LogsTotal

LogsTotal is a self-hosted log analysis platform. Drop a log file — Windows EVTX or Event XML, Winlogbeat/EVTX JSON, auditd, syslog, a journald export, Sysmon for Linux — and several detection engines run Sigma rules over it and report what each one found: findings grouped by severity, MITRE ATT&CK context, the entities involved, and analyst tooling on top.

No account is needed to submit a file or read public results.

Detection engines: Zircolite, Chainsaw, Hayabusa, ChopChopGo and RSigma. Adding another takes a catalog entry and an adapter, with a typed output mapping, for a binary or a Docker image — see Adding a tool adapter.

Screenshots

Upload & workflow	Detection	Analytics
Events timeline	Rules	Process tree

What you get

• Drop a log, get a detection report. Five engines are available; the workflow and log type determine which engines run. The log type is detected on drop.
• MITRE ATT&CK context — a tactic heat-map per job.
• Two timelines — an hourly activity histogram by tactic, and a zoomable per-alert timeline.
• Process trees rebuilt from rule-matched process-creation events.
• Entity extraction and pivoting, and investigation cases.
• A relationship graph with community detection, pathfinding, threat colouring and GraphML export.
• Rules — your own detection layer over what an analysis produces, with auto-tagging, alerts and signed webhooks.
• Export to the rest of your stack — IOC feed (CSV/JSON/STIX/MISP), STIX bundles, MISP events, clipboard IOC packs.
• Fuzzy similarity — TLSH matching between uploads, plus cross-job rule correlation.

Access model

Feature	Admin	Member	User	Anonymous
Upload and jobs	yes	yes	yes	yes
Private submissions	yes	yes	yes	no
Intel (entities, cases, rules)	yes	yes	no	no
Admin pages and workflows	yes	no	no	no

Administrators assign roles at /admin/users.

Prerequisites

• Ubuntu or Debian (the tested platforms), with Docker Engine and the Compose plugin.
• 7z (p7zip-full), rsync and curl.
• Python 3.11 or later on the host, standard library only, for the helper scripts.
• Nothing for the commands themselves: ./logstotal brings its own pinned Task.
• A desktop browser, 1024px or wider, for the people using it.

The full list, with install commands, is in Prerequisites.

Quick start

Download logstotal-<version>.7z from the releases page. On the host:

7z x logstotal-<version>.7z -ologstotal
cd logstotal
./logstotal quickstart

./logstotal quickstart creates .env, generates every secret — including the admin password, printed once, so save it — builds and checks the stack, starts it, and waits for it to answer. It is safe to re-run.

Then open http://<host>:8000 and log in with ADMIN_EMAIL from .env and the printed password. The step-by-step version, PostgreSQL, and what to do next are in Single-host installation.

To upgrade, run ./logstotal upgrade from the same directory: it downloads the latest release and applies it. ./logstotal upgrade:rollback restores the release before it, on this host or on every host of a fleet. Each rollback consumes its snapshot, so running it twice goes back two releases. See Upgrade and rollback.

Documentation

The administrator documentation is published at https://wagga40.github.io/LogsTotal/, and every release ships it in docs/:

• Prerequisites, then single-host installation, HTTPS with Caddy, fleet installation or offline installation
• Configuration — every environment variable
• Health, logs and first-day checks
• Upgrade and rollback
• Security and Known limitations
• Commands — every ./logstotal command

The guide for analysts (submitting logs, reading results, Intel) is built into the application, at /docs. Contributors start with Local development.

Project

• CHANGELOG.md — what changed in each release
• CONTRIBUTING.md — how to propose a change
• SECURITY.md — reporting a vulnerability (please don't open a public issue)
• LICENSE — MIT