How nandikasharma11/project-logs works
This is a Windows EVTX forensic-analysis application: investigators convert event logs, inspect evidence, and ask cited natural-language questions over the resulting records. The documented preparation path normalizes logs, clusters repeated events while retaining record mappings, and builds template and entity-correlation indexes. Querying combines parsed filters, vector search, SQL filtering and correlated evidence before the retrieval layer assembles context and generates an answer; Streamlit presents the workflow and event details. The README documents the layer order; sampled excerpts do not establish every runtime call, so uncertain wiring is omitted.
Main entry points: retrieval_pipeline.py Retrieval Orchestrator · app.py Streamlit Dashboard · fileconversion.py EVTX Converter · log_templater.py Template Clustering
Components 17
Investigation UI
- Streamlit Dashboard
app.py
Ingestion
- EVTX Converter
fileconversion.py - Canonical Logs
Evidence Preparation
- Contextual Chunking
log_transformer.py - Template Clustering
log_templater.py - Template Records
log_templater.py - Template Vector Indexer
stage3_vectorizing.py - Entity Correlation Indexer
correlation_indexer.py - Correlation Index
correlation_indexer.py
Retrieval and Reasoning
- Retrieval Orchestrator
retrieval_pipeline.py - Query Parser
query_parser.py - Hybrid Query Executor
query_executor.py - Cited Findings
retrieval_pipeline.py
Other components
- Investigator
- EVTX Files
- Qdrant Index
- LLM Backend
Connections 21
- Investigator → Streamlit Dashboard: uses
- EVTX Files → EVTX Converter: converts
- Streamlit Dashboard → EVTX Converter: invokes
- EVTX Converter → Canonical Logs: writes records
- Streamlit Dashboard → Retrieval Orchestrator: submits query
- Canonical Logs → Contextual Chunking: reads records
- Canonical Logs → Template Clustering: reads records
- Template Clustering → Template Records: writes mappings
- Template Records → Template Vector Indexer: supplies templates
- Template Vector Indexer → Qdrant Index: indexes vectors
- Canonical Logs → Entity Correlation Indexer: reads records
- Entity Correlation Indexer → Correlation Index: writes links
- Retrieval Orchestrator → Query Parser: parses query
- Retrieval Orchestrator → Hybrid Query Executor: executes filters
- Retrieval Orchestrator → Qdrant Index: searches templates
- Retrieval Orchestrator → Correlation Index: reads links
- Retrieval Orchestrator → Canonical Logs: loads evidence
- Retrieval Orchestrator → LLM Backend: generates reasoning
- LLM Backend → Retrieval Orchestrator: returns answer
- Retrieval Orchestrator → Cited Findings: assembles citations
- Retrieval Orchestrator → Streamlit Dashboard: returns findings