Skip to content

feat: add optional CSV export for findings and warnings #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
stacknil wants to merge 11 commits into from
Closed

feat: add optional CSV export for findings and warnings #24

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
e3063f3
feat: add optional CSV export for findings and warnings
stacknil Mar 24, 2026
1e1684c
feat: add optional CSV export for findings and warnings
stacknil Mar 24, 2026
1634434
feat: add optional CSV export for findings and warnings
stacknil Mar 24, 2026
c32a4ef
feat: add optional CSV export for findings and warnings
stacknil Mar 24, 2026
343af0f
feat: add optional CSV export for findings and warnings
stacknil Mar 24, 2026
ca69d70
feat: add optional CSV export for findings and warnings
stacknil Mar 24, 2026
65df847
feat: add optional CSV export for findings and warnings
stacknil Mar 24, 2026
0d66d44
feat: add optional CSV export for findings and warnings
stacknil Mar 24, 2026
f34c03a
feat: add optional CSV export for findings and warnings
stacknil Mar 24, 2026
0e71858
feat: add optional CSV export for findings and warnings
stacknil Mar 24, 2026
b1499c4
feat: add optional CSV export for findings and warnings
stacknil Mar 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
65 changes: 1 addition & 64 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,64 +1 @@
# Changelog

All notable user-visible changes should be recorded here.

## Unreleased

### Added

- Added sanitized golden `report.md` / `report.json` regression fixtures to lock report contracts.
- Expanded parser coverage for `Accepted publickey` and selected `pam_faillock` / `pam_sss` variants.
- Added compact host-level summaries for multi-host reports.

### Changed

- None yet.

### Fixed

- None yet.

### Docs

- None yet.

## v0.2.0

### Added

- Added dedicated sanitized parser fixture matrices for both `syslog_legacy` and `journalctl_short_full`, expanding `sshd` and `pam_unix` coverage.
- Added deterministic unknown-line telemetry coverage for unsupported parser inputs and unknown-pattern buckets.

### Changed

- Moved sudo handling onto the signal layer so detectors consume one unified normalized input model.
- Kept detector thresholds and the existing report schema stable while simplifying internal detector semantics.

### Fixed

- None.

### Docs

- Improved release-facing documentation in `README.md`, added `docs/release-process.md`, and formalized changelog discipline for future releases.

## v0.1.0

### Added

- Parser support for `syslog_legacy` and `journalctl_short_full` authentication log input.
- Rule-based detections for SSH brute force, multi-user probing, and sudo burst activity.
- Parser coverage telemetry including parsed/unparsed counts and unknown-pattern buckets.
- Repository automation and hardening with CI, CodeQL, pinned GitHub Actions, security policy, and Dependabot for workflow updates.

### Changed

- Established deterministic Markdown and JSON reporting for the MVP release.

### Fixed

- None.

### Docs

- Added CI, CodeQL, repository hardening guidance, and release-facing project documentation for the first public release.
# Changelog All notable user-visible changes should be recorded here. ## Unreleased ### Added - Added sanitized golden `report.md` / `report.json` regression fixtures to lock report contracts. - Expanded parser coverage for `Accepted publickey` and selected `pam_faillock` / `pam_sss` variants. - Added compact host-level summaries for multi-host reports. - Added optional CSV export for findings and warnings when explicitly requested. ### Changed - None yet. ### Fixed - None yet. ### Docs - None yet. ## v0.2.0 ### Added - Added dedicated sanitized parser fixture matrices for both `syslog_legacy` and `journalctl_short_full`, expanding `sshd` and `pam_unix` coverage. - Added deterministic unknown-line telemetry coverage for unsupported parser inputs and unknown-pattern buckets. ### Changed - Moved sudo handling onto the signal layer so detectors consume one unified normalized input model. - Kept detector thresholds and the existing report schema stable while simplifying internal detector semantics. ### Fixed - None. ### Docs - Improved release-facing documentation in `README.md`, added `docs/release-process.md`, and formalized changelog discipline for future releases. ## v0.1.0 ### Added - Parser support for `syslog_legacy` and `journalctl_short_full` authentication log input. - Rule-based detections for SSH brute force, multi-user probing, and sudo burst activity. - Parser coverage telemetry including parsed/unparsed counts and unknown-pattern buckets. - Repository automation and hardening with CI, CodeQL, pinned GitHub Actions, security policy, and Dependabot for workflow updates. ### Changed - Established deterministic Markdown and JSON reporting for the MVP release. ### Fixed - None. ### Docs - Added CI, CodeQL, repository hardening guidance, and release-facing project documentation for the first public release.
214 changes: 1 addition & 213 deletions README.md
View file
Open in desktop

Large diffs are not rendered by default.

