AI log analysis means using a language model such as Claude to read exported security logs and audit findings, explain what the events mean, build timelines and draft the queries an analyst then runs against the real data. Done well, it shortens the hours between "something looks wrong" and a documented conclusion. Done carelessly, it pastes credentials and customer data into a tool nobody vetted and produces confident explanations nobody checked. The method below is the one NetSys uses in defensive assessments: scope the evidence, minimize it, pick the Claude product and data path deliberately, corroborate everything against the raw log, and have an engineer sign the conclusion.
This is a method for reviewing logs you are authorized to review, inside an assessment or an investigation. It is not a description of autonomous monitoring; if you need someone watching alerts around the clock, that is managed detection and response, and the difference between the tools is explained in SIEM vs EDR vs MDR.
What can Claude actually do with security logs?
Four things reliably:
- Explain events. Given an audit record or an alert, Claude can say what the operation is, what normally generates it and what would make it suspicious, which saves an engineer a trip to the documentation for every unfamiliar operation name.
- Build timelines. Given sign-in and audit events for one account over a few days, it can order them, group them by session and point out the sequence that does not fit: a sign-in from a new country, then a new inbox rule, then a mass download.
- Draft queries. It can turn a question ("which accounts signed in with legacy protocols last month?") into a query or a PowerShell filter for the engineer to run and check.
- Interpret tool findings. Given the output of Maester or CISA ScubaGear, it can group hundreds of results by control, separate the failures that matter from the accepted exceptions and draft remediation text. Our Maester vs ScubaGear guide shows what those reports contain.
What it cannot do is see your tenant. It only knows what is in the export you gave it, it has no way to tell a stale export from a current one, and it will fill gaps with plausible text unless you tell it not to. Every one of its outputs is a hypothesis for a person to test.
What should you feed it?
Small, scoped, minimized exports, one question at a time:
- Sign-in log entries for one account or one day, with the columns the question needs: time, application, client app, location, result, Conditional Access outcome. Microsoft's Entra retention reference says these are kept 30 days on Entra ID P1 and P2 and seven days on Free, so export first and analyze second.
- Unified audit log results filtered to an operation or a user, exported to CSV from the Purview portal, trimmed to the period in question.
- Maester or ScubaGear results in their JSON or CSV form, which contain settings and test outcomes rather than personal data.
- Defender alert details with the entities that matter and nothing else.
- Configuration exports (Conditional Access policies, mail flow rules, app consents) with names, not every identifier the portal emits.
Minimizing is not only a privacy step. A model reasons better over 200 relevant rows than 20,000 mixed ones, and the engineer reviewing its answer can actually check 200 rows.
What should never be pasted into Claude?
- Passwords, API keys, tokens, connection strings, private keys and certificate files, including anything that looks like one inside a log line. Rotate any secret that slips through.
- Full mailbox content, attachments or document bodies. The audit log says a file was downloaded; the file itself is not evidence the model needs.
- Protected health information, card numbers, Social Security numbers and other regulated identifiers beyond what the question requires. If a BAA or contract governs the data, the product you use must be covered by it; Anthropic's BAA article lists which Claude services its agreement covers, and the personal plans are not among them.
- Whole-tenant exports "just in case." Export what the question needs.
- Anything from a system you are not authorized to review. Authorization is the first line of the scope, not an afterthought.
A practical rule: before pasting, read the block once as if you were an attacker who later obtains the chat history. If there is anything in it you would not want them to have, cut it.
Which Claude product and data path should you use?
The product decides who can see the chat, how long Anthropic keeps it and whether the company can audit it. As of October 2026, Anthropic's own pages give these terms:
| Route | Who it suits | Training use | Retention | Company oversight |
|---|---|---|---|---|
| Claude Free, Pro or Max (personal plans) | Not suitable for client or company logs | Chats can be used for training when the person allows model improvement; with that setting on, chats may be kept de-identified for up to five years | Deleted chats leave back-end storage within 30 days | None; the account belongs to the person |
| Claude Team | A small firm reviewing its own logs | Not used for training by default | Deleted content removed from back-end storage within 30 days; custom retention controls are not listed for Team | SSO and admin controls; no audit logs or Compliance API |
| Claude Enterprise | Assessments and investigations | Not used for training by default | Custom data retention controls | Audit logs, a Compliance API that exposes chat histories and file content, SCIM and role-based access |
| Claude API, including Claude Mythos under the Cyber Verification Program | Tooling an assessor builds | Not used for training by default | API inputs and outputs deleted within 30 days unless a feature stores them; Mythos requires a 30-day retention policy and is not available under zero data retention | Whatever the assessor builds, plus Anthropic's safety monitoring |
Sources: Anthropic's commercial retention article, its training policy, the Enterprise plan article and the Mythos page. Whichever route is used, write down the product, the data path, the retention terms and who reviews the output, and give the client that paragraph. Do not promise that all data stays local or that a route has zero retention unless the agreement in front of you says so; even under zero-retention and HIPAA arrangements, Anthropic says content flagged for safety may be kept for up to two years.
