jpcertcc/logontracer ? reverse-engineered prompt

Build me a web app for investigating suspicious Windows logons from event logs. I want to upload EVTX or XML files, or pull from Elasticsearch, and then see the accounts, hosts, and logon activity as an interactive graph with a timeline view. It should help me spot compromised accounts, unusual hosts, failed logons, group changes, and other important security events, and it should rank the most suspicious accounts or machines so the risky stuff stands out quickly.

Please also add an option to run Sigma rule checks during import and show the matches in a separate results page. If possible, include an AI analysis feature that can look at the imported data, summarize likely threats in plain language, and generate Sigma rules from what it finds. Make it feel like a simple security investigation dashboard, with login, search and filters, dark mode, and support for keeping separate investigation cases.