How to Analyze and Pseudonymize Security Logs with LogTotal
Summary
A practical guide to exporting and analyzing security logs with LogTotal, which pseudonymizes data using keyed HMAC tokens before analysis and correlates detections into attack chains.
Key points
- The guide covers exporting Windows EVTX, Linux syslog or journald, AWS CloudTrail, Microsoft Entra ID, and network-device CEF logs.
- It recommends fixing the time window and scope and hashing exported files to support chain of custody.
- LogTotal is described as sanitizing logs in the browser with keyed HMAC-SHA-256 tokens before analysis, preserving relationships between repeated values.
- The tool checks events against detection rules, correlates results with Higher-Order Sigma rules, maps findings to MITRE ATT&CK, and uses AI to explain attack chains.
- The article says analysis runs on a disposable instance and that SOC Prime does not retain logs afterward or train on them.
- For stricter handling or multiple files, the article describes using the open-source logtotal-sanitizer CLI locally and reusing a key.
Article Details
- Topic
- Log analytics workflows and SOC Prime LogTotal’s log analysis and in-browser pseudonymization capabilities.
Vendors
Products
DetectFlowEach analysis runs on a disposable, dedicated instance of SOC Prime’s DetectFlow engine and is deleted afterward.LogTotalExport Security, Sysmon, and PowerShell logs and check LogTotal findings for credential access (T1003), PowerShell execution (T1059.001), and scheduled tasks (T1053.005) before reimaging.Prime DetectPrime Detect: runs Sigma rules on streaming events before the SIEM and correlates them into Attack Chains in real time.Prime HuntPrime Hunt: scans historical SIEM, EDR, and data lake data with relevant rules and infers Attack Chains from the results.Uncoder.IOUncoder.IO: translates Sigma and Roota rules into native queries.