Standalone, fully local security-log triage tool. Import raw logs, normalise them into a searchable event store, run detection rules, and review alerts with their MITRE ATT&CK context — without sending evidence anywhere. The application is one process: a FastAPI backend that serves both the JSON API and the built single-page frontend. Data lives in a local SQLite database.