A Python-based Linux auth log analyzer that detects common attack patterns.
Built as a cybersecurity portfolio project demonstrating blue team detection skills.
- Brute Force Detection - flags IPs with 3+ failed logins within 60 seconds
- Compromise Detection - alerts when a previously-failing IP successfully logs in
- Sudo Abuse Detection - tracks privilege escalation and sensitive command execution
- JSON Report Output - saves all findings to a structured file for further analysis
- Severity Ranking - alerts sorted by CRITICAL, HIGH, LOW
python3 logsentinel.py
| Alert Type | Severity | Logic |
|---|---|---|
| BRUTE_FORCE | HIGH | 3+ failed logins from same IP within 60s |
| COMPROMISE | CRITICAL | Successful login from IP with prior failures |
| SUDO_ABUSE | HIGH | Sudo command touching /etc/shadow, /bin/bash |
| SUDO_USAGE | LOW | Any sudo command |
Edit these values at the top of logsentinel.py to tune detection:
BRUTE_THRESHOLD = 3 # failed attempts before brute force alert
BRUTE_WINDOW = 60 # time window in seconds
| File | Description |
|---|---|
| logsentinel.py | Main detection script |
| sample_auth.log | Sample log with simulated attacks |
| logsentinel_report.json | Generated JSON report (created on run) |
- Python scripting (regex, datetime, file I/O)
- Linux log analysis and auth event parsing
- Blue team detection logic (brute force, compromise, privilege escalation)
- JSON structured output for SIEM integration
Tory Griffin Jr — Cybersecurity Student
GitHub: https://github.com/10ktjay