Logging & traceability compliance auditor — a read-only companion to netscan and webscan. Where those two look at the network and the web service, logscan audits what the machine remembers: what it records, for how long, who can alter it and whether anyone is watching. It scores the host 0–100, maps every finding to ENS (RD 311/2022, Anexo II) and ISO/IEC 27001:2022 Annex A / 27002:2022, and produces a self-contained bilingual (EN/ES) HTML report plus a Statement of Applicability workbook.
It performs no exploitation and no remediation: it reads configuration files and the output of standard query commands, and writes nothing to the audited system.
Auditor de cumplimiento de registro y trazabilidad, de solo lectura. Analiza que se registra, durante cuanto tiempo se conserva, quien puede alterarlo y si alguien lo vigila. Puntua el equipo de 0 a 100, mapea cada hallazgo al ENS (RD 311/2022, Anexo II) y a ISO/IEC 27001:2022 y genera un informe HTML autocontenido y bilingue junto con una declaracion de aplicabilidad en Excel.
The activity log is the control that fails quietly. A system can look perfectly hardened and still be unable to answer the only question that matters after an incident: who did what, when, and can we prove it? Logs that live for two weeks, are readable by any local user, never leave the host and are never read by anyone are the single most common non-conformity in ENS and ISO audits — and the cheapest one to fix once it is visible.
El registro de actividad es el control que suspende en silencio. Un sistema puede parecer perfectamente bastionado y aun asi ser incapaz de responder a lo unico que importa tras un incidente: quien hizo que, cuando, y como se demuestra.
docs/sample-report.html is a full report generated from docs/sample-posture.json, alongside the workbook it produces in docs/sample-soa.xlsx. Reproduce it with python -m logscan --from-posture docs/sample-posture.json -o report.html.
The HTML report is self-contained: a score gauge, a severity summary, a recommendation per finding with its ENS/ISO references, and a control status table ready to paste into the Statement of Applicability — with a one-click EN/ES toggle for the whole page.
El informe HTML es autocontenido: medidor de puntuacion, resumen por severidad, recomendacion por hallazgo con sus referencias ENS/ISO y una tabla de estado de controles lista para la declaracion de aplicabilidad, con toggle EN/ES para toda la pagina.
| ID | Severity | Check | ENS | ISO 27002 |
|---|---|---|---|---|
| TIM-01 | 🟠 HIGH | No time synchronisation service running | op.exp.8, mp.info.4 | 8.17 |
| TIM-02 | 🟡 MEDIUM | Time service present but clock unsynchronised | op.exp.8, mp.info.4 | 8.17 |
| TIM-03 | 🔵 LOW | Upstream time source not identifiable | mp.info.4 | 8.17 |
| LOG-01 | 🔴 CRITICAL | No system logging daemon active | op.exp.8 | 8.15, 5.28 |
| LOG-02 | 🟠 HIGH | Volatile journal — logs lost on reboot | op.exp.8 | 8.15, 5.33 |
| LOG-03 | 🟠 HIGH | Kernel audit subsystem not installed | op.exp.8, op.mon.1 | 8.15 |
| LOG-04 | 🟠 HIGH | auditd installed but stopped | op.exp.8 | 8.15 |
| LOG-05 | 🟡 MEDIUM | auditd running with an empty rule set | op.exp.8 | 8.15 |
| LOG-06 | 🟡 MEDIUM | Identity and privilege files not audited | op.exp.8, op.acc.1 | 8.15 |
| LOG-07 | 🟡 MEDIUM | SSH log level too low to record authentications | op.exp.8, op.acc.1 | 8.15 |
| LOG-08 | 🔵 LOW | Privileged command I/O not logged | op.exp.8 | 8.15 |
| WLG-01 | 🟠 HIGH | Windows audit subcategories not recording success | op.exp.8, op.acc.1 | 8.15 |
| WLG-02 | 🟡 MEDIUM | Security event log too small to survive a day | op.exp.8 | 8.15, 8.6 |
| WLG-03 | 🟡 MEDIUM | PowerShell script block logging disabled | op.exp.8, op.mon.1 | 8.15, 8.16 |
| WLG-04 | 🟡 MEDIUM | Process creation events without command line | op.exp.8 | 8.15 |
| WLG-05 | 🔵 LOW | No extended telemetry agent (Sysmon) | op.mon.1, op.mon.3 | 8.16 |
| RET-01 | 🟡 MEDIUM | Retention period not determinable | op.exp.8 | 8.15, 5.33 |
| RET-02 | 🟠/🟡 | Retention below the required threshold | op.exp.8 | 8.15, 5.33 |
| RET-03 | 🔵 LOW | No disk usage cap on the log store | op.exp.8 | 8.6 |
| PRO-01 | 🟠 HIGH | Logs never leave the audited host | op.exp.8, op.mon.3 | 5.33, 5.28 |
| PRO-02 | 🟡 MEDIUM | Log forwarding in clear text | op.exp.8 | 5.33, 8.15 |
| PRO-03 | 🟡 MEDIUM | Authentication/audit logs readable by any local user | op.exp.8 | 5.33, 8.15 |
| PRO-04 | 🔵 LOW | No cryptographic sealing of the local journal | op.exp.8 | 5.33 |
| PRO-05 | 🔵 LOW | No file integrity monitoring | op.mon.1 | 8.16 |
| MON-01 | 🟠 HIGH | No intrusion detection capability | op.mon.1 | 8.16 |
| MON-02 | 🟡 MEDIUM | No automatic response to authentication abuse | op.mon.1 | 8.16 |
| MON-03 | 🔵 LOW | No security metrics collection | op.mon.2 | 8.16 |
| MON-04 | ⚪ INFO | Incident register must be evidenced documentally | op.exp.9 | 5.24, 5.28 |
| MON-05 | 🔵 LOW | Log store not covered by backups | mp.info.6 | 5.33 |
Severity weights feed the score: CRITICAL −40, HIGH −20, MEDIUM −10, LOW −4, INFO 0. The total penalty is normalised against the worst possible outcome for the rules that apply to that platform, so a Windows result stays comparable with a Linux one and a handful of medium findings does not collapse the scale to zero.
