cscli explain --file /var/log/nginx/access.log --type nginx

Replays the log through your local parsers and scenarios, showing which ones match each line and why, without waiting for real attacks. The --type nginx tells it the log format, and --log tests a single line instead of a file. Great for testing new scenarios before deployment.