Detect anomalous access in your logs
One failed login among thousands of normal requests doesn't stand out to the naked eye. But to the radar it's a clear signal: it drifts from the usual traffic pattern.
No predefined rules or signatures. The normal pattern of your access logs is computed by frequency, and whatever deviates —brute force, new IPs, odd routes— rises to the top.
Paste your access log and let the pattern speak.
Frequently asked questions
Is this a SIEM or a firewall?+
No. It's a triage tool: it orders your log so you look at anomalies first. It doesn't block or alert on its own.
Does it detect known attacks?+
It doesn't look for attack signatures. It detects deviation from the pattern, which is the signal that something different happened.
Can I analyze auth logs?+
Yes, any plain text. Access, auth, and audit logs work equally well.
Related
Features
- Unsupervised
- No labels, no training. The normal pattern emerges from frequency alone.
- 100% local
- The model runs in your browser. Zero data transfer, zero servers.
- Fast
- 22M quantized parameters. Hundreds of lines in milliseconds after the initial load.
- Free and unlimited
- No accounts, no quotas, no usage limits.
- Stack-agnostic
- Works on any text: logs, build output, CSV, whatever you paste.