🔍 Log Analyzer — SSH & Web Access Log Security Tool

A Python CLI tool that parses SSH authentication logs and web server access logs, then flags suspicious activity — the same kind of triage work a SOC analyst does when reviewing raw logs, at a small scale.

Built as a hands-on project while learning security operations and log analysis fundamentals.

What it detects

SSH auth logs

• Brute-force login attempts — 5+ failed logins from a single IP
• Distinct usernames tried — a sign of automated credential-stuffing rather than a person mistyping their password
• Critical correlation — if an IP that just brute-forced also had a successful login, that's flagged as CRITICAL, since it likely means the attack worked

Web access logs (Common/Combined Log Format)

• Automated path scanning — 10+ 404 (Not Found) responses from one IP, typical of a tool probing for hidden endpoints
• Sensitive path access — requests to paths like /wp-login.php, /admin, /.env, /.git, /phpmyadmin, /etc/passwd, etc.

Each finding is labeled MEDIUM, HIGH, or CRITICAL based on severity.

Usage

# Analyze an SSH auth log
python log_analyzer.py --ssh sample_logs/auth.log

# Analyze a web access log
python log_analyzer.py --web sample_logs/access.log

# Analyze both at once
python log_analyzer.py --ssh sample_logs/auth.log --web sample_logs/access.log

Sample log files (synthetic, safe to run) are included in sample_logs/ so you can try it immediately.

Example output

=== SSH Auth Log Report ===
Unique IPs with failed logins: 3
[CRITICAL] 203.0.113.5: 6 failed attempts, 5 distinct usernames tried  <-- ALSO HAD A SUCCESSFUL LOGIN as ['root'] — investigate immediately

=== Web Access Log Report ===
Unique IPs seen: 3
[MEDIUM] 198.51.100.44: 12 404 responses — looks like automated path scanning
[HIGH] 198.51.100.44: requested 9 sensitive path(s), e.g. /wp-login.php

=== Summary: 3 finding(s) flagged for review ===

Why this project

Reviewing raw logs and picking out real threats from noise is a core SOC analyst skill. Real SIEM tools (Splunk, ELK, Wazuh) do this at massive scale — this project rebuilds the core logic in plain Python to understand what's actually happening underneath.

What I learned

• Writing regex patterns to parse real-world log formats
• Correlating events across log lines (failed attempts + a later success from the same IP)
• Thinking in terms of severity levels rather than just "flagged / not flagged"
• Using argparse for a proper CLI interface with multiple modes

Possible future improvements

• Export findings to CSV/JSON for use in other tools
• Add a time-window check (e.g. 5 fails within 60 seconds, not just total)
• Support additional log formats (Windows Event Logs, syslog)
• Add a --threshold flag to customize sensitivity

Disclaimer

This is a learning project built for portfolio purposes and tested only against synthetic sample data. It is not a production-grade SIEM and should not be relied on as a sole detection tool.