The Problem

Windows Active Directory generates millions of logon events daily, and finding the one account or host that signals compromise is like searching for a needle in a haystack. Security analysts need to correlate event IDs like 4624 (successful logon) and 4625 (logon failure) across hosts and accounts to identify lateral movement or brute-force attacks, but raw event logs don't make those relationships visible.

What This Does

LogonTracer is a Python/Flask web application that ingests Windows event logs, parses logon-related events (4624, 4625, 4768, 4769, 4776, 4672), and stores the relationships between hosts and accounts in a Neo4j graph database. It then visualizes those relationships as an interactive graph using Cytoscape.js, letting analysts see which accounts logged into which hosts at a glance.

The tool adds analytical depth beyond simple visualization: it applies PageRank to rank suspicious hosts and accounts, uses a Hidden Markov model and ChangeFinder (see model/hmm.pkl) to detect anomalous logon patterns, and provides a chronological timeline view. The UI includes case management (templates/casemng.html), user management, and a dark mode toggle.

How It Is Wired

The single Python file logontracer.py (2,201 lines) is the entire backend. It serves the Flask routes that render templates from templates/ (login, case management, timeline, graph views) and handles the Neo4j database operations. The frontend logic lives in static/js/script.js, which talks to the Flask API and renders graphs via Cytoscape.

The repository ships with three Docker Compose configurations: docker-compose/ (minimal Neo4j + LogonTracer), docker-compose-with-elasticstack/ (adds Elasticsearch and Kibana for log ingestion), and docker-compose-with-nginx/ (adds an nginx reverse proxy with TLS). All three reference the same Dockerfile build context. The static analysis mapped 3 modules with zero import edges, meaning the codebase's internal coupling is minimal — logontracer.py is the sole hub everything routes through. There's no mapped call graph for how the Flask routes invoke Neo4j operations, so the internal wiring beyond file boundaries hasn't been traced.

How To Use It

Setup: Clone and run via Docker Compose:

git clone https://github.com/moses-y/LogonTracer
cd LogonTracer
docker-compose -f docker-compose/docker-compose.yml up

Configuration: Neo4j credentials and connection settings live in config/config.yml. Logging configuration is in config/logging.yml. The Docker Compose files set the Neo4j password via environment variables.

Running it: The container starts logontracer.py as the Flask entry point. Navigate to the web UI (default port varies by compose file), log in, upload a .evtx file, and the tool parses and visualizes it.

Real-World Use

A DFIR consultant responding to a suspected credential theft incident receives a domain controller's Security.evtx. They upload it to LogonTracer, and the graph immediately highlights a service account that authenticated to 15 hosts in 20 minutes — a pattern the PageRank scoring flags as anomalous. The analyst drills into the timeline view to pinpoint the exact sequence of logon attempts and identifies the initial compromise vector.

Code Health & Issues

Static analysis (not opinion) found 4 issues: 3 high, 1 medium.

  • High - Deep nesting: logontracer.py has max indentation depth of 11, making control flow hard to follow. Fix: early returns and extracting inner blocks.
  • High - Oversized files (x2): logontracer.py (2,201 lines) and static/js/script.js are too large to hold in one head. Fix: split by responsibility.
  • Medium - Broad exception handling: logontracer.py uses bare except clauses that swallow errors. Fix: catch specific exceptions and re-raise or log.

Additional SDLC observations from the file structure: CI is present (3 GitHub Actions workflows), but no dependency lockfile exists (requirements.txt only), the container base image python:3.12.0-slim is unpinned, the 30.1MB sample/Security.evtx bloats every clone, and no USER directive exists in the Dockerfiles so containers run as root.

The Bottom Line

LogonTracer is a legitimate, battle-tested DFIR tool (forked from JPCERTCC's 3,221-star project) that fills a real gap in logon analysis. The code is functional but monolithic and needs modernization — pin dependencies, split logontracer.py, and harden the Docker images. Use it if you need rapid graph-based logon analysis and can tolerate a codebase that requires careful handling.