Windows and Linux do not run the same rules: retention on Windows is expressed as a log size and an overwrite policy (covered by WLG-02), and file permissions, journal sealing, brute-force response, metrics and backups are not collected there. Those controls are reported as NOT ASSESSED on Windows rather than assumed compliant.
git clone https://github.com/mr7security/logscan.git
cd logscan
pip install -r requirements.txt # only needed for the Excel SoA
# optional, for the `logscan` command:
pip install -e .Requires Python 3.9+. The audit itself uses the standard library only; openpyxl is needed exclusively for --soa.
# Basic audit -> writes report.html
python -m logscan
# Console in English (the HTML report is always bilingual)
python -m logscan --lang en
# Full evidence package: report, JSON, Statement of Applicability, raw posture
python -m logscan -o informe.html --json resultados.json --soa declaracion.xlsx --posture evidencia.json
# Demand a stricter retention than the 90-day default
python -m logscan --retention-days 365
# Re-evaluate an archived posture without touching the machine again
python -m logscan --from-posture evidencia.json -o informe-revisado.html
# Installed as a command
logscan --soaRun it with administrative privileges where possible: without them, several configuration files are unreadable and the report says so explicitly rather than pretending the checks passed.
| Flag | Description |
|---|---|
-o, --output |
HTML report path (default report.html) |
--no-report |
Do not write the HTML report |
--json [PATH] |
Write JSON to PATH, or stdout if PATH is omitted |
--soa [PATH] |
Write the Statement of Applicability workbook (default soa.xlsx) |
--posture PATH |
Save the raw collected posture as evidence |
--from-posture PATH |
Re-evaluate a saved posture instead of scanning |
--retention-days N |
Minimum required retention in days (default 90) |
--lang {en,es} |
Console language (default es) |
--quiet |
Suppress the console report |
Exit codes: 0 clean or only low/medium findings, 2 at least one HIGH or CRITICAL finding, 1 execution error. Handy for CI gates and for scheduled compliance drift checks.
- A console summary: score, how many of the applicable checks could actually be evaluated, findings by severity and the status of every control in scope.
- A self-contained HTML report with a score gauge, per-finding recommendation, ENS/ISO references and an EN/ES toggle — no external assets, works offline, prints cleanly to PDF.
- An Excel Statement of Applicability: one row per control with status, justifying findings, evidence, and empty owner / target-date columns so it doubles as the remediation plan.
- Optional JSON for pipelines and SIEM ingestion, and a raw posture file for evidence archival.
logscan/
├── logscan/
│ ├── cli.py # argument parsing + orchestration
│ ├── collector.py # read-only posture collection (Linux + Windows)
│ ├── checks.py # all rules (pure, unit-tested)
│ ├── catalog.py # ENS / ISO control catalogue and cross-mapping
│ ├── models.py # Finding, Severity, Status, bilingual text helper
│ ├── scoring.py # 0-100 score and per-control status
│ ├── report_html.py # self-contained bilingual HTML report
│ ├── report_soa.py # Statement of Applicability workbook
│ └── report_console.py # plain-text console report
└── tests/ # offline tests for the rules, the parsers and the
# contract between collector and rules
python -m unittest discover -s testslogscan assesses the technical evidence a host can offer, and it is deliberately conservative about what it claims. A field that could not be read — because the tool is not running as root, because a command is missing, or because the output could not be parsed reliably — is treated as not determinable and never produces a finding; the controls it would have covered are reported as NOT ASSESSED instead of being quietly counted as a pass. An unjustified "compliant" in a Statement of Applicability is worse than a false positive. Every report states how many of the applicable checks were actually evaluated, so a high score obtained from very little evidence is visible rather than flattering. For the same reason, a run without administrative privileges never claims compliance for anything, and organisational controls such as the op.exp.9 incident register are flagged for documentary evidence rather than inferred from the machine. The ENS / ISO cross-mapping is orientative: it reflects the usual reading of both catalogues, but which controls apply to a given system, and with which reinforcement level, is decided by the organisation in its own Statement of Applicability. This tool supports an audit; it does not replace one.
Los controles de naturaleza organizativa se informan como NO EVALUADO en lugar de suponerse. El mapeo ENS / ISO es orientativo y no sustituye a la declaracion de aplicabilidad de la organizacion ni a una auditoria de certificacion.
This tool is for authorized security assessments only. Only audit systems you own or have explicit written permission to assess. You are solely responsible for how you use it.
Herramienta para auditorias de seguridad autorizadas unicamente. Audita solo sistemas propios o con permiso escrito explicito. Eres el unico responsable del uso que hagas de ella.
MIT — see LICENSE.