WatchLog: Efficient and Interpretable Event Reasoning for Endpoint Detection and Response Logs with Multimodal LLMs

Endpoint Detection and Response (EDR) systems are crucial for identifying malicious activities on endpoint devices, yet existing methods struggle to efficiently model ultra-long log sequences and to provide interpretable reasoning for security analysts. We propose WatchLog, a novel framework that represents raw logs as video-structured data, enabling scalable and expressive video-language modeling of endpoint behaviors. Each event is encoded as a key–value-guided image, and the resulting images are temporally organized into a video sequence. To capture long-range dependencies, WatchLog employs a temporal cross-attention adapter that enables pixel-wise interaction across time. The adapter acts as an auxiliary temporal reasoning pathway, aligning spatial representations with relevant temporal contexts while preserving the original behavioral semantics. We adopt a two-stage pre-training strategy followed by supervised fine-tuning to generate behavior explanations grounded in event-level semantics and detection outcomes. Experiments on our newly constructed EDR8M-20R dataset and a public benchmark demonstrate that WatchLog consistently outperforms state-of-the-art methods in detection accuracy and recall, while offering more interpretable reasoning traces and significantly improved inference efficiency. Extensive ablation studies further support the robustness and interpretability of the proposed method.

Cybersecurity systems rely on large volumes of computer activity records to detect attacks on endpoint devices. However, these records can become extremely long and complex, making them difficult to analyze efficiently. Existing approaches often struggle to capture long-term patterns and usually provide limited explanations for their decisions, making it harder for security analysts to understand and trust the results. We present WatchLog, a new method that converts computer activity records into a visual timeline similar to a video. By organizing events as sequences of images, WatchLog can better recognize how activities evolve over time and identify suspicious behavior more effectively. The system is also designed to provide clearer explanations by linking its decisions to specific events and behavioral patterns. Experiments on large-scale datasets show that WatchLog improves attack detection accuracy and recall while also generating more interpretable reasoning and faster analysis. This work offers a practical step toward cybersecurity systems that are both more effective and easier for humans to understand and trust.