October 16, 2026 — Service update
- 13 new log formats. Together with Windows Event Log, the analyzer now supports 14 formats and detects them automatically from the file content: Linux: – Linux syslog: auth.log / secure, messages, kern.log (including UFW / iptables firewall), mail.log, cron – Linux audit log (auditd) – systemd journal (journalctl -o json) – Fail2ban log Web servers: – Nginx / Apache access log – Nginx error log – Apache error log (including ModSecurity WAF blocks) – IIS (W3C extended) Security and network: – Suricata IDS (eve.json) – Zeek network logs (TSV and JSON) – CEF (Fortinet, Check Point, Palo Alto and other firewalls / SIEMs) Cloud and apps: – AWS CloudTrail – JSON logs (one object per line: Docker, Node.js, Python, Go…) - Sysmon support. Windows logs now include all Sysmon events (1–29) with plain-language descriptions. Suspicious behaviour is flagged with an explanation: encoded PowerShell, LSASS memory access, code injection, persistence via registry / Startup / WMI, unsigned drivers, shadow copy deletion, DNS tunneling and more. - Filters adapt to the log type. Each format gets its own filter buttons and a "suspicious sources by IP" panel that flags brute-force, password spraying, username guessing, port scans and web attacks (SQL injection, XSS, path traversal, Log4Shell and more). - Demo logs. Press "Demo" next to "Analyze" to try any format with a sample log that mixes normal activity with typical attacks. Demo files are analyzed in your browser, exactly like your own logs. - New "What's new" page. You are reading it now. Every new feature and fix will be posted here. – Hover over "14 formats" to see every supported format, and over the "i" button to see what the current parser recognizes. – Lines that cannot be parsed are never hidden: they are shown and counted as "Unparsed".