Step 101
Scope the incident
Collect services, time window, timezone and recent changes.
Deliverable
Time scope
Operational playbookIT & analysis
From noise to sequence
Log analysis and IT troubleshooting
Group error signatures, compare time windows and prepare investigation hypotheses while keeping technical logs in your environment.
ITOperations
Playbook map / analisi-log
IT & analysis
Input
Logs, timestamps, context
Box
Groups and compares
Result
Investigation timeline
Log parsingAnomaly groupingTime-based search
The problem
01Millions of lines and different formats make it difficult to separate the initiating event from errors that are merely consequences.
Expected outcome
02A timeline with patterns and evidence lines that guides investigation without presenting correlation as proven cause.
The playbook
A readable flow, from input to review.
Every phase produces a reviewable artifact before the next one begins.
Step 202
Normalize signals
Align timestamps, group signatures and separate recurring patterns from anomalies.
Deliverable
Event map
Step 303
Form and test hypotheses
Build hypotheses with supporting and contradicting evidence, then verify them in affected systems.
Deliverable
Annotated timeline
What goes in
- Log files and JSON
- Time window
- Known deploys and changes
What stays with the team
- Grouped signatures
- Event sequence
- Evidence-backed hypotheses
Starting point
Three requests to try on your archive.
Prompt 1
Compare the hour before and after deployment and flag new signatures.
Prompt 2
Reconstruct events between 03:35 and 03:50, aligning timestamps.
Prompt 3
For each hypothesis, list supporting lines, contradicting lines and next checks.
Control and perimeter
Automate without hiding responsibility.
These constraints are part of the workflow, not a footnote.
01
Mask secrets and tokens before indexing.
02
IPs, users and paths may be sensitive data; restrict access.
03
Correlation and sequence alone do not prove causation.
Capabilities involved
Log parsingAnomaly groupingTime-based search
Sources and connectors
.log and .txt filesExported JSONLocal technical folder
Continue the path
Related playbooks
The same archive can support multiple workflows while keeping purpose and permissions separate.
IntelligenceBox / workflow discovery
Bring this workflow to your data.
An operational session to map sources, access, output and approval steps before configuration.