Actions
- Export relevant event logs from the host, preserving EVTX format for Windows and JSON output for systemd journals.
- Sanitize logs locally before upload; retain and reuse the HMAC key across files to preserve consistent pseudonymous identities.
- Review the sanitized preview and retain a sanitized copy for the case file.
- For air-gapped environments, run the sanitizer locally and upload only sanitized output.
- Validate ranked attack-chain findings against their underlying events and map pseudonymous tokens back to identities internally.
- Run Windows log exports from an elevated prompt; use appropriate permissions when collecting systemd journals.
- Configure persistent systemd journal storage when future collection across reboots is required.
MITRE ATT&CK
Vendors
Products
Elastic SecurityElastic Security. Built on Elasticsearch with the Elastic Common Schema.Google Security OperationsGoogle Security Operations. Formerly Chronicle.GraylogGraylog. Available as open source and commercial editions.LogTotalOthers, like SOC Prime’s LogTotal, match every event against a precompiled detection library and return correlated attack chains, not a list of hits.Microsoft SentinelSIEM and security analytics platforms (Splunk, Microsoft Sentinel, Google SecOps, Elastic) centralize ingestion, run scheduled and streaming detections, and handle triage and case management.Prime DetectPath to continuous coverage: the same engine runs in Prime Hunt across SIEM, EDR, and data lakes, and in Prime Detect on the data stream before the SIEM.Prime HuntPath to continuous coverage: the same engine runs in Prime Hunt across SIEM, EDR, and data lakes, and in Prime Detect on the data stream before the SIEM.Splunk Enterprise SecuritySplunk Enterprise Security. The reference SIEM for many large SOCs.Sumo LogicSumo Logic. A SaaS log analytics platform with a Cloud SIEM tier.WazuhWazuh. An open-source XDR and SIEM with agents for Windows, Linux, and macOS.