3 min read
|
Saved February 14, 2026
|
Copied!
Do you care about this?
LUMEN is a tool for analyzing Windows Event Logs directly on your computer. It allows you to upload and analyze EVTX files, run SIGMA detections, and extract indicators of compromise, all without sending data online. The application supports multi-file uploads and offers features for guided investigations and custom rule management.
If you do, here's more
LUMEN is a Windows Event Log analyzer designed to run entirely on your local machine, allowing you to work with EVTX files without sending any data online. Users can upload multiple files at once, enabling thorough investigations across entire folders of logs. The tool features a guided investigation process, moving from data ingestion through detection, correlation, and export, with a user-friendly collapsible side panel.
The application supports curated SIGMA detections, where users can choose rules based on platform and category to filter noise and enhance the relevance of results. Custom SIGMA rules can also be uploaded for organization-specific needs. LUMEN provides severity-tagged detection results and an intuitive correlation view that links related events, allowing users to see the narrative behind the data. It includes features like IOC extraction for indicators of compromise, automated detection of suspicious process locations, and AI-powered analysis options using various models.
Installation is straightforward through Git, requiring a few npm commands to build and run the application. It also supports large file uploads (up to 1GB) and offers local session saving without any server-side storage. The front end is built with React and Vite, optimizing load times by lazy-loading heavy views. LUMEN emphasizes privacy by design, ensuring all operations are client-side with no telemetry or data uploads involved.
Questions about this article
No questions yet.