LogSentinel — Python SIEM Log Analyzer

A real-time log analysis and threat detection tool that monitors auth logs, firewall logs, and system logs — detecting attacks as they happen and surfacing them on a live Streamlit dashboard.

---

What it detects

Detection	Trigger	Severity
Brute Force	≥5 failed logins from one IP in 2 minutes	MEDIUM / HIGH
Port Scan	≥10 distinct ports blocked from one IP in 3 minutes	HIGH
Privilege Escalation	sudo to root + sensitive commands	MEDIUM / HIGH
Off-hours Login	Successful login between midnight–6am	MEDIUM
New IP Login	First-seen IP authenticates successfully	LOW
System Anomaly	OOM kills / segfaults spiking	MEDIUM

---

Architecture

logsentinel/
├── app.py              # Streamlit dashboard (charts, alerts, raw events)
├── analyzer.py         # Batch ingest + detector engine
├── watcher.py          # Tails log files, ingests new lines live
├── simulator.py        # Continuous attack simulator for demo
├── generator.py        # One-shot sample log generator
├── utils/
│   ├── db.py           # SQLite schema + connection
│   └── parser.py       # Regex parsers for auth / firewall / syslog
└── detectors/
    ├── brute_force.py  # Rolling window burst detection
    ├── port_scan.py    # Distinct port enumeration per IP
    ├── privilege_esc.py# sudo + direct root login detection
    └── anomaly.py      # Off-hours, new IP, system crash events

---

Setup

git clone https://github.com/Prateep07/logsentinel
cd logsentinel
python3 -m venv venv && source venv/bin/activate
pip install -r requirements.txt

---

Run

Option A — Quick demo (batch mode)

python generator.py        # generate sample logs with built-in attacks
python analyzer.py         # ingest and run detectors
streamlit run app.py       # open dashboard at http://localhost:8501

Click Re-analyze Logs in the sidebar.

Option B — Live mode (three terminals)

Terminal 1:

streamlit run app.py

Terminal 2:

python watcher.py          # watches log files for new lines

Terminal 3:

python simulator.py        # continuously writes realistic attack scenarios

Enable Auto-refresh toggle in the dashboard sidebar — alerts and charts update in real time as the simulator writes new attacks.

---

Dashboard

• KPI row — total events, total alerts, HIGH / MEDIUM / LOW counts
• Event timeline — area chart of events per minute
• Events by type — donut chart (auth / firewall / syslog)
• Alerts by type — bar chart (brute force / port scan / priv esc / anomaly)
• Top attacker IPs — ranked by failed login count
• Active alerts panel — live feed with severity icons and descriptions
• Raw events table — full parsed log table with colour-coded rows
• Alerts table — filterable by severity and type

---

Sample output

[SCENARIO] Brute force from 185.220.101.45 (14 attempts)
[+] 14 new events from auth.log
[!] 2 alerts updated — HIGH: Brute force detected

[SCENARIO] Port scan from 103.21.244.10 (15 ports)
[+] 15 new events from firewall.log
[!] 1 alert updated — HIGH: Port scan detected

---

Tech stack

Python · Streamlit · Pandas · Plotly · SQLite · Regex