Moh.Sh/ghaymah-exam-Mohammad-Shehadeh-SecOps
1
0
نسخ 0
الشفرة المشكلات طلبات السحب Actions Packages المشاريع الإصدارات الويكي النشاط

أنهيت الإمتحان

تصفح المصدر
هذا الالتزام موجود في:
Mohammad
2026-07-27 22:32:29 +03:00
التزام f958602ee5
27 ملفات معدلة مع 1882 إضافات و0 حذوفات
تنزيل ملف التصحيح تنزيل ملف الاختلاف توسيع جميع الملفات طي جميع الملفات

134
q4-siem-log-analysis/README.md Normal file
عرض الملف

@@ -0,0 +1,134 @@
# نظام SIEM مبسط — دليل التسليم
## المحتويات
| الملف | الوظيفة |
|---|---|
| `siem_analyzer.py` | المحرك الرئيسي: يقرأ 3 مصادر سجلات، يكتشف الأنماط المشبوهة، يكتب `output/alerts.json` |
| `generate_sample_logs.py` | يولّد سجلات تجريبية (Web/Auth/Firewall) لتجربة النظام قبل التسليم |
| `dashboard.html` | لوحة المراقبة (HTML/CSS/JS) — تعرض التنبيهات وعناوين IP المشبوهة |
| `logs/` | مجلد السجلات الخام (المدخلات) |
| `output/alerts.json` | مخرجات التحليل (المخرج الذي تقرأه اللوحة) |
---
## 1) المصادر الثلاثة المُختارة ولماذا
| # | المصدر | الطبقة | الهجمات المكتشفة |
|---|---|---|---|
| 1 | **Web Server** (`access.log` بصيغة Nginx/Apache) | Application Layer | SQL Injection، Directory Traversal، Scanning/Fuzzing (كثرة 404/403 من نفس IP) |
| 2 | **Auth/OS** (`auth.log` بصيغة Linux SSH) | Endpoint/OS Layer | Brute Force، دخول ناجح بعد فشل متكرر |
| 3 | **Firewall** (`firewall.log` بصيغة iptables) | Network Layer | Port Scanning (تعدد المنافذ المحظورة من نفس IP) |
اختيار هذه الطبقات الثلاث معًا (شبكة + نظام + تطبيق) يعطي رؤية شاملة تشبه أي SIEM حقيقي.
## 2) طريقة التشغيل
```bash
# 1. توليد سجلات تجريبية (أو استبدل logs/*.log بسجلاتك الحقيقية)
python3 generate_sample_logs.py
# 2. تشغيل التحليل مرة واحدة
python3 siem_analyzer.py --once
# أو تشغيل دوري (محاكاة عمل خدمة SIEM حية) كل 30 ثانية
python3 siem_analyzer.py --watch 30
# 3. تشغيل خادم محلي بسيط لعرض اللوحة (ضروري كي تستطيع اللوحة قراءة alerts.json عبر fetch)
python3 -m http.server 8000
# 4. افتح المتصفح على:
http://localhost:8000/dashboard.html
```
> ملاحظة: إذا فتحت `dashboard.html` مباشرة (بدون خادم)، أضفنا زر **"تحميل alerts.json يدويًا"** في اللوحة كحل بديل يعمل بدون أي خادم.
لاستخدام سجلاتك الحقيقية بدلاً من التجريبية، عدّل المسارات في أعلى `siem_analyzer.py`:
```python
CONFIG = {
"web_log_path": "/var/log/nginx/access.log",
"auth_log_path": "/var/log/auth.log",
"firewall_log_path": "/var/log/iptables.log",
...
}
```
## 3) منطق الكشف (Detection Logic) باختصار
- **SQL Injection / Traversal**: تعابير قياسية (Regex) تبحث عن `UNION SELECT`، `OR 1=1`، `../` ضمن الـ URL المطلوب.
- **Scanning عبر الويب**: عدّاد لكل IP لعدد أكواد 404/403؛ إذا تجاوز الحد (15 افتراضيًا) → تنبيه.
- **Brute Force**: عدّاد محاولات `Failed password` لكل IP خلال الملف؛ إذا تجاوز 5 محاولات → تنبيه، ويُرفع لمستوى "حرج" إذا نجح الدخول بعدها.
- **Port Scanning**: تجميع المنافذ الفريدة (`set`) التي حاول كل IP الوصول إليها وتم رفضها (`DROP/REJECT/BLOCK`)؛ إذا تجاوزت 15 منفذًا → تنبيه.
كل الحدود (Thresholds) قابلة للتعديل من قاموس `CONFIG` أعلى ملف `siem_analyzer.py`.
## 4) تصميم الـ Dashboard
- بطاقات إحصائية علوية (إجمالي التنبيهات، حرجة، عالية، IP مشبوهة).
- جدول التنبيهات كاملاً مرتب حسب الخطورة.
- جدول عناوين IP المشبوهة مع درجة الخطورة (Score) المحسوبة من وزن كل تنبيه.
- رسم بياني بسيط (أعمدة) لعدد التنبيهات حسب المصدر.
- تحديث تلقائي كل 10 ثوانٍ عبر `fetch`، بالإضافة لزر تحديث يدوي وزر رفع ملف JSON يدويًا.
---
## 5) النشر على غيمة (Cloud) باستخدام Block Storage — الجزء المطلوب في السؤال الثالث
### الفكرة العامة
الهدف من استخدام **Block Storage** هنا هو فصل بيانات السجلات (Logs) عن دورة حياة الخادم (VM)، بحيث:
- إذا تم حذف/إعادة بناء الخادم، لا تُفقد السجلات التاريخية.
