Authentication Log Analyzer

Paste authentication log entries and this classifies each one (successful, failed, locked out, disabled account, MFA, and more), then summarizes activity and flags patterns worth a look — repeated failures, a success right after a run of failures, logons outside your usual hours. Failure alone is never called an attack here; patterns are described as observations that may warrant review, not proof of anything. Runs entirely in your browser — your file is not uploaded.

Cross-tool lookups (IOC Lookup, DNS Lookup, Windows Event ID/Error Lookup) open a new page and, for IOC/DNS Lookup, perform a live network request — nothing happens automatically, only when you click one.

Supported sources

Reliably parsed: Linux SSH authentication logs (auth.log / secure — Accepted/Failed password, invalid user, pam_faillock lockouts) and Windows sign-in events exported as JSON with an EventID field (4624/4625/4634/4647/4740/ 4768/4769/4771/4776 are mapped to specific outcomes, including 4625's common sub-status codes for wrong password / unknown user / locked / disabled / expired). Generic application, VPN, RADIUS, and Microsoft Entra ID sign-in logs are recognized when they use common field names (username/user, ip/ipAddress, status/result, etc.) via a best-effort generic classifier — this is not a dedicated parser for those formats, so treat its output as a starting point, not a guarantee. Lines that don't match anything are kept and shown as unknown rather than dropped.