~/projects/log-investigations

Guided log investigations

Planned On the roadmap; nothing to show yet.

Step-through scenarios where the reader flags suspicious log lines and checks their reasoning against analyst notes and a Sigma-style rule.

Tools: TypeScript, Sigma

Planned scope

Scenario 1: repeated failed Windows logons followed by a success from the same source.
Scenario 2: web server access logs containing SQL injection attempts.
Scenario 3: a process tree that ends in an encoded PowerShell command.

Each scenario will use synthetic logs, ask checkpoint questions, and reveal the reasoning and the detection rule after each answer.

Not built yet. This page will be updated when the first scenario works.