- يمكن أخذ نسخ احتياطية (Snapshots) لوحدة التخزين بشكل مستقل عن الخادم.
- يمكن فصل الوحدة وتوصيلها بخادم آخر (مثلاً خادم تحليل مخصص) دون نقل بيانات فعليًا.
### خطوات النشر (عامة، تنطبق على أغلب مزودي الغيمة)
1. **إنشاء خادم افتراضي (VM/Instance)** لتشغيل السكربتات ولوحة الـ Dashboard (يكفي حجم صغير: 1-2 vCPU، 1-2GB RAM).
2. **إنشاء وحدة Block Storage** منفصلة (مثلاً 20-50GB حسب حجم السجلات المتوقع) وربطها (Attach) بالخادم.
3. **تهيئة ووصل الوحدة (Mount)** داخل الخادم:
```bash
sudo mkfs.ext4 /dev/vdb # تهيئة الوحدة (مرة واحدة فقط)
sudo mkdir -p /mnt/siem-storage
sudo mount /dev/vdb /mnt/siem-storage
echo "/dev/vdb /mnt/siem-storage ext4 defaults 0 2" | sudo tee -a /etc/fstab # لضمان الوصل التلقائي بعد إعادة التشغيل
```
4. **نقل مجلدي `logs/` و `output/` إلى وحدة التخزين**، وتحديث المسارات في `CONFIG` داخل `siem_analyzer.py`:
```python
CONFIG = {
"web_log_path": "/mnt/siem-storage/logs/access.log",
"auth_log_path": "/mnt/siem-storage/logs/auth.log",
"firewall_log_path": "/mnt/siem-storage/logs/firewall.log",
"output_path": "/mnt/siem-storage/output/alerts.json",
...
}
```
5. **تشغيل التحليل كخدمة دائمة (systemd)** بدلاً من تشغيله يدويًا، مثال `siem-analyzer.service`:
```ini
[Unit]
Description=SIEM Log Analyzer
After=network.target
[Service]
ExecStart=/usr/bin/python3 /opt/siem/siem_analyzer.py --watch 60
Restart=always
User=siem
[Install]
WantedBy=multi-user.target
```
```bash
sudo systemctl enable --now siem-analyzer
```
6. **تشغيل الـ Dashboard عبر خادم ويب حقيقي** (بدلاً من `http.server`) مثل Nginx، بحيث يخدم:
- `dashboard.html` كصفحة ثابتة.
- `output/alerts.json` (الموجود فعليًا على وحدة الـ Block Storage المُوصولة) كملف بيانات يُقرأ عبر `fetch`.
7. **(اختياري) نسخ احتياطي دوري**: جدولة Snapshot يومي لوحدة الـ Block Storage عبر لوحة تحكم مزود الغيمة، لحفظ تاريخ السجلات والتنبيهات بشكل مستقل عن الخادم نفسه.
### لماذا Block Storage تحديدًا (وليس تخزين محلي على القرص الافتراضي للخادم)؟
- **الاستمرارية (Persistence)**: تخزين القرص الافتراضي المرفق افتراضيًا بالخادم (Root Disk) قد يُفقد عند حذف الخادم؛ Block Storage وحدة مستقلة يمكن الاحتفاظ بها.
- **قابلية التوسع (Scalability)**: يمكن زيادة حجم الوحدة لاحقًا دون التأثير على الخادم نفسه، مهم لأن حجم السجلات يكبر مع الوقت.
- **قابلية النقل**: يمكن فصل الوحدة وربطها بخادم تحليل آخر (مثلاً خادم أقوى لتشغيل تحليل أعمق) دون نسخ نيوتيرا (TB) من البيانات عبر الشبكة.

455
q4-siem-log-analysis/access.log Normal file
عرض الملف

@@ -0,0 +1,455 @@
192.168.1.104 - - [27/Jul/2026:16:14:46 +0000] "GET /products HTTP/1.1" 200 333
192.168.1.38 - - [27/Jul/2026:16:10:29 +0000] "GET /products HTTP/1.1" 404 1654
192.168.1.144 - - [27/Jul/2026:16:15:32 +0000] "GET /about HTTP/1.1" 404 4472
192.168.1.131 - - [27/Jul/2026:16:18:37 +0000] "GET / HTTP/1.1" 200 4337
192.168.1.109 - - [27/Jul/2026:16:20:34 +0000] "GET /about HTTP/1.1" 404 1319
192.168.1.114 - - [27/Jul/2026:16:08:35 +0000] "GET /index.html HTTP/1.1" 304 4613
192.168.1.167 - - [27/Jul/2026:15:42:29 +0000] "GET /login HTTP/1.1" 404 2531
192.168.1.247 - - [27/Jul/2026:15:46:43 +0000] "GET /api/users HTTP/1.1" 200 788
192.168.1.5 - - [27/Jul/2026:16:09:14 +0000] "GET / HTTP/1.1" 404 2766
192.168.1.41 - - [27/Jul/2026:16:31:45 +0000] "GET /about HTTP/1.1" 200 3625
192.168.1.99 - - [27/Jul/2026:15:40:31 +0000] "GET /products HTTP/1.1" 200 2771
192.168.1.35 - - [27/Jul/2026:16:17:57 +0000] "GET /index.html HTTP/1.1" 304 2553
192.168.1.118 - - [27/Jul/2026:15:40:50 +0000] "GET /products HTTP/1.1" 404 4295
