📁 Log Analyzer

Scope: This tool is retained as the log-analysis and detection stage used by IR-Chain. LogNorm supersedes it for log normalization, and SigmaForge supersedes it for detection-rule authoring — but neither LogNorm nor SigmaForge executes detections against an event stream, so this tool remains in active use for that stage.

• Log Parsing: Supports Windows Security Event Log CSV exports only. Linux auth.log parsing was never implemented — parse_linux_log() is a stub that returns an empty list (see Roadmap).
• Threat Detection: Identifies suspicious patterns including:
  • Failed login attempts (brute force detection)
  • Logins at unusual hours
  • Privilege escalation events
  • Account lockouts
• Reporting: Generates clean, readable reports with severity ratings

git clone https://github.com/Rootless-Ghost/Log-Analyzer.git
cd Log-Analyzer
pip install -r requirements.txt

Only --type windows is implemented — --type linux calls a stub (parse_linux_log()) that silently returns zero events.

# Analyze a Windows Security Event Log (CSV export)
python src/log_analyzer.py --input samples/security_log.csv --type windows

# Generate HTML report
python src/log_analyzer.py --input samples/security_log.csv --type windows --report html

log-analyzer/
├── src/
│   ├── log_analyzer.py      # Main script
│   ├── parsers/             # Log parsing modules
│   ├── detectors/           # Detection rule modules
│   └── reporters/           # Report generation
├── samples/                 # Sample log files for testing
├── output/                  # Generated reports
├── tests/                   # Unit tests
├── config.yaml              # Configuration file
├── requirements.txt
└── README.md

• Project setup
• Windows Event Log parser (CSV)
• Basic detection rules
• Terminal output
• HTML report generation
• Linux auth.log parser
• IP reputation lookup (VirusTotal/AbuseIPDB)
• Custom detection rules via config

This project is licensed under the MIT License — see the LICENSE file for details.