BlueTeam/Toolkits

// category

Host & Endpoint Logs

Available tools in the Host & Endpoint Logs category.

Linux Auditd Log Parser

Group raw auditd or ausearch records into readable events with actor, command, file and outcome fields, an explainable risk score and ATT&CK mapping.

Windows Event & Sysmon Log Parser

Parse Windows Event Log XML, Sysmon and Winlogbeat output into normalized logon, process and outcome fields with an explainable risk score and ATT&CK mapping.