192.168.1.37 - - [27/Jul/2026:15:58:27 +0000] "GET /login HTTP/1.1" 304 3532
45.155.205.7 - - [27/Jul/2026:16:23:58 +0000] "GET /wp-admin/196.php HTTP/1.1" 404 200
192.168.1.106 - - [27/Jul/2026:16:22:31 +0000] "GET /about HTTP/1.1" 200 1016
192.168.1.132 - - [27/Jul/2026:15:53:03 +0000] "GET /about HTTP/1.1" 304 4065
192.168.1.218 - - [27/Jul/2026:16:16:25 +0000] "GET /index.html HTTP/1.1" 200 3052
192.168.1.112 - - [27/Jul/2026:16:29:35 +0000] "GET /about HTTP/1.1" 404 2835
192.168.1.18 - - [27/Jul/2026:16:29:36 +0000] "GET /products HTTP/1.1" 304 2835
192.168.1.119 - - [27/Jul/2026:16:22:25 +0000] "GET /login HTTP/1.1" 200 1701
192.168.1.223 - - [27/Jul/2026:15:36:47 +0000] "GET /login HTTP/1.1" 304 4366
192.168.1.139 - - [27/Jul/2026:15:59:45 +0000] "GET /products HTTP/1.1" 304 3946
192.168.1.56 - - [27/Jul/2026:16:25:30 +0000] "GET /index.html HTTP/1.1" 304 236
192.168.1.90 - - [27/Jul/2026:16:18:51 +0000] "GET / HTTP/1.1" 200 2780
192.168.1.183 - - [27/Jul/2026:16:12:28 +0000] "GET /about HTTP/1.1" 200 2325
203.0.113.45 - - [27/Jul/2026:16:26:07 +0000] "GET /products?id=1 OR 1=1 HTTP/1.1" 500 512
192.168.1.90 - - [27/Jul/2026:16:01:14 +0000] "GET /index.html HTTP/1.1" 404 1288
192.168.1.111 - - [27/Jul/2026:15:39:27 +0000] "GET /login HTTP/1.1" 200 3654
192.168.1.232 - - [27/Jul/2026:15:58:55 +0000] "GET /api/users HTTP/1.1" 304 1259
192.168.1.108 - - [27/Jul/2026:16:18:05 +0000] "GET / HTTP/1.1" 304 447
45.155.205.7 - - [27/Jul/2026:16:28:57 +0000] "GET /wp-admin/560.php HTTP/1.1" 404 200
192.168.1.244 - - [27/Jul/2026:15:34:22 +0000] "GET /products HTTP/1.1" 200 4921
192.168.1.161 - - [27/Jul/2026:15:34:34 +0000] "GET /about HTTP/1.1" 200 609
192.168.1.75 - - [27/Jul/2026:15:55:10 +0000] "GET /about HTTP/1.1" 304 781
192.168.1.4 - - [27/Jul/2026:15:57:32 +0000] "GET /products HTTP/1.1" 200 2460
192.168.1.167 - - [27/Jul/2026:16:06:06 +0000] "GET /api/users HTTP/1.1" 304 2416
192.168.1.115 - - [27/Jul/2026:16:18:37 +0000] "GET /index.html HTTP/1.1" 200 4501
192.168.1.37 - - [27/Jul/2026:15:56:43 +0000] "GET /login HTTP/1.1" 200 3672
192.168.1.210 - - [27/Jul/2026:16:07:26 +0000] "GET /index.html HTTP/1.1" 200 590
192.168.1.141 - - [27/Jul/2026:16:10:12 +0000] "GET /api/users HTTP/1.1" 200 603
192.168.1.50 - - [27/Jul/2026:16:26:32 +0000] "GET /api/users HTTP/1.1" 304 4002
192.168.1.22 - - [27/Jul/2026:15:42:16 +0000] "GET / HTTP/1.1" 200 324
192.168.1.122 - - [27/Jul/2026:15:42:24 +0000] "GET /login HTTP/1.1" 404 1163
192.168.1.28 - - [27/Jul/2026:15:53:08 +0000] "GET /index.html HTTP/1.1" 404 2073
192.168.1.236 - - [27/Jul/2026:16:19:59 +0000] "GET /index.html HTTP/1.1" 304 1321
192.168.1.9 - - [27/Jul/2026:16:03:41 +0000] "GET /login HTTP/1.1" 404 2616
192.168.1.249 - - [27/Jul/2026:16:10:54 +0000] "GET /index.html HTTP/1.1" 200 2802
192.168.1.26 - - [27/Jul/2026:16:26:21 +0000] "GET /index.html HTTP/1.1" 200 1735
192.168.1.242 - - [27/Jul/2026:16:16:15 +0000] "GET /about HTTP/1.1" 304 1035
192.168.1.160 - - [27/Jul/2026:15:50:29 +0000] "GET /api/users HTTP/1.1" 304 2154
192.168.1.157 - - [27/Jul/2026:16:10:47 +0000] "GET / HTTP/1.1" 304 2781
192.168.1.237 - - [27/Jul/2026:16:00:22 +0000] "GET /login HTTP/1.1" 200 2636
45.155.205.7 - - [27/Jul/2026:16:24:52 +0000] "GET /wp-admin/524.php HTTP/1.1" 404 200
192.168.1.20 - - [27/Jul/2026:16:20:53 +0000] "GET /api/users HTTP/1.1" 200 2130
192.168.1.201 - - [27/Jul/2026:16:15:45 +0000] "GET /about HTTP/1.1" 200 2091
192.168.1.88 - - [27/Jul/2026:16:26:47 +0000] "GET /products HTTP/1.1" 200 331
