Windows, Linux, macOS and cloud logs in one case
The fast free tools read Windows event logs and stop there. Cloud audit logs need a different script, Linux needs another, and the analyst ends up exporting CSVs from one tool to line up in a spreadsheet with another. The attacker who moved from a phished mailbox to a server crossed those boundaries; the investigation should too.
How KIROSEC answers it
21 source formats, one event model
Native EVTX and Windows XML/JSON exports, Sysmon, Linux syslog (RFC 3164/5424) and auditd, macOS unified log JSON and launchd plists, the Microsoft 365 audit log, Exchange message trace, Entra sign-ins, Azure Monitor, AWS CloudTrail, Okta, Google Workspace, CEF, FortiGate, web access and IIS logs, Splunk exports, and generic CSV, JSON and text.
Correlated across sources
Everything normalises to one event model, so the same attacker address failing to sign in to Microsoft 365 and to an SSH server becomes one finding that spans both.
Drop in a folder or an archive
Import a whole triage collection or zip at once; every file is detected, parsed and kept with its own hash and the archive's.
Where it stops
- macOS support reads `log show` JSON output and launchd plists, not the binary log archive.
Detections that apply
Browse the full detection libraryQuestions
- Can I analyse Microsoft 365 audit logs and Windows event logs together?
- Yes. Import both into one case; they share a timeline and correlate on users, hosts and addresses.
Related problems
See it on your own logs
Bring an incident your current tools struggle with. We will show you how KIROSEC handles it, on your machine, with nothing leaving it.