No tool traces a security log event back to the exact config file:line that caused it. Building one. Roast my approach.

Problem I keep hitting during IR: log says traffic was allowed/blocked, but finding the responsible config rule across iptables + Suricata + proxy configs is manual grep hell. Building LogLens (Rust, open source) that: 1.Parses logs from iptables, Suricata, ModSecurity, nginx, e2guardian, EVTX 2.I