192.168.1.129 - - [27/Jul/2026:16:01:42 +0000] "GET /about HTTP/1.1" 304 3138
192.168.1.154 - - [27/Jul/2026:15:43:47 +0000] "GET /products HTTP/1.1" 304 202
192.168.1.117 - - [27/Jul/2026:16:16:03 +0000] "GET /about HTTP/1.1" 304 2266
192.168.1.7 - - [27/Jul/2026:16:31:29 +0000] "GET /login HTTP/1.1" 200 1944
192.168.1.216 - - [27/Jul/2026:16:24:13 +0000] "GET /login HTTP/1.1" 404 2867
203.0.113.45 - - [27/Jul/2026:16:32:45 +0000] "GET /products?id=1 OR 1=1 HTTP/1.1" 500 512
192.168.1.12 - - [27/Jul/2026:15:57:48 +0000] "GET /api/users HTTP/1.1" 304 3067
192.168.1.98 - - [27/Jul/2026:15:40:11 +0000] "GET /index.html HTTP/1.1" 200 2498
192.168.1.218 - - [27/Jul/2026:15:48:32 +0000] "GET / HTTP/1.1" 404 258
192.168.1.144 - - [27/Jul/2026:16:15:52 +0000] "GET /api/users HTTP/1.1" 200 3426
192.168.1.163 - - [27/Jul/2026:15:54:58 +0000] "GET /login HTTP/1.1" 304 3888
192.168.1.190 - - [27/Jul/2026:15:37:58 +0000] "GET /index.html HTTP/1.1" 200 3034
192.168.1.180 - - [27/Jul/2026:16:30:03 +0000] "GET /about HTTP/1.1" 200 2367
192.168.1.231 - - [27/Jul/2026:15:53:33 +0000] "GET /about HTTP/1.1" 304 1000
192.168.1.207 - - [27/Jul/2026:15:42:53 +0000] "GET /index.html HTTP/1.1" 200 4427
192.168.1.232 - - [27/Jul/2026:16:30:38 +0000] "GET /api/users HTTP/1.1" 200 724
192.168.1.106 - - [27/Jul/2026:16:32:52 +0000] "GET / HTTP/1.1" 200 4033
192.168.1.172 - - [27/Jul/2026:16:24:48 +0000] "GET /products HTTP/1.1" 304 3170
192.168.1.90 - - [27/Jul/2026:16:00:15 +0000] "GET /login HTTP/1.1" 200 1261
192.168.1.242 - - [27/Jul/2026:15:55:44 +0000] "GET / HTTP/1.1" 404 2782
192.168.1.103 - - [27/Jul/2026:15:33:12 +0000] "GET /api/users HTTP/1.1" 304 345
192.168.1.17 - - [27/Jul/2026:16:02:47 +0000] "GET / HTTP/1.1" 200 4235
192.168.1.125 - - [27/Jul/2026:16:02:07 +0000] "GET /api/users HTTP/1.1" 404 4476
192.168.1.185 - - [27/Jul/2026:16:31:26 +0000] "GET /about HTTP/1.1" 304 2232
192.168.1.23 - - [27/Jul/2026:15:51:42 +0000] "GET /index.html HTTP/1.1" 200 4460
45.155.205.7 - - [27/Jul/2026:16:26:48 +0000] "GET /wp-admin/215.php HTTP/1.1" 404 200
45.155.205.7 - - [27/Jul/2026:16:28:39 +0000] "GET /wp-admin/789.php HTTP/1.1" 404 200
192.168.1.92 - - [27/Jul/2026:16:22:08 +0000] "GET /api/users HTTP/1.1" 200 3725
192.168.1.72 - - [27/Jul/2026:16:27:49 +0000] "GET /products HTTP/1.1" 404 4416
192.168.1.24 - - [27/Jul/2026:15:58:09 +0000] "GET /login HTTP/1.1" 200 4047
192.168.1.233 - - [27/Jul/2026:16:26:18 +0000] "GET / HTTP/1.1" 304 4238
192.168.1.95 - - [27/Jul/2026:16:13:49 +0000] "GET /login HTTP/1.1" 200 4750
192.168.1.35 - - [27/Jul/2026:16:27:30 +0000] "GET /api/users HTTP/1.1" 304 3606
192.168.1.171 - - [27/Jul/2026:16:18:44 +0000] "GET /login HTTP/1.1" 200 538
45.155.205.7 - - [27/Jul/2026:16:26:14 +0000] "GET /wp-admin/494.php HTTP/1.1" 404 200
192.168.1.26 - - [27/Jul/2026:16:10:34 +0000] "GET /products HTTP/1.1" 200 274
192.168.1.210 - - [27/Jul/2026:15:44:50 +0000] "GET /index.html HTTP/1.1" 200 3610
192.168.1.151 - - [27/Jul/2026:15:42:17 +0000] "GET /index.html HTTP/1.1" 200 666
192.168.1.244 - - [27/Jul/2026:16:21:09 +0000] "GET /api/users HTTP/1.1" 200 2988
192.168.1.17 - - [27/Jul/2026:15:53:55 +0000] "GET /products HTTP/1.1" 200 4729
192.168.1.41 - - [27/Jul/2026:16:17:36 +0000] "GET /products HTTP/1.1" 200 1905
203.0.113.45 - - [27/Jul/2026:16:29:56 +0000] "GET /search?q=SELECT * FROM accounts HTTP/1.1" 500 512
45.155.205.7 - - [27/Jul/2026:16:28:18 +0000] "GET /wp-admin/819.php HTTP/1.1" 404 200
