LogFuseIR

LogFuseIR is a web app (with optional lightweight desktop collector) that speeds up incident response by normalizing and correlating messy, multi-source telemetry into a single, time-ordered “attack story.” Instead of trying to replace your SIEM/EDR, it sits on top of what you already have and focuses on the painful middle: assembling evidence, mapping it to a timeline, and producing defensible containment recommendations. It ingests exports and APIs from common tools (EDR alerts, firewall/proxy logs, Okta/Azure AD sign-ins, M365 audit, cloud trail logs), deduplicates entities (users, hosts, IPs), and highlights likely lateral movement paths. An AI assistant helps draft an incident summary, list impacted assets, and generate a containment checklist, but every claim links back to source events for auditability. Realistically, success depends on tight integrations and trust: if the correlations are wrong, teams won’t use it.