v2.0.0 - SOC triage rewrite

A ground-up rewrite. v1 was one 3,682-line script with 572 shellcheck findings
and no tests. v2 is a modular tree that still ships as a single portable file.

Install

curl -LO https://github.com/ktalons/bashedlogs/releases/download/v2.0.0/bashedlogs && chmod +x bashedlogs

Needs bash 4.0+ and standard awk/grep/sort. Nothing else at runtime.

What's in it

Eight analyzers: SSH/auth, journald, syslog, web access, Wazuh alerts, DNS,
firewall, and an honest generic fallback.

• -o json / -o ndjson plus an exit-code contract (0 analyzed, 1 usage error,
  2 unreadable input, 3 findings at or above --fail-level) so it drops into
  cron and pipelines.
• Real time-windowed brute-force detection. v1 counted total keyword hits, so
  ten failures over a day looked the same as ten in a second.
• IOC extraction with --defang, and optional GeoIP/ASN enrichment. No network
  call is ever made unless you pass --enrich-online.

Verification

106 tests run in CI on Linux and macOS, plus a bash 4.0 + busybox floor check,
and the whole suite runs again against the built single-file artifact.
shellcheck is clean and enforced.

A cross-vendor audit before tagging found five real defects, each now fixed with
a regression test. The two worth calling out: on Debian and Ubuntu, sshd logs
two lines per failed attempt, and counting both doubled every figure and halved
the effective brute-force threshold; and IPv6 sources were invisible to every
per-source detector, so an IPv6 attack was counted in the totals but produced no
finding at all. Details in CHANGELOG.md.

Not included

The CTF-oriented v1 analyzers (payments, IoT telemetry, Android logcat, SQLite,
Squid, VSFTPD) were dropped to keep this a SOC triage tool. They remain at tag
v1.0.0.

Verify the download: shasum -a 256 -c SHA256SUMS