192.168.1.124 - - [27/Jul/2026:15:46:04 +0000] "GET /api/users HTTP/1.1" 200 3634
192.168.1.145 - - [27/Jul/2026:15:34:46 +0000] "GET /login HTTP/1.1" 200 3569
45.155.205.7 - - [27/Jul/2026:16:23:19 +0000] "GET /wp-admin/127.php HTTP/1.1" 404 200
192.168.1.171 - - [27/Jul/2026:16:21:51 +0000] "GET /login HTTP/1.1" 304 538
192.168.1.81 - - [27/Jul/2026:16:26:39 +0000] "GET /api/users HTTP/1.1" 200 2279
192.168.1.47 - - [27/Jul/2026:16:02:11 +0000] "GET /about HTTP/1.1" 200 285
192.168.1.226 - - [27/Jul/2026:16:04:50 +0000] "GET /index.html HTTP/1.1" 304 1097
192.168.1.175 - - [27/Jul/2026:15:57:23 +0000] "GET /login HTTP/1.1" 200 753
192.168.1.92 - - [27/Jul/2026:15:57:15 +0000] "GET /login HTTP/1.1" 200 4358
192.168.1.67 - - [27/Jul/2026:16:29:56 +0000] "GET /api/users HTTP/1.1" 200 1705
192.168.1.57 - - [27/Jul/2026:16:30:33 +0000] "GET /api/users HTTP/1.1" 200 2628
192.168.1.202 - - [27/Jul/2026:15:51:43 +0000] "GET / HTTP/1.1" 200 4925
45.155.205.7 - - [27/Jul/2026:16:26:51 +0000] "GET /wp-admin/504.php HTTP/1.1" 404 200
192.168.1.102 - - [27/Jul/2026:16:20:39 +0000] "GET /login HTTP/1.1" 200 2976
192.168.1.125 - - [27/Jul/2026:15:35:37 +0000] "GET /products HTTP/1.1" 200 2736
192.168.1.131 - - [27/Jul/2026:16:29:43 +0000] "GET /api/users HTTP/1.1" 200 3023
192.168.1.175 - - [27/Jul/2026:16:23:23 +0000] "GET /about HTTP/1.1" 404 3061
192.168.1.99 - - [27/Jul/2026:15:37:06 +0000] "GET /about HTTP/1.1" 404 3839
192.168.1.204 - - [27/Jul/2026:15:42:44 +0000] "GET /index.html HTTP/1.1" 200 3905
192.168.1.33 - - [27/Jul/2026:15:50:46 +0000] "GET /api/users HTTP/1.1" 200 3797
192.168.1.246 - - [27/Jul/2026:16:03:29 +0000] "GET /products HTTP/1.1" 304 3535
192.168.1.161 - - [27/Jul/2026:16:11:53 +0000] "GET /index.html HTTP/1.1" 200 2913
192.168.1.186 - - [27/Jul/2026:16:20:47 +0000] "GET /login HTTP/1.1" 200 1997
192.168.1.105 - - [27/Jul/2026:15:59:27 +0000] "GET /products HTTP/1.1" 200 3524
45.155.205.7 - - [27/Jul/2026:16:30:15 +0000] "GET /wp-admin/816.php HTTP/1.1" 404 200
192.168.1.35 - - [27/Jul/2026:15:38:00 +0000] "GET / HTTP/1.1" 304 4744
192.168.1.143 - - [27/Jul/2026:16:08:41 +0000] "GET /api/users HTTP/1.1" 200 1886
192.168.1.20 - - [27/Jul/2026:15:53:11 +0000] "GET /login HTTP/1.1" 200 1735
192.168.1.75 - - [27/Jul/2026:15:48:27 +0000] "GET /api/users HTTP/1.1" 200 1278
192.168.1.198 - - [27/Jul/2026:16:12:56 +0000] "GET /index.html HTTP/1.1" 304 908
192.168.1.244 - - [27/Jul/2026:16:19:22 +0000] "GET /products HTTP/1.1" 200 1368
192.168.1.111 - - [27/Jul/2026:16:27:41 +0000] "GET /api/users HTTP/1.1" 200 1362
192.168.1.20 - - [27/Jul/2026:15:34:19 +0000] "GET /api/users HTTP/1.1" 200 4928
192.168.1.174 - - [27/Jul/2026:16:17:35 +0000] "GET /products HTTP/1.1" 304 2024
192.168.1.96 - - [27/Jul/2026:15:37:52 +0000] "GET /about HTTP/1.1" 304 2505
192.168.1.84 - - [27/Jul/2026:16:06:57 +0000] "GET /products HTTP/1.1" 304 858
192.168.1.247 - - [27/Jul/2026:15:40:18 +0000] "GET /login HTTP/1.1" 404 3958
192.168.1.127 - - [27/Jul/2026:15:51:09 +0000] "GET /index.html HTTP/1.1" 200 4993
192.168.1.20 - - [27/Jul/2026:15:50:30 +0000] "GET / HTTP/1.1" 200 4975
198.51.100.23 - - [27/Jul/2026:16:26:33 +0000] "GET /download?file=../../../../etc/passwd HTTP/1.1" 403 300
192.168.1.87 - - [27/Jul/2026:16:01:22 +0000] "GET /login HTTP/1.1" 200 1161
192.168.1.9 - - [27/Jul/2026:15:37:53 +0000] "GET /products HTTP/1.1" 404 1634
192.168.1.195 - - [27/Jul/2026:15:45:25 +0000] "GET /login HTTP/1.1" 200 2762
192.168.1.159 - - [27/Jul/2026:16:26:32 +0000] "GET /index.html HTTP/1.1" 200 4109
