{"id":13387902,"url":"https://github.com/jpcertcc/logontracer","last_synced_at":"2026-10-19T01:03:33.624Z","repository":{"id":39003702,"uuid":"111882253","full_name":"JPCERTCC/LogonTracer","owner":"JPCERTCC","description":"Investigate malicious Windows logon by visualizing and analyzing Windows event log","archived":false,"fork":false,"pushed_at":"2026-08-02T02:31:38.000Z","size":13529,"stargazers_count":3289,"open_issues_count":22,"forks_count":493,"subscribers_count":133,"default_branch":"master","last_synced_at":"2026-10-17T10:41:56.120Z","etag":null,"topics":["active-directory","blueteam","dfir","event-log","javascript","python-3","security","visualization"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/JPCERTCC.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2017-11-24T06:07:49.000Z","updated_at":"2026-10-16T20:40:12.000Z","dependencies_parsed_at":"2023-01-31T02:31:27.034Z","dependency_job_id":"7292d2ab-c75b-44bd-a70c-6fd8c9bdabfd","html_url":"https://github.com/JPCERTCC/LogonTracer","commit_stats":{"total_commits":191,"total_committers":11,"mean_commits":"17.363636363636363","dds":0.3036649214659686,"last_synced_commit":"b814fef899e9057af54f2f551d7e7cd6988fb488"},"previous_names":[],"tags_count":21,"template":false,"template_full_name":null,"purl":"pkg:github/JPCERTCC/LogonTracer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JPCERTCC%2FLogonTracer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JPCERTCC%2FLogonTracer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JPCERTCC%2FLogonTracer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JPCERTCC%2FLogonTracer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/JPCERTCC","download_url":"https://codeload.github.com/JPCERTCC/LogonTracer/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JPCERTCC%2FLogonTracer/sbom","scorecard":{"id":69084,"data":{"date":"2025-08-11","repo":{"name":"github.com/JPCERTCC/LogonTracer","commit":"b814fef899e9057af54f2f551d7e7cd6988fb488"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":3,"checks":[{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Code-Review","score":1,"reason":"Found 3/27 approved changesets -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql-analysis.yml:28","Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql-analysis.yml:29","Warn: no topLevel permission defined: .github/workflows/codeql-analysis.yml:1","Warn: no topLevel permission defined: .github/workflows/logontracer-daily-test.yml:1","Warn: no topLevel permission defined: .github/workflows/logontracer-test.yml:1","Warn: no topLevel permission defined: .github/workflows/publish-docker-image.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":9,"reason":"license file detected","details":["Info: project has a license file: LICENSE.txt:0","Warn: project license file does not contain an FSF or OSI license."],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Vulnerabilities","score":0,"reason":"29 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: PYSEC-2018-66 / GHSA-562c-5r94-xh97","Warn: Project is vulnerable to: PYSEC-2019-179 / GHSA-5wv5-4vpf-pj6m","Warn: Project is vulnerable to: PYSEC-2023-62 / GHSA-m2qf-hxjv-5gpq","Warn: Project is vulnerable to: PYSEC-2024-4 / GHSA-2mqj-m65w-jghx","Warn: Project is vulnerable to: PYSEC-2023-165 / GHSA-cwvm-v4w8-q58c","Warn: Project is vulnerable to: PYSEC-2022-42992 / GHSA-hcpj-qp55-gfph","Warn: Project is vulnerable to: PYSEC-2023-137 / GHSA-pr76-5cm5-w9cj","Warn: Project is vulnerable to: PYSEC-2023-161 / GHSA-wfm5-v35h-vwf4","Warn: Project is vulnerable to: GHSA-55x5-fj6c-h6m8","Warn: Project is vulnerable to: PYSEC-2014-9 / GHSA-57qw-cc2g-pv5p","Warn: Project is vulnerable to: PYSEC-2021-19 / GHSA-jq4v-f5q6-mjqq","Warn: Project is vulnerable to: GHSA-pgww-xf46-h92r","Warn: Project is vulnerable to: PYSEC-2022-230 / GHSA-wrxv-2j5q-m38w","Warn: Project is vulnerable to: PYSEC-2018-12 / GHSA-xp26-p53h-6h2p","Warn: Project is vulnerable to: PYSEC-2018-34 / GHSA-2fc2-6r4j-p65h","Warn: Project is vulnerable to: