38 lines
3.1 KiB
Markdown
38 lines
3.1 KiB
Markdown
# Privacy model
|
|
|
|
Windows Event Logs frequently contain usernames, hostnames, IP addresses, e-mail addresses, executable paths and application-specific fields.
|
|
|
|
## In-memory workflow
|
|
|
|
1. The browser sends the selected `.evtx` to the self-hosted API.
|
|
2. A receive-level request gate rejects oversized body streams before multipart parsing; the API then reads bounded chunks, parses bytes off the event loop and returns normalized JSON.
|
|
3. EventLens does not create an application-level upload file or database record.
|
|
4. The multipart parser may transiently spool request data as part of the web framework; the upload handle is closed after every request and the app does not retain that path.
|
|
5. The browser keeps the normalized analysis in component memory for the current session; switching workspaces does not create another copy or upload it elsewhere.
|
|
6. Only display preferences (timestamp mode, defaults, density and preferred workspace) may be stored in the single `eventlens.preferences.v1` localStorage record; event text, EVTX-derived values and analysis results are never stored there. The Settings workspace labels this boundary directly, exposes its technical key only on request and can reset the record to defaults.
|
|
7. Export is generated locally in the browser.
|
|
8. The favicon, touch icons and web manifest are static files bundled with EventLens. They make no third-party request, do not enable a service worker and do not persist investigation data.
|
|
|
|
## Redaction before export
|
|
|
|
Redaction is enabled by default and operates on a cloned analysis object. It masks or replaces:
|
|
|
|
- computer/host values;
|
|
- username/account/e-mail identity fields, including domain-qualified accounts, SIDs and machine accounts;
|
|
- e-mail addresses in free text;
|
|
- IPv4 and IPv6 addresses in free text or IP-address fields;
|
|
- Windows and UNC paths (including spaces/parentheses) and path-like fields;
|
|
- source-name fields and source values propagated into free-form text;
|
|
- known structured identities propagated into summaries, incident titles and reasons;
|
|
- the source filename in the exported report.
|
|
|
|
The UI previews replacement counts by type before export. The original in-memory analysis is never modified by the redaction function. The source name is replaced with `[REDACTED_SOURCE].evtx` when redaction is enabled. JSON and Markdown carry the same redacted normalized analysis and parse-completeness metadata.
|
|
|
|
Redaction can be disabled when a raw forensic export is explicitly required, but that is an explicit user choice and the warning remains visible.
|
|
|
|
## Limits
|
|
|
|
The API enforces a 50 MiB file limit, a bounded request body independent of `Content-Length`, parser event/time budgets, bounded normalized strings/fields/output and bounded parse concurrency. These controls reduce accidental resource exhaustion; they are not a guarantee against every parser implementation vulnerability.
|
|
|
|
Redaction is a best-effort privacy layer, not a formal DLP engine. Application-specific free-form values may contain sensitive data that cannot be inferred safely. Review exports before sharing them outside the intended context.
|