192.168.1.194 - - [27/Jul/2026:16:19:40 +0000] "GET /api/users HTTP/1.1" 200 3442
45.155.205.7 - - [27/Jul/2026:16:24:15 +0000] "GET /wp-admin/652.php HTTP/1.1" 404 200
192.168.1.23 - - [27/Jul/2026:16:11:16 +0000] "GET /index.html HTTP/1.1" 404 1564
192.168.1.89 - - [27/Jul/2026:15:54:45 +0000] "GET /index.html HTTP/1.1" 200 1123
192.168.1.29 - - [27/Jul/2026:15:50:02 +0000] "GET /login HTTP/1.1" 200 4530
192.168.1.201 - - [27/Jul/2026:15:55:11 +0000] "GET /login HTTP/1.1" 200 1960
192.168.1.94 - - [27/Jul/2026:16:15:36 +0000] "GET / HTTP/1.1" 404 2283
45.155.205.7 - - [27/Jul/2026:16:23:29 +0000] "GET /wp-admin/651.php HTTP/1.1" 404 200
192.168.1.51 - - [27/Jul/2026:15:53:01 +0000] "GET /index.html HTTP/1.1" 404 4064
192.168.1.138 - - [27/Jul/2026:16:07:28 +0000] "GET /login HTTP/1.1" 200 4163
192.168.1.82 - - [27/Jul/2026:16:23:44 +0000] "GET /api/users HTTP/1.1" 200 2432
192.168.1.59 - - [27/Jul/2026:16:05:04 +0000] "GET /index.html HTTP/1.1" 200 4208
192.168.1.92 - - [27/Jul/2026:15:42:06 +0000] "GET /products HTTP/1.1" 404 4062
192.168.1.103 - - [27/Jul/2026:15:55:09 +0000] "GET /products HTTP/1.1" 200 767
45.155.205.7 - - [27/Jul/2026:16:28:37 +0000] "GET /wp-admin/274.php HTTP/1.1" 404 200
192.168.1.63 - - [27/Jul/2026:15:57:02 +0000] "GET /login HTTP/1.1" 304 3971
192.168.1.98 - - [27/Jul/2026:16:33:06 +0000] "GET /api/users HTTP/1.1" 200 4941
192.168.1.231 - - [27/Jul/2026:16:27:06 +0000] "GET /products HTTP/1.1" 200 4876
192.168.1.79 - - [27/Jul/2026:16:05:08 +0000] "GET /about HTTP/1.1" 200 1276
198.51.100.23 - - [27/Jul/2026:16:32:15 +0000] "GET /download?file=../../../../etc/passwd HTTP/1.1" 403 300
45.155.205.7 - - [27/Jul/2026:16:23:29 +0000] "GET /wp-admin/238.php HTTP/1.1" 404 200
192.168.1.12 - - [27/Jul/2026:15:39:55 +0000] "GET /products HTTP/1.1" 200 1793
192.168.1.205 - - [27/Jul/2026:16:01:55 +0000] "GET /about HTTP/1.1" 200 4598
192.168.1.38 - - [27/Jul/2026:16:02:49 +0000] "GET /products HTTP/1.1" 304 4517
192.168.1.226 - - [27/Jul/2026:16:21:36 +0000] "GET /about HTTP/1.1" 200 792
192.168.1.203 - - [27/Jul/2026:16:03:56 +0000] "GET /api/users HTTP/1.1" 304 3811
192.168.1.86 - - [27/Jul/2026:16:06:17 +0000] "GET /index.html HTTP/1.1" 200 4613
192.168.1.232 - - [27/Jul/2026:16:18:26 +0000] "GET /api/users HTTP/1.1" 200 2426
45.155.205.7 - - [27/Jul/2026:16:28:45 +0000] "GET /wp-admin/222.php HTTP/1.1" 404 200
192.168.1.116 - - [27/Jul/2026:16:19:25 +0000] "GET /login HTTP/1.1" 200 484
192.168.1.193 - - [27/Jul/2026:15:45:42 +0000] "GET /products HTTP/1.1" 200 520
192.168.1.60 - - [27/Jul/2026:16:10:37 +0000] "GET /index.html HTTP/1.1" 200 1572
192.168.1.223 - - [27/Jul/2026:15:52:19 +0000] "GET /index.html HTTP/1.1" 304 3603
192.168.1.167 - - [27/Jul/2026:16:01:39 +0000] "GET /products HTTP/1.1" 304 3301
192.168.1.83 - - [27/Jul/2026:15:40:21 +0000] "GET /login HTTP/1.1" 200 3436
192.168.1.25 - - [27/Jul/2026:16:06:31 +0000] "GET /about HTTP/1.1" 200 3500
192.168.1.194 - - [27/Jul/2026:16:26:05 +0000] "GET /login HTTP/1.1" 200 1630
192.168.1.94 - - [27/Jul/2026:15:54:52 +0000] "GET /products HTTP/1.1" 200 2040
192.168.1.65 - - [27/Jul/2026:16:18:14 +0000] "GET /api/users HTTP/1.1" 200 3547
192.168.1.206 - - [27/Jul/2026:15:37:04 +0000] "GET /about HTTP/1.1" 304 2373
192.168.1.30 - - [27/Jul/2026:16:10:49 +0000] "GET /products HTTP/1.1" 200 4965
192.168.1.181 - - [27/Jul/2026:16:04:38 +0000] "GET /about HTTP/1.1" 200 1481
