Publish curated EventLens source from a0b1324c0f3e54c1e9a26058aa2785f9487519bf

PUBLIC_SOURCE_EXPORT.md

@@ -1,3 +1,3 @@
 # Public source export
 
-This source snapshot was generated from the private canonical repository at revision `08724b391a5cd3a2bb258f516809cb349a47e0ed`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
+This source snapshot was generated from the private canonical repository at revision `a0b1324c0f3e54c1e9a26058aa2785f9487519bf`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.

PUBLIC_SOURCE_MANIFEST.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sourceRevision": "08724b391a5cd3a2bb258f516809cb349a47e0ed",
+  "sourceRevision": "a0b1324c0f3e54c1e9a26058aa2785f9487519bf",
   "files": [
     {
       "path": ".dockerignore",
@@ -24,8 +24,8 @@
     },
     {
       "path": "README.md",
-      "sha256": "d4c150cc0c4b5b58552e3df34c31b4c4ec5ef63fa9ecac382b2e4b841016c7ee",
+      "sha256": "5e8961597355247bf20df8424f60a694d0b94c3281407f3b91d0b034c42c2731",
-      "bytes": 9460
+      "bytes": 10087
     },
     {
       "path": "SECURITY.md",

README.md

@@ -99,6 +99,12 @@ Open [http://localhost:1252](http://localhost:1252). The production image uses d
 
 For an Unraid DockerMan-managed Compose deployment, the compose metadata publishes the WebUI URL and serves the durable canonical icon locally at `/eventlens-icon-512.png` through `net.unraid.docker.webui` and `net.unraid.docker.icon`. A broker-managed deployment must preserve those service labels for DockerMan to import them; EventLens does not claim DockerMan lifecycle ownership.
 
+## Analyze your first event log
+
+Start with the deterministic demo to learn the timeline, filters and report controls without uploading incident data. For a real investigation, load an authorized EVTX file, inspect the parser's completion status, narrow the time window and review the original evidence behind a correlation before exporting a report.
+
+An empty filtered timeline does not establish that nothing happened. Check the selected interval, event filters and parse/truncation status. Review redacted exports before sharing them: best-effort redaction is not a guarantee that every identifying value has been removed.
+
 ## Validation
 
 The release gates are reproducible from a clean checkout: