SOC Analyst Toolkit

Highlight tuner

Highlight the noise. Let the page argue back.

Paste the log that should alert and the log that is a false positive. Drag across what makes the false positive harmless. Before you get any rule text, the page checks it against your alerting log, looks for risky activity, and tries to slip a worse version of the same event past your exclusion.

Runs only in your browser. What you paste or load here is never uploaded, saved, or sent anywhere. This page cannot make network requests at all, and it uses no cookies or storage. Reloading or closing the tab clears everything.

Read this first.

  • Your logs stay in your browser, but they can still hold sensitive details. Use Replace my identifying values first if you will share your screen.
  • It only knows what you paste. Passing the checks means nothing in your samples contradicts the exclusion, not that it is safe. Search history first.
  • Field names are a guess for raw logs. Chronicle converts raw logs to UDM on Google's side, which this page cannot do. Paste UDM JSON for exact names, or correct each guess in the list.
  • Rule exclusions apply to Google curated detections. For your own YARA-L rules use the YARA-L option. Syntax is not validated here; test it in your platform.

1. Paste the two logs

JSON (raw or Chronicle UDM), JSON lines, key=value, CSV or Event Viewer text. Use the same format for both.

2. Replace my identifying values (optional)

3. Load them