LogInquisitor

Upload your security logs.
Ask what happened in plain English.

Upload your security logs.
See what happened, in seconds.

CloudTrail, CloudWatch, VPC Flow, Entra ID, Defender, Sentinel exports, Windows and Linux, firewalls, Okta and more — parsed automatically and checked against detection rules and threat intelligence, and investigated by AI on request.

LogInquisitor is in private beta. Access is by invitation only.

Request access

Tell us a little about you. We review every request and email you sign-in details if it's approved.

What are you interested in?

Thanks, we've got your request

If it's approved, you'll get an email with your username and a temporary password. It usually takes a day or two.

  • Drop in raw files. .json, .gz, .zip, .csv, .log, .evtx — the format is detected for you.
  • Findings first. Brute force, password spraying, privilege escalation, log tampering and more are flagged on upload.
  • Ask anything. “Which IPs touched EC2 on Monday and Thursday?” The AI queries your data and shows its working.
  • Search everything. Filter every event by IP, user, host or text, across all your uploads at once.
  • Safe by design. Every upload is checked before it's read, and your data is kept in storage of its own.
LogInquisitor

Security log analysis

Every log tells a story.
Read it faster.

Hosted in London (eu-west-2) · your data stays in storage of its own

LogInquisitor

Sign in

Welcome back. Use the email address your invitation was sent to.

New here?

No account yet?

Choose your password

You signed in with a temporary password. Pick your own to finish setting up your account.

  • At least 12 characters
  • An upper-case letter
  • A lower-case letter
  • A number
  • Both passwords match

Two-step check

Enter the 6-digit code from your authenticator app.

Protect your account

Sign-in needs an authenticator app (such as Microsoft Authenticator, Google Authenticator or 1Password). Add this key to it, then enter the code it shows.

On your phone? Open in your authenticator app

Reset your password

Enter your email and we'll send you a code to set a new password.

Set a new password

If an account exists for that address, we've emailed it a code.

  • At least 12 characters
  • An upper-case letter
  • A lower-case letter
  • A number
  • Both passwords match

·

Create your account

We'll email you a code to confirm your address.

  • At least 12 characters
  • An upper-case letter
  • A lower-case letter
  • A number
  • Both passwords match

Already have an account?

Check your email

We've sent you a confirmation code.

When you sign in, your password never leaves this browser. It is checked with a one-time signature instead.

LogInquisitor
▤Overview ✦Ask AI ⚠Findings ⇧Uploads ◉Threat intel ↻Forwarding ⌕Explore ☑Requests

Access requests

Approving creates the account and emails the person a temporary password. Only members of the admins group see this page.

Overview

Ask AI

The AI queries your normalised events and shows each query it ran. Only a summary of your data and the query results are sent to the AI service — never whole files.

Findings

Uploads

Supported log sources

AWS

CloudTrail (S3 delivery, lookup-events, EventBridge), CloudWatch Logs exports & subscriptions, VPC Flow Logs (default & custom), GuardDuty, Security Hub, ALB access logs, WAF, Route 53 Resolver

Microsoft

Entra ID sign-in & audit (Graph, Log Analytics, diagnostic exports), Sentinel query exports (CSV/JSON), Azure Activity, Microsoft 365 unified audit log, Defender alerts & advanced hunting

Endpoint & OS

Windows Event Log (.evtx, XML, JSON, Winlogbeat, SecurityEvent), Sysmon, Linux syslog / auth.log / secure, journald, auditd

Network & identity

Palo Alto, Fortinet, Check Point & others via CEF/LEEF, Cisco ASA/FTD, Suricata, Zeek, Okta System Log, Google Workspace, Apache/Nginx, any JSON/CSV/key=value

Google Cloud & Kubernetes

Cloud Audit Logs (admin activity, data access, policy denied), VPC Flow Logs, Cloud Firewall logs, Kubernetes audit logs from EKS, AKS, GKE or self-managed clusters

OCSF & data lakes

OCSF events from Amazon Security Lake and vendor exports (CrowdStrike, Okta, Cloudflare, Zscaler…), as JSON or Parquet files

Forward logs from S3

Send logs to LogInquisitor automatically: S3 replication copies new files from a bucket in your AWS account into a private intake bucket of yours here. Every 15 minutes, whatever has arrived becomes an upload, checked and analysed like any other. You keep control: we never get access to your AWS account, and you can stop forwarding at any time by removing the replication rule or turning it off here.

Threat intel

Known-bad IPs, IP ranges, domains, URLs and file hashes are checked against all of your logs, including logs uploaded before an indicator was known. Matches appear on the Findings page.

Your indicator lists your own IOCs take priority over built-in feeds
Plain text, CSV, JSON, STIX 2.1 bundles and MISP event exports · up to 5 MB
Built-in feeds updated automatically

Explore events

Account unavailable