A Python-based security automation engine designed for log ingestion, regex-based telemetry extraction, and automated threat triage. This tool identifies brute-force patterns and generates standardized JSON alerts for security operations.
The core engine is fully operational. It successfully parses raw server telemetry and identifies High-Risk Indicators of Compromise (IoCs).
- Dataset:
logs.txt(Synthetic Production Simulation) - Total Entries Processed: 5
- Identified Authentication Failures: 3
- System Status: HIGH RISK ACTIVITY DETECTED
| Indicator (IP) | Failures | Risk Level | Mitigation Action |
|---|---|---|---|
| 10.0.0.50 | 3 | HIGH | Logged to alerts.json for SIEM Ingestion |
- Telemetry Extraction: Custom Regex patterns extract ISO-8601 timestamps, status codes, and IP addresses.
- Automated Triage: Threshold-based logic identifies brute-force attempts (Threshold: 3 failures).
- Audit Compliance: Standardized JSON export ensures interoperability with modern SIEM/SOAR platforms.
- Week 1: Data Ingestion (Regex Parsing & File Handling)
- Week 2: Automated Auditing (Threshold Triage & JSON Export)
- Week 3: AGI Integration (LLM-based Threat Summarization)
- Week 4: Deployment & Portfolio Validation