Log Analysis Tool
An automated parser for pinpointing suspicious web and system activity.
Project Overview
Created a robust log examination framework that translates huge volumes of raw HTTP, System, and Authentication logs into human-readable, prioritized security alerts, greatly expediting incident response processes.
Key Features
- Parses standard Apache and Nginx web logging formats, including specialized multi-line traces.
- Identifies SQL Injection (SQLi) and Cross-Site Scripting (XSS) payloads in HTTP GET/POST parameters automatically.
- Correlates failed login attempts predicting brute-force campaign vectors across a timeline.
- Flags anomalous administrative command execution in shell histories.
- Outputs structured JSON arrays ready for ingestion by other SIEM tools.
Technologies Used
Bash / Awk
Grep Patterns
Incident Response
DFIR
Regex