PYSEC-2021-856 / GHSA-5545-2q6w-2gh6","Warn: Project is vulnerable to: PYSEC-2019-108 / GHSA-9fq2-x9r6-wfmf","Warn: Project is vulnerable to: PYSEC-2018-33 / GHSA-cw6w-4rcx-xphc","Warn: Project is vulnerable to: PYSEC-2021-857 / GHSA-f7c7-j99h-c22f","Warn: Project is vulnerable to: GHSA-fpfv-jqm9-f5jm","Warn: Project is vulnerable to: PYSEC-2017-1 / GHSA-frgw-fgh6-9g52","Warn: Project is vulnerable to: PYSEC-2021-142 / GHSA-8q59-q68h-6hv4","Warn: Project is vulnerable to: PYSEC-2018-49 / GHSA-rprw-h62v-c2w7","Warn: Project is vulnerable to: PYSEC-2020-107 / GHSA-jjw5-xxj6-pcv5","Warn: Project is vulnerable to: PYSEC-2024-110 / GHSA-jw8x-6495-233v","Warn: Project is vulnerable to: PYSEC-2020-108","Warn: Project is vulnerable to: PYSEC-2019-156 / GHSA-xp76-357g-9wqq","Warn: Project is vulnerable to: PYSEC-2023-102","Warn: Project is vulnerable to: PYSEC-2023-114"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":7,"reason":"SAST tool detected but not run on all commits","details":["Info: SAST configuration detected: CodeQL","Warn: 0 commits out of 6 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/JPCERTCC/LogonTracer/codeql-analysis.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/JPCERTCC/LogonTracer/codeql-analysis.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/JPCERTCC/LogonTracer/codeql-analysis.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/JPCERTCC/LogonTracer/codeql-analysis.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/logontracer-daily-test.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/JPCERTCC/LogonTracer/logontracer-daily-test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/logontracer-daily-test.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/JPCERTCC/LogonTracer/logontracer-daily-test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/logontracer-test.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/JPCERTCC/LogonTracer/logontracer-test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/logontracer-test.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/JPCERTCC/LogonTracer/logontracer-test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-docker-image.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/JPCERTCC/LogonTracer/publish-docker-image.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-docker-image.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/JPCERTCC/LogonTracer/publish-docker-image.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-docker-image.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/JPCERTCC/LogonTracer/publish-docker-image.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-docker-image.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/JPCERTCC/LogonTracer/publish-docker-image.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-docker-image.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/JPCERTCC/LogonTracer/publish-docker-image.yml/master?enable=pin","Warn: containerImage not pinned by hash: docker-compose-with-elasticstack/LogonTracer/build/Dockerfile:1: pin your Docker image by updating python:3.12.0-slim to python:3.12.0-slim@sha256:19a6235339a74eca01227b03629f63b6f5020abc21142436eced6ec3a9839a76","Warn: containerImage not pinned by hash: docker-compose-with-nginx/LogonTracer/build/Dockerfile:1: pin your Docker image by updating python:3.12.0-slim to python:3.12.0-slim@sha256:19a6235339a74eca01227b03629f63b6f5020abc21142436eced6ec3a9839a76","Warn: containerImage not pinned by hash: docker-compose/LogonTracer/build/Dockerfile:1: pin your Docker image by updating python:3.12.0-slim to python:3.12.0-slim@sha256:19a6235339a74eca01227b03629f63b6f5020abc21142436eced6ec3a9839a76","Warn: containerImage not pinned by hash: docker/Dockerfile:1: pin your Docker image by updating neo4j:4.4.27 to neo4j:4.4.27@sha256:0e593674d131841df7955d637c17a7f4e4622c2318a771e658b37f9f92c1c3b7","Warn: pipCommand not pinned by hash: docker-compose-with-elasticstack/LogonTracer/build/Dockerfile:17-28","Warn: pipCommand not pinned by hash: