v1.0.0

The first public release. LogsTotal is a self-hosted platform for analysing security logs:
upload a log file, and several detection engines report what each of them found, side by
side, with the context an analyst needs to act on it.

Highlights

• Several engines, one report. Zircolite, Chainsaw, Hayabusa and ChopChopGo run over the
  same file, with SigmaHQ, Hayabusa and Chainsaw rule sets included. Findings are grouped by
  severity, each names its rule and the rule's author, and a detection score shows how many
  engines agreed.
• Windows and Linux logs. EVTX, Windows Event XML, Winlogbeat and EVTX JSON, Sysmon for
  Linux, auditd, syslog and journald exports, detected automatically; drop many files at
  once.
• Context. MITRE ATT&CK heatmap and timelines, a zoomable events timeline, extracted
  entities (users, hosts, IPs, hashes, executables, domains…) across every analysis, their
  relationships as a graph, and the process tree behind a detection.
• Investigation. Cases that gather jobs and entities with notes, a timeline and a graph;
  tags, discussions and watched jobs; rules that tag, alert or call a webhook when an entity
  or a job matches; exports to STIX 2.1, MISP, IOC packs and a TAXII 2.1 feed; an optional
  AI analysis of a job through your own OpenAI-compatible or Anthropic endpoint.
• Built to be run. One command to install on a server (./logstotal quickstart), HTTPS
  with Caddy, a multi-server fleet with PostgreSQL, S3 storage and a private WireGuard
  network deployed from your workstation, offline bundles for closed networks, verified
  backups, and upgrades that take a rollback point first. Every operation is
  ./logstotal <name> and needs nothing installed beforehand.
• Documentation at https://wagga40.github.io/LogsTotal/.