TraceGuard: investigating security logs with five explainable rules

说明与用途

TraceGuard 是一个基于浏览器的工具，自动识别五个关键安全日志信号，提供证据和调查步骤，并支持导出已脱敏的报告。

问题

Security logs are useful only when an analyst can connect a finding to the events behind it.

结果

TraceGuard demonstrates a lightweight, privacy‑preserving workflow that surfaces investigation signals from structured logs without requiring server‑side processing or external APIs.

工作流

• Import a JSON array, an object containing events, or quoted CSV (max 2 MiB, 20 000 events).
• The dashboard displays a UTC timeline, category and severity breakdowns, affected users and sources, and offers search and filters.
• Each finding links to evidence IDs, timestamps, an explanation and investigation steps.
• Export redacted JSON or a self‑contained HTML report for further analysis.

证据

TraceGuard analyzes these patterns: Authentication failure burst – Five or more failures for the same source IP and user within five minutes

来源

Import a JSON array, an object containing events, or quoted CSV. Inputs are bounded to 2 MiB and 20,000 events

来源

The dashboard shows a UTC timeline, category and severity breakdowns, affected users and sources, search and filters

来源

Run it locally: Use Node.js 24 or later and pnpm 11 or later

来源