192.168.1.58 - - [27/Jul/2026:16:29:46 +0000] "GET /index.html HTTP/1.1" 404 538
192.168.1.55 - - [27/Jul/2026:15:34:31 +0000] "GET / HTTP/1.1" 200 3614
192.168.1.231 - - [27/Jul/2026:16:06:29 +0000] "GET / HTTP/1.1" 304 2156
192.168.1.4 - - [27/Jul/2026:16:06:26 +0000] "GET /login HTTP/1.1" 404 1149
45.155.205.7 - - [27/Jul/2026:16:26:37 +0000] "GET /wp-admin/625.php HTTP/1.1" 404 200
192.168.1.83 - - [27/Jul/2026:15:58:20 +0000] "GET /about HTTP/1.1" 200 4172
45.155.205.7 - - [27/Jul/2026:16:25:51 +0000] "GET /wp-admin/729.php HTTP/1.1" 404 200
192.168.1.79 - - [27/Jul/2026:16:18:02 +0000] "GET /about HTTP/1.1" 200 4754
203.0.113.45 - - [27/Jul/2026:16:29:53 +0000] "GET /login?id=1' UNION SELECT username,password FROM users-- HTTP/1.1" 500 512
192.168.1.115 - - [27/Jul/2026:16:07:46 +0000] "GET /products HTTP/1.1" 200 4554
192.168.1.137 - - [27/Jul/2026:16:04:37 +0000] "GET /products HTTP/1.1" 404 1957
192.168.1.88 - - [27/Jul/2026:16:32:57 +0000] "GET /index.html HTTP/1.1" 200 4414
192.168.1.13 - - [27/Jul/2026:16:17:59 +0000] "GET /login HTTP/1.1" 200 4693
192.168.1.189 - - [27/Jul/2026:15:54:42 +0000] "GET /index.html HTTP/1.1" 200 2467
192.168.1.131 - - [27/Jul/2026:15:41:26 +0000] "GET /api/users HTTP/1.1" 200 3749
45.155.205.7 - - [27/Jul/2026:16:25:23 +0000] "GET /wp-admin/680.php HTTP/1.1" 404 200
192.168.1.180 - - [27/Jul/2026:16:29:02 +0000] "GET / HTTP/1.1" 304 3928
192.168.1.203 - - [27/Jul/2026:16:10:46 +0000] "GET / HTTP/1.1" 304 2374
192.168.1.250 - - [27/Jul/2026:16:07:10 +0000] "GET /api/users HTTP/1.1" 200 4670
192.168.1.12 - - [27/Jul/2026:15:54:51 +0000] "GET /about HTTP/1.1" 200 4593
192.168.1.234 - - [27/Jul/2026:15:47:34 +0000] "GET /products HTTP/1.1" 200 2188
192.168.1.62 - - [27/Jul/2026:16:21:20 +0000] "GET / HTTP/1.1" 404 4369
192.168.1.201 - - [27/Jul/2026:15:51:44 +0000] "GET /login HTTP/1.1" 200 1314
192.168.1.160 - - [27/Jul/2026:15:41:09 +0000] "GET /login HTTP/1.1" 404 670
192.168.1.45 - - [27/Jul/2026:16:17:45 +0000] "GET /about HTTP/1.1" 304 2943
192.168.1.193 - - [27/Jul/2026:15:51:55 +0000] "GET /about HTTP/1.1" 304 205
192.168.1.191 - - [27/Jul/2026:15:55:18 +0000] "GET / HTTP/1.1" 404 1783
192.168.1.17 - - [27/Jul/2026:15:33:21 +0000] "GET /login HTTP/1.1" 304 4829
45.155.205.7 - - [27/Jul/2026:16:23:48 +0000] "GET /wp-admin/466.php HTTP/1.1" 404 200
192.168.1.45 - - [27/Jul/2026:16:31:29 +0000] "GET /index.html HTTP/1.1" 304 1255
192.168.1.228 - - [27/Jul/2026:15:56:05 +0000] "GET / HTTP/1.1" 200 2824
192.168.1.207 - - [27/Jul/2026:16:30:14 +0000] "GET /login HTTP/1.1" 200 2601
198.51.100.23 - - [27/Jul/2026:16:24:03 +0000] "GET /view?page=..%2f..%2f..%2fetc%2fpasswd HTTP/1.1" 403 300
192.168.1.117 - - [27/Jul/2026:16:09:27 +0000] "GET /index.html HTTP/1.1" 200 4979
192.168.1.162 - - [27/Jul/2026:15:55:30 +0000] "GET /products HTTP/1.1" 404 3190
192.168.1.161 - - [27/Jul/2026:15:34:12 +0000] "GET /login HTTP/1.1" 200 3564
192.168.1.47 - - [27/Jul/2026:15:44:32 +0000] "GET /api/users HTTP/1.1" 404 3790
192.168.1.164 - - [27/Jul/2026:16:01:21 +0000] "GET /index.html HTTP/1.1" 200 2736
192.168.1.126 - - [27/Jul/2026:15:52:13 +0000] "GET /api/users HTTP/1.1" 200 2932
192.168.1.241 - - [27/Jul/2026:15:47:13 +0000] "GET /products HTTP/1.1" 200 2203
192.168.1.151 - - [27/Jul/2026:15:58:26 +0000] "GET /about HTTP/1.1" 200 314
45.155.205.7 - - [27/Jul/2026:16:23:25 +0000] "GET /wp-admin/24.php HTTP/1.1" 404 200
192.168.1.220 - - [27/Jul/2026:15:42:01 +0000] "GET /products HTTP/1.1" 200 2071
