authlog-analyzer

# AuthLog Analyzer 🔍

[![Python](https://img.shields.io/badge/Python-3.7+-blue.svg)](https://www.python.org/downloads/)
[![License](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
[![Version](https://img.shields.io/badge/Version-1.0.0-brightgreen.svg)]()

A powerful CLI tool for parsing Windows Event Logs and Linux authentication logs to extract failed login attempts, timestamps, and IP addresses. Automatically maps findings to the **MITRE ATT&CK framework (T1110 - Brute Force)** and exports results in JSON and CSV formats.

---

## ✨ Features

- 🔍 **Multi-Platform Support**: Parses both Windows Event Logs (EventID 4625) and Linux auth logs
- 📊 **Multiple Export Formats**: JSON and CSV output for easy integration with SIEMs
- 📅 **Date Range Filtering**: Filter results by specific date ranges
- 🎯 **MITRE ATT&CK Integration**: Automatic mapping to T1110 (Brute Force) technique
- 🚨 **Risk Scoring**: Smart risk scoring based on attack patterns and frequency
- 📈 **Statistical Analysis**: Top attacking IPs, most targeted users, and summaries
- 🔧 **No External Dependencies**: Built entirely with Python standard library

---

## 📦 Installation

### Prerequisites
- Python 3.7 or higher
- Git (for cloning)

### Clone the Repository
```bash
git clone https://github.com/JuttSahib1999/authlog-analyzer.git
cd authlog-analyzer

```

### Or Download Directly

Download the `authlog_analyzer.py` file - no installation required!

## 🚀 Quick Start

```bash
# Analyze with sample data
python authlog_analyzer.py -f samples/sample_windows_security.txt -j -c

# Analyze Linux auth logs  
python authlog_analyzer.py -f samples/sample_linux_auth.log -j -c

# Filter by date range
python authlog_analyzer.py -f /var/log/auth.log -s 2026-05-01 -e 2026-05-10 -j -c

```

## 📖 Usage

### Command Line Arguments

| Argument | Description | Example |
| --- | --- | --- |
| `-f`, `--files` | Custom log files to analyze | `-f auth.log security.txt` |
| `-s`, `--start-date` | Start date (YYYY-MM-DD) | `-s 2026-05-01` |
| `-e`, `--end-date` | End date (YYYY-MM-DD) | `-e 2026-05-10` |
| `-o`, `--output` | Output file prefix | `-o my_analysis` |
| `-j`, `--json` | Export to JSON | `-j` |
| `-c`, `--csv` | Export to CSV | `-c` |
| `--version` | Show version | `--version` |

### Examples

#### Analyze System Logs (Linux)

```bash
sudo python authlog_analyzer.py -j -c

```

#### Analyze Windows Event Logs

First export Windows Security logs:

```powershell
wevtutil epl Security C:\security.evtx "/q:*[System[(EventID=4625)]]"

```

Then analyze:

```bash
python authlog_analyzer.py -f C:\security.evtx -j -c

```

#### Date Range Filtering

```bash
python authlog_analyzer.py -f auth.log -s 2026-05-01 -e 2026-05-10 -j -c

```

## 🎯 MITRE ATT&CK Mapping

All detected failed login attempts are mapped to:

| Technique | Name | Tactic |
| --- | --- | --- |
| `T1110` | Brute Force | Credential Access |

Sub-techniques tracked:

* `T1110.001` - Password Guessing
* `T1110.002` - Password Cracking
* `T1110.003` - Password Spraying
* `T1110.004` - Credential Stuffing

## 📊 Output Example

```text
======================================================================
🔍 AUTHENTICATION LOG ANALYSIS REPORT
======================================================================

📊 General Statistics:
    Total Failed Attempts: 18
    Unique Source IPs: 4
    Unique Usernames: 12

🚨 Top Attacking IPs:
    192.168.1.100: 6 attempts
    10.0.0.50: 5 attempts

🎯 MITRE ATT&CK Mapping:
    Technique: T1110 - Brute Force
    Tactic: Credential Access
======================================================================

```

## 📁 Project Structure

```text
authlog-analyzer/
├── authlog_analyzer.py      # Main tool
├── README.md                # Documentation
├── LICENSE                  # MIT License
├── .gitignore               # Git ignore rules
└── samples/                 # Sample logs for testing
    ├── README.md
    ├── sample_windows_security.txt
    └── sample_linux_auth.log

```

## 🤝 Contributing

Contributions are welcome! Feel free to:

1. Fork the repository
2. Create a feature branch
3. Submit a Pull Request

## 📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

Copyright © 2026 Abdul Muqeet Tabraiz

## 👨‍💻 Author

**Abdul Muqeet Tabraiz**

* GitHub: [@JuttSahib1999](https://github.com/JuttSahib1999)

## ⭐ Support

If you find this tool useful, please give it a star ⭐ on GitHub!