SOC Log Analyzer

A Python-based Security Operations Center (SOC) tool that analyzes Linux SSH authentication logs to detect suspicious activity and generate alerts.

Built as a portfolio/resume project demonstrating detection engineering, log analysis, and Python scripting skills.

---

What it detects

Rule	Severity	Description
BRUTE_FORCE	HIGH	Repeated failed logins from same IP within a time window
BRUTE_FORCE_SUCCESS	CRITICAL	Many failures followed by a successful login (likely break-in)
SUSPICIOUS_LOGIN_TIME	MEDIUM	Successful login during off-hours (default: 11 PM – 5 AM)
USER_ENUMERATION	MEDIUM	One IP trying many different invalid usernames
HIGH_ACTIVITY_IP	LOW	Single IP generating abnormally high event volume

---

Project structure

soc-log-analyzer/
├── data/
│   └── sample_auth.log       # Sample log for testing
├── detections/
│   ├── brute_force.py        # Rules A & B: brute force detection
│   ├── suspicious_time.py    # Rule C: off-hours login detection
│   └── ip_activity.py        # Rules D & E: enumeration & high activity
├── parsers/
│   └── auth_parser.py        # Regex-based auth.log parser
├── reports/
│   └── report_generator.py   # Terminal output & file export
├── tests/
│   ├── test_parser.py        # Unit tests for parser
│   └── test_detections.py    # Unit tests for detection rules
├── output/                   # Generated reports saved here
├── main.py                   # Entry point
├── config.json               # Tunable detection thresholds
├── requirements.txt
└── README.md

---

Quick start

# 1. Clone or download the project
cd soc-log-analyzer

# 2. Install dependencies (only pytest is required)
pip install -r requirements.txt

# 3. Run analysis on the sample log
python main.py --file data/sample_auth.log

# 4. Run with custom output directory
python main.py --file data/sample_auth.log --output-dir my_reports

# 5. Run without saving files
python main.py --file data/sample_auth.log --no-json --no-txt

# 6. Run unit tests
pytest tests/ -v

---

Configuration

Edit config.json to tune detection sensitivity for your environment:

{
  "brute_force": {
    "failed_login_threshold": 5,
    "time_window_minutes": 10
  },
  "suspicious_time": {
    "suspicious_start_hour": 23,
    "suspicious_end_hour": 5
  }
}

---

Sample output

[CRITICAL] [!!!] BRUTE_FORCE_SUCCESS
  Source IP  : 192.168.1.12
  Possible break-in: 6 failed logins followed by successful login for user 'abilan'
  -> Username: abilan
  -> Failed Count: 6

[HIGH] [!!]  BRUTE_FORCE
  Source IP  : 198.51.100.7
  Brute force detected: 10 failed logins in 10 minutes

[MEDIUM] [!]   SUSPICIOUS_LOGIN_TIME
  Source IP  : 10.0.0.5
  Successful login outside normal hours for user 'jsmith' at 03:14 AM

---

Resume bullet point

Built a Python-based SOC log analyzer that parsed SSH authentication logs and detected brute-force attacks, credential stuffing, user enumeration, and off-hours logins using modular rule-based detections, CLI argument handling, configurable thresholds, and JSON/text report export.

---

Possible extensions

• Web server access log support (Apache/Nginx)
• IP geolocation enrichment
• MITRE ATT&CK technique tagging (T1110 for brute force, T1589 for enumeration)
• Flask/Streamlit dashboard
• Threat intelligence IP list matching
• Detection confidence scoring