docker-compose-with-elasticstack/LogonTracer/build/Dockerfile:17-28","Warn: pipCommand not pinned by hash: docker-compose-with-elasticstack/LogonTracer/build/Dockerfile:17-28","Warn: pipCommand not pinned by hash: docker-compose-with-elasticstack/LogonTracer/build/Dockerfile:17-28","Warn: pipCommand not pinned by hash: docker-compose-with-elasticstack/LogonTracer/build/Dockerfile:17-28","Warn: pipCommand not pinned by hash: docker-compose-with-nginx/LogonTracer/build/Dockerfile:17-29","Warn: pipCommand not pinned by hash: docker-compose-with-nginx/LogonTracer/build/Dockerfile:17-29","Warn: pipCommand not pinned by hash: docker-compose-with-nginx/LogonTracer/build/Dockerfile:17-29","Warn: pipCommand not pinned by hash: docker-compose-with-nginx/LogonTracer/build/Dockerfile:17-29","Warn: pipCommand not pinned by hash: docker-compose-with-nginx/LogonTracer/build/Dockerfile:17-29","Warn: downloadThenRun not pinned by hash: docker-compose/LogonTracer/build/Dockerfile:19","Warn: pipCommand not pinned by hash: docker-compose/LogonTracer/build/Dockerfile:22-33","Warn: pipCommand not pinned by hash: docker-compose/LogonTracer/build/Dockerfile:22-33","Warn: pipCommand not pinned by hash: docker-compose/LogonTracer/build/Dockerfile:22-33","Warn: pipCommand not pinned by hash: docker-compose/LogonTracer/build/Dockerfile:22-33","Warn: pipCommand not pinned by hash: docker-compose/LogonTracer/build/Dockerfile:22-33","Warn: downloadThenRun not pinned by hash: docker/Dockerfile:132-156","Warn: pipCommand not pinned by hash: docker/Dockerfile:161-174","Warn: pipCommand not pinned by hash: docker/Dockerfile:179-194","Warn: pipCommand not pinned by hash: docker/Dockerfile:179-194","Warn: pipCommand not pinned by hash: docker/Dockerfile:179-194","Warn: pipCommand not pinned by hash: docker/Dockerfile:179-194","Warn: pipCommand not pinned by hash: docker/Dockerfile:179-194","Warn: pipCommand not pinned by hash: docker/Dockerfile:179-194","Warn: pipCommand not pinned by hash: .github/workflows/logontracer-daily-test.yml:29","Warn: pipCommand not pinned by hash: .github/workflows/logontracer-daily-test.yml:30","Warn: pipCommand not pinned by hash: .github/workflows/logontracer-daily-test.yml:31","Warn: pipCommand not pinned by hash: .github/workflows/logontracer-daily-test.yml:32","Warn: pipCommand not pinned by hash: .github/workflows/logontracer-daily-test.yml:33","Warn: pipCommand not pinned by hash: .github/workflows/logontracer-daily-test.yml:34","Warn: pipCommand not pinned by hash: .github/workflows/logontracer-test.yml:29","Warn: pipCommand not pinned by hash: .github/workflows/logontracer-test.yml:30","Warn: pipCommand not pinned by hash: .github/workflows/logontracer-test.yml:31","Warn: pipCommand not pinned by hash: .github/workflows/logontracer-test.yml:32","Warn: pipCommand not pinned by hash: .github/workflows/logontracer-test.yml:33","Warn: pipCommand not pinned by hash: .github/workflows/logontracer-test.yml:34","Warn: pipCommand not pinned by hash: .github/workflows/publish-docker-image.yml:29","Warn: pipCommand not pinned by hash: .github/workflows/publish-docker-image.yml:30","Warn: pipCommand not pinned by hash: .github/workflows/publish-docker-image.yml:31","Warn: pipCommand not pinned by hash: .github/workflows/publish-docker-image.yml:32","Warn: pipCommand not pinned by hash: .github/workflows/publish-docker-image.yml:33","Warn: pipCommand not pinned by hash: .github/workflows/publish-docker-image.yml:34","Info:   0 out of  11 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   2 third-party GitHubAction dependencies pinned","Info:   0 out of   4 containerImage dependencies pinned","Info:   0 out of  40 pipCommand dependencies pinned","Info:   0 out of   2 downloadThenRun dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}}]},"last_synced_at":"2025-08-15T03:23:15.988Z","repository_id":39003702,"created_at":"2025-08-15T03:23:15.988Z","updated_at":"2025-08-15T03:23:15.988Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344872684,"owners_count":38334005,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-17T02:00:06.547Z","response_time":57,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["active-directory","blueteam","dfir","event-log","javascript","python-3","security","visualization"],"created_at":"2024-07-30T12:01:37.702Z","updated_at":"2026-10-19T01:03:33.614Z","avatar_url":"https://github.com/JPCERTCC.png","language":"Python","funding_links":[],"categories":["\u003ca id=\"ac43a3ce5a889d8b18cf22acb6c31a72\"\u003e\u003c/a\u003eETW"],"sub_categories":["\u003ca id=\"0af4bd8ca0fd27c9381a2d1fa8b71a1f\"\u003e\u003c/a\u003e工具"],"readme":"\u003cdiv align=\"center\"\u003e\u003cimg src=\"images/logo_top.svg\" width=\"500\"\u003e\u003c/div\u003e\n\n[![Version](https://img.shields.io/badge/version-2.0-blue)](https://github.com/JPCERTCC/LogonTracer/releases) [![Docker pull](https://img.shields.io/docker/pulls/jpcertcc/docker-logontracer)](https://hub.docker.com/r/jpcertcc/docker-logontracer/) ![test](https://github.com/JPCERTCC/LogonTracer/workflows/test/badge.svg?branch=master)\n\n## Concept\n\n**LogonTracer v2** is a tool to investigate malicious logon by visualizing and analyzing Windows Active Directory event logs. This tool associates a host name (or an IP address) and account name found in logon-related events and displays it as a graph. This way, it is possible to see in which account login attempt occurs and which host is used.\n\nThis tool can visualize the following event IDs related to Windows logon.\n\n| Event ID | Description |\n|----------|-------------|\n| **4624** | Successful logon |\n| **4625** | Logon failure |\n| **4662** | An operation was performed on an object |\n| **4672** | Assign special privileges |\n| **4719** | System audit policy was changed |\n| **4720** | A user account was created |\n| **4726** | A user account was deleted |\n| **4728 / 4732 / 4756** | A member was added to a security-enabled group |\n| **4729 / 4733 / 4757** | A member was removed from a security-enabled group |\n| **4768** | Kerberos Authentication (TGT Request) |\n| **4769** | Kerberos Service Ticket (ST Request) |\n| **4776** | NTLM Authentication |\n| **5137** | A directory service object was created |\n| **5141** | A directory service object was deleted |\n\nMore details are described in the following documents:\n- [Visualise Event Logs to Identify Compromised Accounts - LogonTracer -](http://blog.jpcert.or.jp/2017/11/visualise-event-logs-to-identify-compromised-accounts---logontracer-.html)\n- [イベントログを可視化して不正使用されたアカウントを調査](https://www.jpcert.or.jp/magazine/acreport-logontracer.html) (Japanese)\n\n![LogonTracer sample](images/sample.png)\n\n---\n\n## What's New in Version 2.0\n\n### AI-Powered Security Analysis\nLogonTracer v2.0 integrates an AI analysis engine using OpenAI GPT models to provide intelligent threat detection beyond traditional rule-based approaches.\n\n- **Security Pattern Analysis** — Automatically interprets graph query results and generates risk assessments with MITRE ATT\u0026CK tactic mapping\n- **Autonomous LLM Agent** — An iterative AI agent that autonomously generates and executes Cypher queries against the Neo4j graph to discover threats without manual intervention\n- **AI-Generated Sigma Rules** — Converts AI analysis findings into deployable Sigma detection rules\n- **Multi-language Support** — AI responses can be generated in English, Japanese, or French\n\n### Sigma Rule Integration\n- **Bundled Sigma Rules** — Includes the full [SigmaHQ](https://github.com/SigmaHQ/sigma) rule set for scanning EVTX files\n- **Sigma Scan on Upload** — Optionally run Sigma rule scanning automatically during EVTX file upload\n- **Sigma Rescan API** — Re-scan previously uploaded EVTX files with a specific Sigma rule folder via REST API\n- **Sigma Results View** — Dedicated UI page displaying Sigma detection results in an interactive table\n\n---\n\n## Additional Analysis\n\nLogonTracer uses [PageRank](https://en.wikipedia.org/wiki/PageRank), [Hidden Markov Model](https://en.wikipedia.org/wiki/Hidden_Markov_model), and [ChangeFinder](https://pdfs.semanticscholar.org/c5bc/7ca31914d3cdfe1b2932cbc779875e645bbb.pdf) to detect malicious hosts and accounts from event logs.