Why it matters
Raw CSV and JSON logs are difficult to interpret quickly, particularly when imperfect rows, failed logins and suspicious traffic need context rather than opaque scores.
Defensive Security // case study
LogWächter Lite
An explainable defensive-security dashboard that turns uploaded application logs into reviewable alerts.
High risk alerts3Explainable rule matches
What I built
LogWächter validates rows independently, normalizes valid events, applies transparent detection rules and lets an analyst trace each alert back to its supporting events.
03 / ProductCore
Core
capabilities
- 01
Independent CSV and JSON row validation
- 02
Reviewable alerts with severity and risk score
- 03
Dashboard summaries and source-IP context
- 04
Open, reviewed and dismissed alert states
Clear boundaries.
Useful outcomes.
- Explainable threshold rules rather than black-box detection
- Argon2 passwords and user-scoped database queries
- Synthetic examples using reserved documentation IPs
- Backend, frontend and container checks in CI
StackReact · TypeScript · FastAPI · PostgreSQL · Docker
Security tooling is more useful when it explains why a signal exists. Transparent thresholds, partial-import handling and honest false-positive guidance make results easier to trust.
Rate limiting, secure cookie sessions, import deduplication, background processing and analyst notes are useful next steps; live scanning and offensive automation stay outside the scope.
Source code, setup instructions and the complete technical documentation are available in the repository.
Open repository ↗