Our security software

Anyone who has ever analyzed Windows event logs knows what endless work it is to go through several hundred kinds of events by type, without full knowledge of the case, find the connections between them, build the timeline and confirm the findings. This is where LogStalker comes in.

• Rust-based EVTX engine. Sigma rules, MITRE ATT&CK mapping, severity scoring and eight selectable analysis profiles.
• Full forensic timeline. EvtxECmd parses every event, with five- and thirty-minute pivots on one machine or by account.
• Verified AI investigation (Mecha). Code drives the investigation, the AI rules on closed questions, and 12 coverage gates verify the report.
• Your choice of AI provider. Local Ollama or LM Studio, cloud OpenAI or Claude, and a Chat that queries the timeline itself.
• Three-tier incident management. Main incident, investigation and analysis on PostgreSQL, with RBAC roles and a restorable trash.
• PowerShell ScriptBlock reconstruction. Complete scripts from fragmented events, Base64 decoding and automatic IoC extraction.
• Nine kinds of Stack Analysis. Frequency-based anomaly detection across processes, command lines, services and logons.
• Four timeline modules and a process tree. Logons, suspicious processes, scheduled tasks, device connections and the parent-child tree.
• GeoIP map and VirusTotal checks. Logon Summary, regex log search and lateral movement pivots with interactive visualizations.
• Incident report and custom rules. Printable HTML and PDF report, custom Sigma rules checked before saving, a self-updating rule set.
• Logging coverage. EventID metrics, the OSSEM event dictionary and a downloadable script that turns on endpoint logging.
• Security by default. HTTPS, bcrypt authentication, an encrypted key store, a full audit log and offline annual licensing.

StaticDocLab sorts every incoming document, archive and attachment into one of five risk levels and, before anyone opens it, tells you: safe to open, or do not open. The file never has to run.

• PE, EXE, DLL and SYS deep analysis. Sections, import and export tables, entropy, suspicious API calls, signature verification.
• PDF inspection. JavaScript and OpenAction detection, embedded file extraction, URLs from annotations, entropy analysis.
• PDF signatures and provenance. E-signatures (pyHanko) checked against EU trusted lists, C2PA content credentials against the official list.
• Office, OLE and RTF analysis. Macro behavior without running the macro (download, execution, persistence), XLM macros and VBA stomping.
• PowerShell decoding. Base64-hidden commands decoded recursively, plus what they would do: download, persistence, weakening defenses.
• Named attack techniques. Follina, Equation Editor, OLE2Link, the WinRAR CVE-2023-38831 flaw, remote template injection and MotW bypass.
• More file types. LNK command lines and LOLBAS, HTML smuggling, active SVG content, ISO and VHD disk images, MSI, CHM and OneNote.
• Email analysis from .eml and .msg. Header and metadata inspection, recursive attachment extraction, automatic IOC extraction.
• YARA rule engine. One-click updates from ten GitHub sources, custom rule upload and weighted risk scoring.
• Threat intelligence. VirusTotal, AlienVault OTX, AbuseIPDB, URLhaus, MalwareBazaar, offline ClamAV, ssdeep similarity, encrypted API keys.
• Linux ELF analysis and archive handling. Recursive ZIP, RAR, 7z and TAR extraction with password guessing and zip bomb protection.
• Export and REST API. Bilingual PDF report, JSON and CSV export, a token-based API with Swagger docs, duplicate hash detection.

Hand HeaderGuard full emails from your email client as EML, MSG, MBOX or PST files, several at once if you like, paste the raw source, or give it just the raw header block. The analysis is equally comprehensive in every case.

• Automatic True Origin IP. Bottom-up traversal, private IP filtering, MaxMind geolocation and an interactive world map.
• SPF, DKIM, DMARC and ARC at once. Live DNS lookups, with header auth results checked against the actual DNS record.
• Homoglyph and Unicode spoofing detector. More than 60 confusable character pairs, Levenshtein brand matching, IDN and Punycode.
• Threat intelligence integration. VirusTotal, AbuseIPDB, PhishTank, URLScan.io, Pulsedive, EmailRep, HIBP, DNSBL and domain age (RDAP).
• AlienVault OTX APT attribution. APT groups, malware families, MITRE ATT&CK techniques and campaign names.
• Links and attachments. Resolves URL shorteners and SafeLinks rewrites, detects Office macros, MIME mismatches and PDF links.
• Quishing detector. QR codes in PNG and JPG attachments are decoded and the extracted URLs go through the threat intelligence checks.
• Rule-based phishing engine. Hungarian and English patterns: urgency, credential requests, financial lures, 27 brands, fake sender names.
• AI psycho-linguistic analysis. A local Ollama or LM Studio model streams in real time, flagging signs of manipulation.
• Timing anomaly and crypto wallet detector. Backward timestamps, delays of more than two hours between hops, BTC and ETH addresses.
• Case management and correlation. Campaign-level and linked cases, 2D and 3D node graphs and a correlation report.
• Reports and export. PDF report, NIS2 incident documentation, IoC export in CSV and MISP formats, full JSON export.
• Enterprise operation. User roles, offline signed licensing, encrypted API keys, a source-free image, Hungarian and English UI.

Web server logs contain a wealth of information, but traditional grep cannot help you see the patterns. Grepster gives you visual insight into traffic trends, anomalies and suspicious IP addresses, so you catch attack indicators that grepping raw logs would miss.

• Streaming TypeScript parser. Files are processed line by line, never loaded into memory, in independently scalable worker containers.
• ClickHouse analytics database. Columnar OLAP storage and pre-aggregated rollup tables, so the dashboard reads a fraction of the rows.
• Zero configuration. Apache, Nginx, Tomcat, IIS, HAProxy, AWS ALB, Caddy, Squid, syslog, JSON and more are recognized automatically.
• Case-based management. Logs are organized into projects, and a case can be shared with colleagues as analyst or viewer.
• Built-in threat detection. SQL injection, XSS, path traversal, known scanners (sqlmap, nikto, nmap) and suspected brute force.
• Apache ECharts visualization. An interactive dashboard of traffic trends, failed requests and security alerts.
• IP and path analysis. Suspicious addresses, most visited pages, failed requests, status codes, a GeoIP world map and country ranking.
• Regex search and export. Pattern search in ClickHouse, multi-dimensional filters, streamed export of results as CSV, JSON and JSONL.
• BullMQ and Redis background processing. A reliable job queue, with parse progress pushed live over Server-Sent Events.
• Docker-based, production-ready architecture. API, worker, UI, databases and Prometheus metrics in a single stack.