Security Analyst
A complete investigation workspace. Add logs, alerts or raw e-mails: parsing, detection, IOC extraction and phishing analysis run in your browser. Your own AI reviews a compact case briefing — never your raw logs — and every case exports as an incident report, STIX 2.1 indicators or Sigma, KQL, SPL, YARA and Suricata rules.
Included from the Pro plan · runs on your own AI key
How to use Security Analyst
- 1
Open a case and add evidence — logs (JSON, CloudTrail, Windows XML, syslog, CEF, LEEF, Apache/Nginx, CSV), alerts or raw e-mails.
- 2
Review the detections, event timeline, indicators and MITRE ATT&CK matrix computed on your device.
- 3
Ask your AI analyst, then export the incident report, STIX 2.1 indicators and detection rules.
- SOC alert triage
- Log investigation
- Phishing analysis
- Threat hunting
- Incident reports
- Detection engineering
Log analytics on your device
Nine log formats parsed in the browser into one event table with a timeline, top hosts, users and sources, severity filters and brute-force detection.
MITRE ATT&CK matrix
46 behaviour rules map activity to 14 tactics and 130+ techniques; add your own findings, plus the techniques your AI names.
IOCs and phishing analysis
IPs, domains, URLs, hashes and e-mails extracted and defanged, with verdicts and lookups; .eml analysis checks SPF, DKIM, DMARC, links and attachments.
Reports and detection rules
Incident report (Markdown, Word, PDF), STIX 2.1 bundle, blocklists and Sigma, KQL, SPL, YARA and Suricata rules generated from the case.
Decoder
CyberChef-style recipes with Magic auto-detection: Base64, hex, PowerShell -EncodedCommand, gzip, XOR, JWT and 22 operations in all.
AI analyst on your keys
Triage, IOC enrichment, hunting, hardening and incident writing on your own model, from a briefing built on the device.
Guardian AI is the self-hosted counterpart — Docker and Windows, included with Business and Enterprise.