Normalize and correlate security logs into an evidence-backed timeline while preserving timestamps and parse errors. Use for log analysis, auth failures, event timelines, JSONL triage or suspicious application logs.
