LogonTracer
A security tool that visualizes and analyzes Windows Active Directory event logs to investigate malicious logon activity.
What is LogonTracer?
LogonTracer is a security investigation tool that visualizes and analyzes Windows Active Directory event logs to detect malicious logon activity. It correlates hosts, IP addresses, and accounts from authentication events and displays them as interactive graphs, helping security analysts identify compromised credentials and suspicious authentication patterns. The tool applies advanced algorithms like PageRank and Hidden Markov Models to automatically detect anomalies in logon behavior.
Security analysts, incident responders, and cybersecurity professionals who need to investigate potential account compromises and malicious logon activity in Windows Active Directory environments.
LogonTracer provides specialized visualization and analysis of Windows authentication logs that traditional SIEM tools often lack, making complex logon relationships immediately understandable. Its open-source nature and self-hostable deployment give security teams full control over sensitive log data while providing advanced detection algorithms typically found in commercial security products.
Overview
Investigate malicious Windows logon by visualizing and analyzing Windows event log
Use Cases
Best For
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
