Security-Log-Parser

An automated log analysis and correlation engine designed in Python. This security utility processes unstructured web server transaction logs, leverages pattern matching logic to identify brute-force credential attacks, and evaluates malicious artifacts against an integrated Threat Intelligence indicator feed.

This tool models the primary ingestion and analytical workflows executed by tier-1 SOC (Security Operations Center) analysts and SIEM correlation rules.

Key Features

• Regex Ingestion Pipeline: Implements highly structured Regular Expressions (re) to extract IP addresses, HTTP request methodologies, URI pages, and server response codes from messy text logs.
• Statistical Threshold Rules: Evaluates connection frequency metrics using Python's collections.Counter to expose multi-fault brute-force parameters.
• Threat Intelligence Cross-Referencing: Cross-references parsed indicators of compromise (IoCs) against a simulated blocklist database to assess risk levels.
• State Categorization: Automatically distinguishes between low-risk single authentication failures and critical multi-attempt compromises.

Core Cybersecurity Concepts Demonstrated

• Security Analytics & SIEM: Simulates internal logic patterns utilized by SIEM platforms (like Splunk or Elastic) to flag malicious behavior.
• Threat Intelligence Operations: Practical application of searching and mapping logs against operational threat intel feeds to determine threat actor presence.
• Pattern Matching & Parsing: Mastering regex data processing to transform plain text server data into structural, actionable metrics.

Installation & Usage

1. Clone the repository:

git clone https://github.com
cd Security-Log-Parser

2. Run the script:

python log_analyzer.py

Disclaimer

This project is built strictly for educational purposes and analytical research workflows.