173 changes: 1 addition & 172 deletions src/main.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,172 +1 @@
#include "config.hpp"
#include "detector.hpp"
#include "parser.hpp"
#include "report.hpp"

#include <charconv>
#include <filesystem>
#include <iostream>
#include <optional>
#include <stdexcept>
#include <string_view>

namespace {

struct CliOptions {
std::optional<std::filesystem::path> config_path;
std::optional<loglens::InputMode> input_mode;
std::optional<int> assumed_year;
std::filesystem::path input_path;
std::filesystem::path output_directory;
};

void print_usage() {
std::cerr << "Usage: loglens [--config <config.json>] [--mode <syslog|journalctl-short-full>] [--year <YYYY>] <input_log> [output_dir]\n";
}

int parse_year_argument(std::string_view value) {
int parsed_year = 0;
const auto* begin = value.data();
const auto* end = value.data() + value.size();
const auto result = std::from_chars(begin, end, parsed_year);
if (result.ec != std::errc{} || result.ptr != end || parsed_year <= 0) {
throw std::runtime_error("invalid year value: " + std::string(value));
}

return parsed_year;
}

CliOptions parse_cli_options(int argc, char* argv[]) {
if (argc < 2) {
throw std::runtime_error("missing required arguments");
}

int index = 1;
CliOptions options;

while (index < argc) {
const std::string_view argument = argv[index];
if (argument == "--config") {
if (index + 1 >= argc) {
throw std::runtime_error("missing path after --config");
}

options.config_path = std::filesystem::path{argv[index + 1]};
index += 2;
continue;
}

if (argument == "--mode") {
if (index + 1 >= argc) {
throw std::runtime_error("missing value after --mode");
}

const auto parsed_mode = loglens::parse_input_mode(argv[index + 1]);
if (!parsed_mode.has_value()) {
throw std::runtime_error("unsupported mode: " + std::string{argv[index + 1]});
}

options.input_mode = *parsed_mode;
index += 2;
continue;
}

if (argument == "--year") {
if (index + 1 >= argc) {
throw std::runtime_error("missing value after --year");
}

options.assumed_year = parse_year_argument(argv[index + 1]);
index += 2;
continue;
}

if (argument.starts_with('-')) {
throw std::runtime_error("unknown option: " + std::string{argv[index]});
}

break;
}

const int remaining = argc - index;
if (remaining < 1 || remaining > 2) {
throw std::runtime_error("invalid argument count");
}

options.input_path = std::filesystem::path{argv[index]};
options.output_directory = remaining == 2
? std::filesystem::path{argv[index + 1]}
: std::filesystem::current_path();
return options;
}

loglens::ParserConfig resolve_parser_config(const CliOptions& options, const loglens::AppConfig& config) {
const auto resolved_mode = options.input_mode.has_value()
? options.input_mode
: config.input_mode;
if (!resolved_mode.has_value()) {
throw std::runtime_error("input mode is required; use --mode or input_mode in config.json");
}

loglens::ParserConfig parser_config;
parser_config.input_mode = *resolved_mode;

if (parser_config.input_mode == loglens::InputMode::SyslogLegacy) {
parser_config.assumed_year = options.assumed_year.has_value()
? options.assumed_year
: config.timestamp.assume_year;
if (!parser_config.assumed_year.has_value()) {
throw std::runtime_error("syslog mode requires --year or timestamp.assume_year in config.json");
}
}

return parser_config;
}

} // namespace

int main(int argc, char* argv[]) {
CliOptions options;
try {
options = parse_cli_options(argc, argv);
} catch (const std::exception& error) {
print_usage();
std::cerr << "LogLens failed: " << error.what() << '\n';
return 1;
}

try {
const auto app_config = options.config_path.has_value()
? loglens::load_app_config(*options.config_path)
: loglens::AppConfig{};
const auto parser_config = resolve_parser_config(options, app_config);

const loglens::AuthLogParser parser(parser_config);
const auto parsed = parser.parse_file(options.input_path);

const loglens::Detector detector(app_config.detector);
const auto findings = detector.analyze(parsed.events);

const loglens::ReportData report_data{
options.input_path,
parsed.metadata,
parsed.quality,
parsed.events,
findings,
parsed.warnings,
app_config.detector.auth_signal_mappings};

loglens::write_reports(report_data, options.output_directory);

std::cout << "Parsed events: " << parsed.events.size() << '\n';
std::cout << "Findings: " << findings.size() << '\n';
std::cout << "Warnings: " << parsed.warnings.size() << '\n';
std::cout << "Markdown report: " << (options.output_directory / "report.md").string() << '\n';
std::cout << "JSON report: " << (options.output_directory / "report.json").string() << '\n';
} catch (const std::exception& error) {
std::cerr << "LogLens failed: " << error.what() << '\n';
return 1;
}

