A Python library and CLI for creating interactive visualizations of security and system logs like Cuckoo JSON and ProcMon CSV.
Visualize_logs is a Python library and command-line toolset that creates interactive graph visualizations from security and system logs. It transforms structured log data—like Cuckoo JSON reports and ProcMon CSV files—into visual plots showing relationships between processes, files, registry keys, and network connections, making it easier to analyze malware behavior and system activity.
Security analysts, malware researchers, and forensic investigators who need to visualize and understand complex log data from sandboxes like Cuckoo or system monitors like ProcMon.
It provides an open-source, extensible alternative to commercial tools like ProcDot, offering interactive visualizations directly from the command line with support for multiple log formats and customizable filtering options.
A Python library and command line tools to provide interactive log visualization.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Generates zoomable, hoverable HTML plots using Graphviz and Plotly, allowing detailed exploration of log data as demonstrated in the extensive gallery with examples like Kovter and ransomware.
Offers command-line flags to filter by activity type (e.g., file writes, registry deletes) and ignore/include paths via regex, enabling focused analysis on specific log events.
Includes tools like plotcuckoojson and plotprocmoncsv for quick plotting from the terminal, and provides a Python API for programmatic integration into scripts, as noted in the usage and documentation sections.
Currently supports Cuckoo-modified JSON reports and ProcMon CSV logs, with a unified framework and plans for more formats, making it a starting point for extensible log visualization.
Only supports two specific log formats, with others 'coming' but not yet available, restricting immediate use for diverse logging systems beyond security sandboxes.
Requires Graphviz installation and Python 3, with noted compatibility issues on Windows and untested environments, adding overhead for quick deployment.
The README warns that processing large ProcMon CSV files can be slow, recommending pre-filtering, which may hinder analysis of extensive datasets without manual intervention.
Visualize_Logs is an open-source alternative to the following products: