TraceGuard: investigating security logs with five explainable rules

Описание и применение

TraceGuard – браузерный инструмент для расследования логов безопасности, автоматически выявляющий пять ключевых сигналов с объяснениями и возможностью экспорта отчётов.

Задача

Security logs are useful only when an analyst can connect a finding to the events behind it.

Результат

TraceGuard demonstrates a lightweight, privacy‑preserving workflow that surfaces investigation signals from structured logs without requiring server‑side processing or external APIs.

Рабочий процесс

• Import a JSON array, an object containing events, or quoted CSV (max 2 MiB, 20 000 events).
• The dashboard displays a UTC timeline, category and severity breakdowns, affected users and sources, and offers search and filters.
• Each finding links to evidence IDs, timestamps, an explanation and investigation steps.
• Export redacted JSON or a self‑contained HTML report for further analysis.

Доказательства

TraceGuard analyzes these patterns: Authentication failure burst – Five or more failures for the same source IP and user within five minutes

Источник

Import a JSON array, an object containing events, or quoted CSV. Inputs are bounded to 2 MiB and 20,000 events

Источник

The dashboard shows a UTC timeline, category and severity breakdowns, affected users and sources, search and filters

Источник

Run it locally: Use Node.js 24 or later and pnpm 11 or later

Источник