p474nj4y/Mini-SIEM-Log-Search-Tool

## ⚠️ 重要使用说明 ### 📁 文件夹路径要求 #### ✅ 正确输入 ``` /Users/pipo/Desktop/Logs ``` #### ❌ 错误输入 ``` /Users/pipo/Desktop/Logs/access.log ``` ## 📂 支持的日志格式 * `.txt` * `.log` * `.http` * `.dns` * `.ftp` * `.sh` ## ▶️ 快速开始 ### 第一步：运行程序 ``` python3 log_ingester.py ``` ### 第二步：输入文件夹路径 ``` Folder Path: /Users/pipo/Desktop/Logs ``` ### 第三步：输入搜索关键字 ``` Search Keyword: Failed ``` ### 第四步：查看结果 ``` <<<<<<< RESULTS >>>>>>> [access.log] Line 2: Failed login from 192.168.1.10 [access.log] Line 4: Failed login from 192.168.1.20 Total Matches: 2 ``` ## 📝 示例日志文件 ### access.log ``` User login successful Failed login from 192.168.1.10 Admin login successful Failed login from 192.168.1.20 ``` ## 📂 示例目录结构 ``` Logs/ └── access.log ``` 在提示时提供以下路径： ``` /Users/pipo/Desktop/Logs ``` ## 📊 示例输出 ``` <<<<<<< RESULTS >>>>>>> [access.log] Line 2: Failed login from 192.168.1.10 [access.log] Line 4: Failed login from 192.168.1.20 Total Matches: 2 ``` ## 📋 报告生成 示例报告： ``` ============================= Mini SIEM Investigation Report ============================= Keyword Searched: Failed Match 1: File: access.log Line: 2 Event: Failed login from 192.168.1.10 Match 2: File: access.log Line: 4 Event: Failed login from 192.168.1.20 Total Matches: 2 ``` ## 🔥 计划增强功能 ### 检测与告警 - [ ] 自定义检测规则 - [ ] 类 Sigma 检测引擎 - [ ] 告警生成 - [ ] 严重性分类 ### 威胁狩猎 - [ ] IOC 匹配 - [ ] IP 地址提取 - [ ] 域名提取 - [ ] 威胁情报集成 ### 报告 - [ ] TXT 报告导出 - [ ] CSV 导出 - [ ] 调查报告 - [ ] 告警摘要 ### 可视化 - [ ] Dashboard 界面 - [ ] 日志分析 - [ ] 事件统计 - [ ] 安全指标 ## 💡 使用技巧 ## 🏷️ 标签 `python` `cybersecurity` `siem` `log-analysis` `soc-analyst` `incident-response` `threat-hunting` `blue-team` `security-monitoring` `log-ingestion`

标签：Python, 安全运营, 扫描框架, 文档结构分析, 无后门, 逆向工具