How do you corroborate what Claude tells you?
- Ask for the evidence line. Every claim in the answer must cite the row, timestamp and operation it came from. Claims without a row are discarded.
- Re-run the query yourself. If Claude drafted a filter, run it against the live log and compare counts. A model that read a truncated export will undercount.
- Check a second source. A suspicious sign-in in Entra should have a matching trace somewhere else: a Defender alert, a mailbox audit record, a Conditional Access outcome. One source is a lead, two are a finding.
- Check the dates. Models confuse export time with event time and mix time zones. Convert everything to one zone before you ask, and spot-check the timeline against the raw rows.
- Challenge the conclusion. Ask for the most likely benign explanation of the same sequence. If the benign story is credible, the finding is not ready.
How should the conclusion be documented?
The written finding carries the question asked, the evidence files by name, the events that support the conclusion, the benign explanations considered and rejected, the recommended action and the name of the engineer who signed it. The Claude conversation is working material, not evidence: keep it under the same access control as the exports, delete it when the engagement closes unless the client's retention policy says otherwise, and on Enterprise expect it to be visible to the organization through the audit log and Compliance API. If the finding becomes an incident, the chain of custody for the exports matters more than any summary a model wrote.
How does NetSys use Claude in log review?
Log review is one part of a NetSys defensive assessment, alongside configuration audits, hardening and interpretation of Maester and ScubaGear output; the full picture is in what a Claude-assisted defensive assessment includes. NetSys participates in Anthropic's Cyber Verification Program with Defense Access. In practice, engineers with electrical and computer engineering degrees export and minimize the evidence under a written scope, use Claude to explain, order and query it, corroborate every lead against the raw logs and sign the findings themselves. Each report states the product used, the data path, the retention terms and the reviewer. Ongoing monitoring, if you need it, is a separate service with its own tooling, and our security assessments page explains how an assessment is scoped and what the report contains.
Frequently asked questions
Is AI log analysis the same as a SIEM or managed detection and response?
No. A SIEM collects and correlates logs continuously, and managed detection and response adds people who act on alerts around the clock. AI log analysis as described here is a review method inside an assessment or investigation: a person asks questions of exported evidence and verifies the answers. It complements monitoring; it does not replace it.
Can Claude read our Microsoft 365 logs directly?
Not in this method, and not through the standard integration. Claude's Microsoft 365 connector reads mail, files, calendars and Teams content within the signed-in user's access; it does not read the tenant's sign-in or audit logs. Giving a model standing access to a tenant is a connector decision with its own review, covered in Claude Microsoft 365 connectors: permissions before rollout. We work from exports.
Which Claude plan is safe for client logs?
A company-owned Team or Enterprise organization, or the API under a written agreement. Never a personal Free, Pro or Max account, because the company cannot see, retain or delete what is in it. Enterprise adds the audit logs and Compliance API that let the company prove later what was pasted and by whom.
Does Anthropic train on the logs we paste?
On commercial products (Team, Enterprise, API) Anthropic's policy is that inputs and outputs are not used for training by default; training use is opt-in through feedback or explicit permission. On the personal plans, chats can be used when the person allows model improvement. That difference alone rules out personal accounts for security work.
How long does Anthropic keep what we paste?
As of October 2026: deleted content leaves back-end storage within 30 days on commercial products; Mythos requires a 30-day retention policy by default; feedback submitted with thumbs up or down can be kept up to five years, de-linked from the user; and content flagged for safety may be kept up to two years. Enterprise organizations can set custom retention controls.
Do we need Claude Mythos for this?
No. Anthropic's announcement of the expanded Cyber Verification Program says its generally available models remain usable for triaging security alerts, code review and finding vulnerabilities in owned source code. What makes log review safe and useful is the method and the human review, not which model is behind the chat.
NetSys, founded in 1998, now uses Claude in log review under a written scope and an engineer's signature. Scope a defensive assessment with a NetSys engineer.
Discuss security assessments for your business.
Tell us about your current systems, the result you need and your timeline. We will discuss the work, responsibilities and pricing before you decide on an engagement.