Security Log Analyzer

A dark-mode Python desktop app for defensive security-log triage. It analyzes SSH/auth logs and Apache/Nginx-style web access logs, detects suspicious behavior, scores the threat level, saves scan history, and exports clean reports.

Features

• Dark ttkbootstrap GUI with Dashboard, Events, Rules, History, and Report tabs.
• Background analysis with progress updates, so large logs do not freeze the app.
• Dashboard cards for total events, threat level, unique IPs, top attack type, and time range.
• Embedded charts for attack types, top source IPs, and event timeline.
• Sortable and filterable event table with raw-line detail view.
• SQLite scan history that persists between app launches.
• Custom regex rules with severity, category, log type, and enabled/disabled state.
• JSON, CSV, and HTML report exports.

Detections

The analyzer includes built-in rules for:

• SSH brute-force attempts
• Invalid SSH users
• Sudo/authentication failures
• SQL injection probes
• XSS payloads
• Path traversal attempts
• Directory and sensitive-file scans
• Suspicious user agents such as scanners and scripted clients
• Repeated HTTP error activity from the same source IP

Install

From the project folder:

cd C:\Users\Ayaa\Downloads\Security-Log-Analyzer-main\Security-Log-Analyzer-main
python -m pip install -r requirements.txt

Requirements:

• Python 3.10 or newer
• ttkbootstrap
• matplotlib

Run

python main.py

The app opens in dark mode by default.

Quick GUI Test

1. Launch the app with python main.py.
2. Click Open Log.
3. Choose sample_logs/mixed_security.log.
4. Click Analyze.
5. Check the Dashboard tab for charts and threat score.
6. Open the Events tab and try searching for script, admin, or 203.0.113.
7. Open the History tab to confirm the scan was saved.
8. Try Export JSON, Export CSV, or Export HTML.

Automated Tests

Run:

python -m unittest

Expected result:

Ran 8 tests
OK

The tests cover parsing, built-in detections, custom rule validation, threat scoring, SQLite scan history, custom rules, and JSON/CSV/HTML export.

Project Structure

• main.py starts the desktop app.
• security_log_analyzer/analyzer.py parses logs, applies rules, and scores risk.
• security_log_analyzer/ui.py contains the dark-mode desktop interface.
• security_log_analyzer/models.py defines normalized event, rule, summary, and result objects.
• security_log_analyzer/rules.py contains default detection rules and rule validation.
• security_log_analyzer/storage.py saves scan history and custom rules in SQLite.
• security_log_analyzer/exporters.py writes JSON, CSV, and HTML reports.
• sample_logs/mixed_security.log provides a demo file for manual testing.
• tests/ contains the automated test suite.

Notes

• Scan history is stored in SQLite at %USERPROFILE%\.security_log_analyzer\history.db.
• The tool reads text-based logs and ignores undecodable characters.
• This is a local desktop app; it does not upload logs anywhere.

Defensive Use Only

This tool is intended for educational and defensive cybersecurity use. Analyze only logs you are authorized to inspect.