LogTriage

LogTriage gives Claude the tools security investigators use on logtriage.app, answering from data instead of memory, with a link to the page that explains each answer.

• lookup_error_code: Entra ID (AADSTS), Windows NTSTATUS (as logged in events 4625 and 4776, hex or decimal) and Kerberos codes, explained from Microsoft's official tables, with where each code is logged.
• explain_log_record: one log record (access log, syslog/auth.log, Windows event XML, CloudTrail, Entra ID, CrowdStrike, CEF and more) field by field, with each meaning's source and decoded times, codes, addresses and PowerShell.
• check_ip_blocklists: IPv4 addresses against 12 free public blocklists (IPsum, FireHOL, Spamhaus DROP, blocklist.de and others), refreshed twice a day.
• scan_log_for_attacks: format detection for more than 50 log formats and deterministic attack checks (brute force, password spraying, web scanning, cloud privilege changes, suspicious commands), with MITRE ATT&CK techniques.
• search_reference: LogTriage's reference pages on Windows events, error codes, CloudTrail and CrowdStrike events, SSH messages, scanner probes and log formats.

No account or key is needed. Text sent to the tools is processed in memory and not stored.