return 0;
}
#include "config.hpp" #include "detector.hpp" #include "parser.hpp" #include "report.hpp" #include <charconv> #include <filesystem> #include <iostream> #include <optional> #include <stdexcept> #include <string_view> namespace { struct CliOptions { std::optional<std::filesystem::path> config_path; std::optional<loglens::InputMode> input_mode; std::optional<int> assumed_year; bool emit_csv = false; std::filesystem::path input_path; std::filesystem::path output_directory; }; void print_usage() { std::cerr << "Usage: loglens [--config <config.json>] [--mode <syslog|journalctl-short-full>] [--year <YYYY>] [--csv] <input_log> [output_dir]\n"; } int parse_year_argument(std::string_view value) { int parsed_year = 0; const auto* begin = value.data(); const auto* end = value.data() + value.size(); const auto result = std::from_chars(begin, end, parsed_year); if (result.ec != std::errc{} || result.ptr != end || parsed_year <= 0) { throw std::runtime_error("invalid year value: " + std::string(value)); } return parsed_year; } CliOptions parse_cli_options(int argc, char* argv[]) { if (argc < 2) { throw std::runtime_error("missing required arguments"); } int index = 1; CliOptions options; while (index < argc) { const std::string_view argument = argv[index]; if (argument == "--config") { if (index + 1 >= argc) { throw std::runtime_error("missing path after --config"); } options.config_path = std::filesystem::path{argv[index + 1]}; index += 2; continue; } if (argument == "--mode") { if (index + 1 >= argc) { throw std::runtime_error("missing value after --mode"); } const auto parsed_mode = loglens::parse_input_mode(argv[index + 1]); if (!parsed_mode.has_value()) { throw std::runtime_error("unsupported mode: " + std::string{argv[index + 1]}); } options.input_mode = *parsed_mode; index += 2; continue; } if (argument == "--year") { if (index + 1 >= argc) { throw std::runtime_error("missing value after --year"); } options.assumed_year = parse_year_argument(argv[index + 1]); index += 2; continue; } if (argument == "--csv") { options.emit_csv = true; ++index; continue; } if (argument.starts_with('-')) { throw std::runtime_error("unknown option: " + std::string{argv[index]}); } break; } const int remaining = argc - index; if (remaining < 1 || remaining > 2) { throw std::runtime_error("invalid argument count"); } options.input_path = std::filesystem::path{argv[index]}; options.output_directory = remaining == 2 ? std::filesystem::path{argv[index + 1]} : std::filesystem::current_path(); return options; } loglens::ParserConfig resolve_parser_config(const CliOptions& options, const loglens::AppConfig& config) { const auto resolved_mode = options.input_mode.has_value() ? options.input_mode : config.input_mode; if (!resolved_mode.has_value()) { throw std::runtime_error("input mode is required; use --mode or input_mode in config.json"); } loglens::ParserConfig parser_config; parser_config.input_mode = *resolved_mode; if (parser_config.input_mode == loglens::InputMode::SyslogLegacy) { parser_config.assumed_year = options.assumed_year.has_value() ? options.assumed_year : config.timestamp.assume_year; if (!parser_config.assumed_year.has_value()) { throw std::runtime_error("syslog mode requires --year or timestamp.assume_year in config.json"); } } return parser_config; } } // namespace int main(int argc, char* argv[]) { CliOptions options; try { options = parse_cli_options(argc, argv); } catch (const std::exception& error) { print_usage(); std::cerr << "LogLens failed: " << error.what() << '\n'; return 1; } try { const auto app_config = options.config_path.has_value() ? loglens::load_app_config(*options.config_path) : loglens::AppConfig{}; const auto parser_config = resolve_parser_config(options, app_config); const loglens::AuthLogParser parser(parser_config); const auto parsed = parser.parse_file(options.input_path); const loglens::Detector detector(app_config.detector); const auto findings = detector.analyze(parsed.events); const loglens::ReportData report_data{ options.input_path, parsed.metadata, parsed.quality, parsed.events, findings, parsed.warnings, app_config.detector.auth_signal_mappings}; loglens::write_reports(report_data, options.output_directory, options.emit_csv); std::cout << "Parsed events: " << parsed.events.size() << '\n'; std::cout << "Findings: " << findings.size() << '\n'; std::cout << "Warnings: " << parsed.warnings.size() << '\n'; std::cout << "Markdown report: " << (options.output_directory / "report.md").string() << '\n'; std::cout << "JSON report: " << (options.output_directory / "report.json").string() << '\n'; if (options.emit_csv) { std::cout << "Findings CSV: " << (options.output_directory / "findings.csv").string() << '\n'; std::cout << "Warnings CSV: " << (options.output_directory / "warnings.csv").string() << '\n'; } } catch (const std::exception& error) { std::cerr << "LogLens failed: " << error.what() << '\n'; return 1; } return 0; }
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector bot Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P0 Badge Preserve line breaks in C++ translation units

This commit rewrites src/main.cpp as a single physical line, which causes the preprocessor to treat nearly the whole file as a malformed #include directive instead of compiling the program body. In a detached checkout of 375fba0, cmake --build fails when linking loglens with undefined reference to main; the same line-flattening pattern also appears in src/report.cpp, src/report.hpp, and the modified tests. As committed, the project is not buildable.

Useful? React with 👍 / 👎.

Loading
Loading