A modular Security Operations Center (SOC) log analyzer built with Python.
Python • Cybersecurity • Threat Detection • Security Automation • GitHub Actions
The Python SOC Log Analyzer is a modular cybersecurity application designed to simulate a Security Operations Center (SOC) workflow.
It reads authentication log files, analyzes login activity, detects repeated failed login attempts, identifies potential brute-force attacks, generates security summaries, exports investigation reports, and validates detection logic using automated tests.
The project demonstrates practical cybersecurity engineering, Python programming, software architecture, testing, and CI/CD practices.
- ✅ Authentication Log Parsing
- ✅ Failed Login Detection
- ✅ Brute Force Detection
- ✅ High-Risk Alert Generation
- ✅ Security Report Export
- ✅ Modular Architecture
- ✅ Unit Testing
- ✅ GitHub Actions CI/CD
- ✅ Professional Documentation
flowchart LR
A[Authentication Logs]
--> B[parser.py]
B --> C[detector.py]
C --> D[report.py]
D --> E[Terminal Output]
D --> F[Security Report]
flowchart TD
A[CSV Authentication Logs]
A --> B[Load Events]
B --> C[Analyze Failed Logins]
C --> D[Detect Brute Force]
D --> E[Generate Security Report]
E --> F[Export Report]
python-soc-log-analyzer/
│
├── .github/
│ └── workflows/
│ └── python-tests.yml
│
├── reports/
│ └── security_report.txt
│
├── sample_logs/
│ └── authentication_logs.csv
│
├── src/
│ ├── main.py
│ ├── parser.py
│ ├── detector.py
│ └── report.py
│
├── tests/
│ └── test_detector.py
│
├── README.md
├── LICENSE
└── .gitignore
Clone the repository.
git clone https://github.com/ThePreacherMan/python-soc-log-analyzer.gitNavigate into the project.
cd python-soc-log-analyzerRun the application.
python src/main.pyRun the automated tests.
python -m unittest discover -s tests -v========== SECURITY SUMMARY ==========
Total Events : 15
Successful Logins : 5
Failed Logins : 10
Security Alerts : 1
======================================
========== HIGH-RISK ALERTS ==========
Alert #1
User : admin
IP Address : 10.0.0.5
Failed Attempts : 5
Risk Level : HIGH
Reason :
5 failed login attempts detected for user 'admin' from 10.0.0.5.
The application currently detects:
- Multiple failed login attempts
- Potential brute-force attacks
- High-risk authentication events
- Suspicious user activity
Future versions will include:
- Impossible Travel Detection
- Login Time Analysis
- IP Reputation Checks
- Geolocation
- Risk Scoring
- Dashboard
- REST API
The project uses Python's built-in unittest framework.
Current tests include:
- Failed login detection
- Brute-force detection
- Threshold validation
All tests are executed automatically using GitHub Actions on every push to the repository.
| Metric | Value |
|---|---|
| Language | Python |
| Architecture | Modular |
| Detection Engine | Rule-Based |
| Test Framework | unittest |
| CI/CD | GitHub Actions |
| Authentication Dataset | Synthetic |
| License | MIT |
- Authentication Log Parsing
- Failed Login Detection
- Brute Force Detection
- Security Report Export
- Unit Testing
- GitHub Actions
- CSV Export
- JSON Export
- Configurable Detection Thresholds
- Rich Terminal Output
- SQLite Support
- Interactive Dashboard
- REST API
- Docker Support
- SIEM-style Event Viewer
- User Risk Profiles
- Python Programming
- Cybersecurity
- Security Operations Center (SOC)
- Authentication Monitoring
- Threat Detection
- Incident Response
- Secure Software Design
- Modular Programming
- Unit Testing
- Git
- GitHub
- GitHub Actions (CI/CD)
This project strengthened my understanding of:
- Python application architecture
- Authentication log analysis
- Security event detection
- Brute-force identification
- Modular software design
- Automated testing
- Continuous Integration
- Professional GitHub workflows
ISC2 Certified in Cybersecurity (CC)
Cybersecurity Analyst focused on:
- Security Operations (SOC)
- Python Security Automation
- Threat Detection
- Cloud Security
- Risk Management
GitHub
https://github.com/ThePreacherMan
https://www.linkedin.com/in/chigoziem-ibeh-seo-cybersecurity
Portfolio
Contributions, suggestions, and improvements are welcome.
Feel free to fork the repository, create a feature branch, and submit a pull request.
This project is licensed under the MIT License.