\n\n![PageRank List](images/rank.png)\n\nWith LogonTracer, it is also possible to display event logs in chronological order.\n\n![Timeline](images/timeline.png)\n\n---\n\n## Requirements\n\n- Python 3.9 or later (3.12 recommended)\n- Neo4j 5.x (Community or Enterprise)\n- OpenAI API key (optional — required only for AI analysis features)\n\n- Python modules\n\n```\nnumpy\nevtx\nlxml\nscipy\nchangefinder\nflask\nhmmlearn\u003e=0.2.8\nscikit-learn\nelasticsearch-dsl\u003e=7.0.0,\u003c8.0.0\npyyaml\nflask-sqlalchemy\nflask-login\nflask_wtf\nflask-limiter\nwtforms\nGitPython\npysigma\u003e=0.11.0\npysigma-backend-sqlite\nopenai\u003e=1.0.0\naiohttp\nneo4j\n```\n\n---\n\n## Installation\n\n### 1. Clone the repository\n\n```shell\ngit clone https://github.com/JPCERTCC/LogonTracer.git\ncd LogonTracer\n```\n\n### 2. Install dependencies\n\n```shell\npip3 install -r requirements.txt\n```\n\n### 3. Start Neo4j\n\nDownload and start [Neo4j](https://neo4j.com/download/). Set the initial password and note the Bolt port (default: `7687`).\n\n### 4. Edit the configuration file\n\n```shell\nvi config/config.yml\n```\n\nKey settings:\n\n```yaml\nsettings:\n  logontracer:\n    WEB_PORT: \"8080\"\n    default_user: \"neo4j\"       # Neo4j username for the default LogonTracer account\n    default_password: \"password\" # Change this before first run\n\n  neo4j:\n    NEO4J_USER: \"neo4j\"\n    NEO4J_PASSWORD: \"password\"   # Your Neo4j password\n    NEO4J_SERVER: \"localhost\"\n    WS_PORT: \"7687\"\n```\n\n### 5. Start the web application\n\n```shell\npython3 logontracer.py --run\n```\n\nOpen your browser at `http://localhost:8080`.\n\n---\n\n## Usage\n\n### Importing Event Logs\n\n#### Import EVTX file(s)\n\n```shell\npython3 logontracer.py -e \u003cpath/to/Security.evtx\u003e -z \u003cUTC offset\u003e -s \u003cNeo4j server\u003e -u \u003cuser\u003e -p \u003cpassword\u003e\n```\n\n#### Import XML file(s)\n\n```shell\npython3 logontracer.py -x \u003cpath/to/event.xml\u003e -z \u003cUTC offset\u003e -s \u003cNeo4j server\u003e -u \u003cuser\u003e -p \u003cpassword\u003e\n```\n\n#### Import from Elasticsearch\n\n```shell\npython3 logontracer.py --es -s \u003cNeo4j server\u003e -u \u003cuser\u003e -p \u003cpassword\u003e --es-server \u003cES host:port\u003e\n```\n\n#### Import with Sigma scanning\n\nAdd the `--sigma` flag to run Sigma rule detection during import:\n\n```shell\npython3 logontracer.py -e \u003cpath/to/Security.evtx\u003e -z 9 -s localhost -u neo4j -p password --sigma\n```\n\n#### Add additional logs (without deleting existing data)\n\n```shell\npython3 logontracer.py -e \u003cpath/to/Security.evtx\u003e -z 9 -s localhost -u neo4j -p password --add\n```\n\n### Web GUI Upload\n\nAfter starting the web application, click **Upload Event Log** in the left sidebar. You can:\n- Select one or more EVTX or XML files\n- Choose the UTC offset for the log timezone\n- Enable **Add additional files** to append data without clearing the database\n- Enable **Run scan using Sigma rules** to run Sigma detection automatically after import\n\n![Upload](images/upload.png)\n\n### Sigma Scan Results\n\nAfter uploading with Sigma scanning enabled, or after triggering a rescan via the API, click **Sigma Scan Results** in the sidebar to view findings.