A command-line security tool that analyzes authentication logs and identifies potentially suspicious login activity. The application helps security administrators and system operators quickly review login events, detect possible brute-force attacks, and generate summary reports without manually inspecting large log files.
Security teams often deal with large volumes of authentication logs generated by applications and systems. Reviewing these logs manually can be time-consuming and may result in suspicious activities being overlooked.
This project provides a lightweight CLI solution that processes login records from a CSV file and highlights unusual patterns that may indicate unauthorized access attempts.
The system identifies accounts that exceed a configurable number of failed login attempts within a specified time window.
Example:
User: ali
Failed Attempts: 3
Time Window: 5 minutes
Risk Level: HIGH
Reason: Possible brute-force login attempt
The system generates a summary report containing:
- Total log events
- Successful logins
- Failed logins
- Logout events
- Admin logins
- Number of suspicious accounts
- Most active user
- Most active IP address
Example:
=== Security Summary Report ===
Total Events : 100
Successful Logins : 70
Failed Logins : 20
Logout Events : 8
Admin Logins : 2
Suspicious Accounts : 3
This application is intended for:
- System administrators
- Security analysts
- IT support personnel
- Students learning cybersecurity concepts
A command-line interface was chosen because the application focuses on processing log files rather than user interaction. Security tools are commonly executed from terminals, scripts, and automation pipelines, making a CLI a practical and efficient choice.
Benefits include:
- Lightweight and fast execution
- Easy integration with automation workflows
- No additional UI dependencies
- Suitable for large log file processing
- Python 3
- CSV File Processing
- argparse
- datetime
- collections
security-log-analyzer-cli/
│
├── security_log_analyzer.py
├── sample_logs.csv
└── README.md
The application expects a CSV file with the following structure:
timestamp,username,ip_address,event
2026-06-01 10:00:00,ali,192.168.1.10,LOGIN_FAILED
2026-06-01 10:01:00,ali,192.168.1.10,LOGIN_FAILED
2026-06-01 10:03:00,ali,192.168.1.10,LOGIN_FAILEDSupported event types:
- LOGIN_SUCCESS
- LOGIN_FAILED
- LOGOUT
- ADMIN_LOGIN
Clone the repository:
git clone https://github.com/your-username/security-log-analyzer-cli.gitNavigate into the project directory:
cd security-log-analyzer-cliNo additional packages are required.
Run with default settings:
python security_log_analyzer.py sample_logs.csvRun with custom detection rules:
python security_log_analyzer.py sample_logs.csv --threshold 5 --minutes 10Where:
- threshold = number of failed login attempts before triggering an alert
- minutes = detection time window
One of the main challenges was designing a simple detection mechanism that could identify suspicious login patterns while remaining lightweight and easy to understand. Another challenge was ensuring the solution remained flexible by allowing configurable thresholds and time windows instead of relying on hardcoded values.
Potential future enhancements include:
- Export reports to CSV or PDF
- Risk scoring system
- Geolocation-based login analysis
- Detection of unusual login times
- Interactive dashboard version
- Real-time log monitoring
Danish Haikal Bin Suhaimi
Developed as part of the Shortcut Asia Internship Challenge 2026.