Sources and log detail

Sources shows every sourcetype, sized by volume and coloured by health. Click one to open it.

Every sourcetype, sized by volume. Amber is degraded, red is silent.

Each log has its own page with tabs:

Overview	Availability, freshness, volume, completeness, parsing and normalisation scores, plus uptime and owner
Fields	Each field, its meaning, and how often it is present now and last week
Parsing	Recent events, coloured field by field, with format and warnings
Drift	Fields that changed since last week, often the first sign of a vendor update
Hosts	Hosts that reported last week but stopped
Dependencies	The use cases and attack techniques that read this log

A degraded Palo Alto log. A firmware update added columns to the format.

The Fields tab: src_user dropped from 96% to 0% this week.

The Hosts tab: 14 Linux hosts stopped reporting.

What if it stops shows which use cases and attack techniques you would lose if this log went silent. Check now looks for passwords, keys and card numbers in recent events and masks what it finds.