io.github.logtriage-cyber/logtriage · v1.0.0 · cloud-and-infra
LogTriage is healthy: it completed an MCP handshake in 1044 ms and exposes 7 tools.
Security log tools: Windows/Entra error codes, log explainer, IP blocklists, attack scans
Endpoint: https://api.logtriage.app/mcp (streamable-http)
No repository listed · Website · JSON · Add to my inventory
| Users (last 30 days) | 0 |
| Handshake | Healthy |
| Auth needed | None |
| Tool count | 7 |
| Latency | 1044 ms |
| Last checked (UTC) | 2026-11-05T08:55:47.597Z |
| Checked (UTC) | Status | Latency | Error |
|---|---|---|---|
| 2026-11-05T08:55:47.597Z | Healthy | 1044 |
lookup_error_code | Explains Microsoft authentication error codes from Microsoft's official tables: Entra ID sign-in errors (AADSTS50126, or the bare 50126), Windows NTSTATUS codes as logged in events 4625/4776 (0xC000006A, C000006A, or decimal 3221225578 / -1073741718), Kerberos failure codes from events 4768/4769/477 |
explain_log_record | Identifies the format of one log record (access-log line, syslog/auth.log line, Windows event XML, CloudTrail, Entra ID, CrowdStrike, firewall, CEF/LEEF and more) and lists every field with what it means and where that meaning comes from (LogTriage's reference pages or the vendor's published definit |
check_ip_blocklists | Checks IPv4 addresses against 12 free public blocklists (IPsum, FireHOL levels 1-3, Spamhaus DROP, blocklist.de, CINS Army, GreenSnow, DShield, ET compromised, Tor exits), the same lists as logtriage.app's IP blocklist checker. Accepts a list of addresses or any text containing them (log lines, CSV) |
scan_log_for_attacks | Detects the log format (50+ formats: web access logs, auth.log, Windows events, Sysmon, CloudTrail, Entra ID, Okta, Kubernetes audit, firewalls, EDR exports and more) and runs LogTriage's deterministic attack checks: brute force and password spraying, logins after failures, web scanning and injectio |
search_reference | Finds LogTriage's reference pages for an investigation: Windows Security event IDs, Entra AADSTS, NTSTATUS and Kerberos codes, AWS CloudTrail events (ConsoleLogin, AssumeRole...), CrowdStrike Falcon events (ProcessRollup2...), sshd/PAM log messages, web scanner probes, scanner user agents, log forma |
analyze_log_file | Runs LogTriage's full analysis on a log: parsing (50+ formats), threat-intelligence enrichment of addresses, user agents and hashes, risk scoring, attack-pattern detection and an AI-written incident report with indicators, MITRE ATT&CK mapping and remediation steps. Needs a LogTriage API key sent as |
get_analysis | Returns the status and, once complete, the incident report of an analysis started with analyze_log_file: severity, attack pattern, executive summary, detected patterns, indicators, MITRE ATT&CK techniques, remediation steps and a link to the full report in the app. Needs the same API key. |