Log Analyzer

Analyze security logs and detect suspicious activity.

📖 How to use Log Analyzer

Learn the three simple steps before you upload a log file.

1. 📁 Upload 2. 🔍 Analyze 3. 📊 Review results
No file selected
0
Total Requests
0
Failed Requests
0
Unique IPs
0
Security Events

Request Status

🛡️
No Brute Force Activity Detected
Analyze a log to check for repeated failed login attempts.
Successful0%0 events
Failed0%0 events

Activity Over Time

Successful Failed
Events are grouped by minute from the analyzed log timestamps.

Security Events

IP Activity

IP AddressRequestsFailedStatus

📖 User Manual

1. 📁 Select a Log

Tap Choose Log File and select a text-based .log or .txt file from your device. You can also use Load Demo Log to test the analyzer.

2. 🔍 Analyze the Log

Tap Analyze Log to calculate total requests, failed requests, unique IP addresses, security events, request status percentages, and activity over time.

3. 🚨 Brute-Force Detection

CyberShield checks repeated failed requests from the same IP address. When one IP reaches 70 or more failed requests, the Request Status panel changes to Brute Force Attempt Detected.

This is a detection signal based on the analyzed log and should be investigated rather than treated as absolute proof of an attack.

4. 📄 Supported Log Format

CyberShield analyzes plain-text server and web access logs. Apache-style access logs are recommended.

The log should contain an IP address, date and time, HTTP request, and HTTP status code.

Supported timestamp formats include:

01/Sep/2026:10:15:02 +0530
[2026-09-01 10:15:02]
2026-09-01 10:15:02
01/Sep/2026 10:15:02

Recommended example:

192.168.1.10 - - [01/Sep/2026:10:15:02 +0530] "GET /login HTTP/1.1" 200 512

The analyzer uses recognizable IP addresses, timestamps, HTTP requests, and status codes to calculate statistics, analyze activity, identify repeated failed requests, and detect possible security events.