GravityLog — Understanding logs and their cybersecurity importance

The Weight Of Your Logs

GravityLog turns Windows and Linux audit data into sourced, actionable guidance — mapped to NIST 800-53, CIS Controls, PCI DSS, HIPAA, DISA STIG, SOC 2, and NIST CSF 2.0, cross-referenced to MITRE ATT&CK, with live tools to test your actual config and real detection logic to close what's missing.

How It Works

From standards to closed gaps

1
Standards & Requirements
Seven frameworks as the starting reference — NIST 800-53, CIS Controls, PCI DSS, HIPAA, DISA STIG, SOC 2, and NIST CSF 2.0.
2
Config Review
Gravity Scanner reads your actual auditpol export, Sysmon config, PowerShell logging settings, GPO report, or Linux audit rules — parsed in your browser, never uploaded anywhere.
3
Telemetry Mapping
Every control is tied to the specific Windows or Linux events that genuinely evidence it, not a generic best-practices checklist.
4
Detection Mapping
The Detection Catalog links that telemetry to real, criteria-level detection logic — the actual conditions to build, not just "turn on logging."
5
Gap Analysis
What's missing gets named honestly — in the Evidence Report, the ATT&CK Gap Analyzer, and every framework's own Coverage Gap section.
Key Features

What GravityLog does

✓
99 Windows events, sourced
Security, Sysmon, System, Application, and PowerShell — every event with a monitoring call and why.
✓
19 Linux audit events Beta
auditd, PAM, and journald records — the same rigor as the Windows catalog, for hosts that don't run Windows.
✓
NIST 800-53 mapping
34 controls tied to exact event codes, plus an Evidence Builder for audit prep.
✓
MITRE ATT&CK coverage
30 techniques mapped, with gaps named honestly instead of glossed over.
✓
MITRE ATLAS coverage
The AI/ML threat framework — 6 techniques where Windows logging genuinely helps, honest about the rest.
✓
Cyber Kill Chain view
This catalog's ATT&CK techniques mapped onto the 7-stage model — a stakeholder-friendly lens grounded in a published academic crosswalk, not invented here.
✓
D3FEND coverage
Every technique linked to the defensive-technique vocabulary that names what kind of analysis its evidence actually performs.
✓
CIS Controls coverage
Controls 5 & 8 mapped to real event evidence — only 6 of 18 safeguards are actually log-provable, named honestly.
✓
PCI DSS Requirement 10 coverage
All 7 event-logging sub-requirements of 10.2.1 mapped to real event evidence — the tightest hit rate of any framework on this site.
✓
DISA STIG coverage
Windows Server 2022 STIG V2R9 audit-policy rules mapped to event evidence, cross-referenced to NIST 800-53 through each rule's own CCI.
✓
HIPAA Security Rule coverage
Technical Safeguards mapped to real event evidence — the five genuinely log-evidenced provisions, named honestly against the rest.
✓
Detection Catalog Beta
41 standards-first detections — what NIST, CIS, PCI, HIPAA, STIG, SOC 2, and NIST CSF 2.0 actually ask you to monitor, and the specific event that gives you the evidence to build it, across every standard that detection potentially supports.
✓
Live policy scanner
Upload real audit policy, Sysmon, PowerShell, and Linux auditctl configs — see what's actually covered.
✓
Gap analyzer with one-click fixes
Pick a technique, see exactly what's missing, fix it instantly.
✓
Dependency graph
Policy → event → framework coverage, visualized as one connected map.
✓
SIEM cost optimizer
Keep / Filter / Sample / Drop guidance, tuned to Splunk, Sentinel, and others.
✓
Runs entirely in your browser
Nothing uploaded, no server. Dark or light mode.
Under-logging

Blind spots you don't find until an incident needs them.

Over-logging

Noise that drowns signal and burns budget.

Explore

Modules

Windows Event Logging Live
A sourced reference across all five core Windows event log sources, with monitoring guidance for every event.
99 events 5 log sources 13 overlap pairs
→
NIST SP 800-53 Mapping Live
Which controls your Windows events actually give an auditor evidence for, control by control.
34 controls 8 families 55 event codes
→
MITRE ATT&CK Coverage Map Live
Which ATT&CK techniques your logs can detect, and an honest list of what they can't.
30 techniques 8 of 15 tactics 47 event codes
→
MITRE ATLAS Coverage Live
The AI/ML threat framework — where Windows logging can help attacks on AI systems, and where it honestly can't.
6 techniques 7 of 16 tactics 12 event codes
→
CIS Controls Coverage Live
CIS Critical Security Controls v8.1 — Audit Log Management and Account Management, mapped to real event evidence.
6 safeguards 2 control families 11 event codes
→
PCI DSS Requirement 10 Live
Log and monitor all access — all 7 event-logging sub-requirements of 10.2.1 mapped to real event evidence.
7 sub-requirements 1 control family 9 event codes
→
DISA STIG Coverage Live
Windows Server 2022 STIG V2R9 — audit-policy requirements mapped to real event evidence, cross-referenced to NIST 800-53 via CCI.
4 rules mapped 1 rule family 5 event codes
→
HIPAA Security Rule Live
Technical Safeguards under 45 CFR §164.312 — audit controls, unique user ID, emergency access, and more mapped to real event evidence.
→
SOC 2 Common Criteria Live
Trust Services Criteria CC1–CC9 — logical access, system operations, and change management mapped to real event evidence, with governance criteria named honestly as gaps.
→
NIST CSF 2.0 Live
Detect and Protect function subcategories — continuous monitoring, event analysis, and identity management mapped to real event evidence, with Govern and Respond/Recover named honestly as gaps.
→
Detection Catalog Beta
Standards-first: what NIST, CIS, PCI, HIPAA, STIG, SOC 2, and CSF actually require you to monitor, the specific Windows event that gives you that ability, and every standard one detection satisfies at once.
41 detections 7 standards
→
Cyber Kill Chain Live
This catalog's ATT&CK techniques mapped onto the 7-stage Lockheed Martin model — a familiar lens for stakeholder reporting, grounded in a published academic crosswalk.
→
D3FEND Coverage Live
Every ATT&CK technique on this site, grouped by the D3FEND defensive-technique vocabulary that names what kind of analysis its event evidence actually performs.
→
Linux Audit Events Beta
auditd and PAM records — the same rigor as the Windows catalog, for hosts that don't run Windows. Early and intentionally growing.
19 events documented 2 log sources 13 required
→
Gravity Scanner Live
Eighteen live views sharing one config: policy scanner, gap analyzer, dependency graph, cost optimizer, and more.
62 policy toggles 99 events 18 connected views
→
Baseline Generator Live
The inverse of Gravity Scanner — pick a role, get a real auditpol script, Sysmon config, PowerShell logging .reg, or Linux auditd rules file back. Nothing to upload.
4 Windows roles 2 Linux modes 4 file types generated
→
Cloud Logging Mapper New
What cloud security logs exist, why each one matters, whether it's on by default, and how long it's kept before it's gone — plus a manual assessment tracker to mark your own progress. Azure and AWS so far; more providers and sources are being added incrementally.
19 sources, 2 providers 3 frameworks referenced
→