\n\n### AI Analysis (v2.0)\n\n#### Setup\n\n1. Go to **Settings → AI Settings** in the navigation bar\n2. Enable AI analysis and enter your OpenAI API key\n3. Select the GPT model and preferred response language\n\n#### Using AI Analysis\n\n- Click **AI Analysis** in the top navigation to run the autonomous LLM agent\n- The agent iteratively generates Cypher queries, executes them against the Neo4j database, and reports discovered threats\n- Click **AI History** to view the last analysis result\n- From the AI analysis result panel, click **Generate Sigma Rules** to convert findings into Sigma detection rules\n\n---\n\n## Web Application Screenshots\n\n### Login\n![Login](images/login.png)\n\n### Main Graph View\n![Sample](images/sample.png)\n\n### Dark Mode\n![Dark Mode](images/sample_dark.png)\n\n### Timeline\n![Timeline](images/timeline.png)\n\n### Navigation Bar\n![Navigation Bar](images/nav_bar.png)\n\n### Side Bar\n![Side Bar](images/side_bar.png)\n\n### Filter Panel\n![Filter Panel](images/filter_panel.png)\n\n### Diff Graph\n![Diff Panel](images/diff_panel.png)\n\n---\n\n## Case Management (Neo4j Enterprise)\n\nWith Neo4j Enterprise Edition, LogonTracer supports multiple independent investigation cases — each stored in a separate Neo4j database.\n\n- **Add New Case** — Create a new database for a new investigation\n- **Delete Case** — Remove a case database\n- **Add/Delete Access to Case** — Grant or revoke per-user access to specific cases\n- **Change Case** — Switch the active case in the current session\n\n---\n\n## Docker\n\n### Using Docker (single container)\n\n```shell\ndocker run \\\n  --detach \\\n  --publish=7474:7474 --publish=7687:7687 --publish=8080:8080 \\\n  -e LTHOSTNAME=\u003cIP Address\u003e \\\n  jpcertcc/docker-logontracer\n```\n\n### Using Docker Compose\n\n```shell\ncd docker-compose\ndocker compose build\ndocker compose up -d\n```\n\n### Using Docker Compose with HTTPS (nginx)\n\n```shell\ncd docker-compose-with-nginx\ndocker compose build\ndocker compose up -d\n```\n\n### Using Docker Compose with Elastic Stack\n\n```shell\ncd docker-compose-with-elasticstack\ndocker compose build\ndocker compose up -d\n```\n\n---\n\n## Command Line Options\n\n| Option | Description |\n|--------|-------------|\n| `-r`, `--run` | Start the web application |\n| `-o PORT` | Web application port (default: 8080) |\n| `--host HOST` | Bind address (default: 0.0.0.0) |\n| `-e EVTX [...]` | Import EVTX file(s) |\n| `-x XML [...]` | Import XML event log file(s) |\n| `-s SERVER` | Neo4j server address (default: localhost) |\n| `-u USER` | Neo4j username (default: neo4j) |\n| `-p PASSWORD` | Neo4j password |\n| `--wsport PORT` | Neo4j Bolt port (default: 7687) |\n| `-z UTC` | Timezone offset (e.g. `9` for JST) |\n| `-f DATE` | Parse logs from this datetime (e.g. `2024-01-01T00:00:00`) |\n| `-t DATE` | Parse logs to this datetime |\n| `--add` | Append data without clearing the database |\n| `--delete` | Clear the database before importing |\n| `--sigma` | Run Sigma rule scanning during import |\n| `--sigma-only` | Run Sigma scan only (no Neo4j processing) |\n| `--sigma-rules PATH` | Path to Sigma rules folder (default: `sigma`) |\n| `--es` | Import data from Elasticsearch |\n| `--postes` | Post analysis results to Elasticsearch |\n| `--es-server HOST:PORT` | Elasticsearch server |\n| `--es-index INDEX` | Elasticsearch index (default: `winlogbeat-*`) |\n| `--es-prefix PREFIX` | Elasticsearch event prefix (default: `winlog`) |\n| `--case NAME` | Case name for Neo4j Enterprise multi-database mode |\n| `-c FILE` | Configuration file path (default: `config/config.yml`) |\n| `--create_user USER` | Create a new Neo4j user |\n| `--create_password PASS` | Password for the new Neo4j user |\n| `--role ROLE` | Role for the new user (`admin`, `architect`, `reader`) |\n| `--delete_user USER` | Delete a Neo4j user |\n| `-l`, `--learn` | Run machine learning analysis (Hidden Markov Model) |\n\n---\n\n## Demonstration\n\nThe following [YouTube video](https://www.youtube.com/watch?v=aX-vTd7-moY) shows how to use LogonTracer.\n\n[![LogonTracer_Demonstration](https://img.youtube.com/vi/aX-vTd7-moY/0.jpg)](https://www.youtube.com/watch?v=aX-vTd7-moY)\n\n---\n\n## Documentation\n\nFor more details, please check [the LogonTracer wiki](https://github.com/JPCERTCC/LogonTracer/wiki).\n\n---\n\n## License\n\n[LICENSE.txt](LICENSE.txt)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjpcertcc%2Flogontracer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjpcertcc%2Flogontracer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjpcertcc%2Flogontracer/lists"}