192.168.1.199 - - [27/Jul/2026:16:22:27 +0000] "GET /index.html HTTP/1.1" 200 4136
203.0.113.45 - - [27/Jul/2026:16:25:23 +0000] "GET /login?id=1' UNION SELECT username,password FROM users-- HTTP/1.1" 500 512
45.155.205.7 - - [27/Jul/2026:16:32:30 +0000] "GET /wp-admin/554.php HTTP/1.1" 404 200
192.168.1.191 - - [27/Jul/2026:15:59:48 +0000] "GET /about HTTP/1.1" 200 2080
192.168.1.187 - - [27/Jul/2026:16:05:07 +0000] "GET /api/users HTTP/1.1" 200 1080
192.168.1.16 - - [27/Jul/2026:16:26:27 +0000] "GET /products HTTP/1.1" 304 2936
192.168.1.201 - - [27/Jul/2026:16:10:03 +0000] "GET /products HTTP/1.1" 200 4354
192.168.1.23 - - [27/Jul/2026:16:08:03 +0000] "GET /products HTTP/1.1" 200 4631
45.155.205.7 - - [27/Jul/2026:16:31:52 +0000] "GET /wp-admin/674.php HTTP/1.1" 404 200
192.168.1.161 - - [27/Jul/2026:16:29:00 +0000] "GET /products HTTP/1.1" 200 349
192.168.1.62 - - [27/Jul/2026:16:07:00 +0000] "GET / HTTP/1.1" 404 694
192.168.1.192 - - [27/Jul/2026:16:19:24 +0000] "GET /api/users HTTP/1.1" 404 1765
192.168.1.91 - - [27/Jul/2026:15:50:24 +0000] "GET /api/users HTTP/1.1" 200 4240
192.168.1.108 - - [27/Jul/2026:16:03:46 +0000] "GET /login HTTP/1.1" 200 1078
192.168.1.111 - - [27/Jul/2026:15:56:41 +0000] "GET /login HTTP/1.1" 200 1558
192.168.1.212 - - [27/Jul/2026:15:34:56 +0000] "GET /index.html HTTP/1.1" 200 4258
192.168.1.17 - - [27/Jul/2026:16:06:43 +0000] "GET /about HTTP/1.1" 404 3140
203.0.113.45 - - [27/Jul/2026:16:30:08 +0000] "GET /login?id=1' UNION SELECT username,password FROM users-- HTTP/1.1" 500 512
192.168.1.249 - - [27/Jul/2026:16:26:45 +0000] "GET /about HTTP/1.1" 200 368
192.168.1.171 - - [27/Jul/2026:16:13:17 +0000] "GET /login HTTP/1.1" 200 3660
192.168.1.187 - - [27/Jul/2026:15:40:48 +0000] "GET /products HTTP/1.1" 200 340
192.168.1.102 - - [27/Jul/2026:15:43:53 +0000] "GET /about HTTP/1.1" 404 238
192.168.1.206 - - [27/Jul/2026:15:47:28 +0000] "GET /about HTTP/1.1" 304 3511
45.155.205.7 - - [27/Jul/2026:16:29:11 +0000] "GET /wp-admin/916.php HTTP/1.1" 404 200
192.168.1.172 - - [27/Jul/2026:16:09:25 +0000] "GET /products HTTP/1.1" 404 4053
192.168.1.118 - - [27/Jul/2026:15:33:27 +0000] "GET /index.html HTTP/1.1" 200 2108
192.168.1.117 - - [27/Jul/2026:15:34:27 +0000] "GET /api/users HTTP/1.1" 404 2850
192.168.1.225 - - [27/Jul/2026:15:58:35 +0000] "GET /index.html HTTP/1.1" 304 2405
192.168.1.152 - - [27/Jul/2026:15:50:33 +0000] "GET /products HTTP/1.1" 200 3407
192.168.1.41 - - [27/Jul/2026:15:35:35 +0000] "GET /login HTTP/1.1" 200 449
192.168.1.110 - - [27/Jul/2026:16:26:25 +0000] "GET /about HTTP/1.1" 404 3710
45.155.205.7 - - [27/Jul/2026:16:25:40 +0000] "GET /wp-admin/202.php HTTP/1.1" 404 200
198.51.100.23 - - [27/Jul/2026:16:30:42 +0000] "GET /view?page=..%2f..%2f..%2fetc%2fpasswd HTTP/1.1" 403 300
192.168.1.178 - - [27/Jul/2026:16:15:04 +0000] "GET /products HTTP/1.1" 200 600
192.168.1.72 - - [27/Jul/2026:16:07:21 +0000] "GET / HTTP/1.1" 200 3809
203.0.113.45 - - [27/Jul/2026:16:30:18 +0000] "GET /search?q=SELECT * FROM accounts HTTP/1.1" 500 512
192.168.1.77 - - [27/Jul/2026:16:17:12 +0000] "GET /index.html HTTP/1.1" 200 3067
192.168.1.12 - - [27/Jul/2026:16:29:00 +0000] "GET /index.html HTTP/1.1" 200 3854
192.168.1.141 - - [27/Jul/2026:16:29:42 +0000] "GET /index.html HTTP/1.1" 404 463
192.168.1.57 - - [27/Jul/2026:15:38:44 +0000] "GET / HTTP/1.1" 200 4651
192.168.1.136 - - [27/Jul/2026:15:33:35 +0000] "GET /api/users HTTP/1.1" 200 4432
192.168.1.37 - - [27/Jul/2026:16:15:19 +0000] "GET /index.html HTTP/1.1" 200 4847
45.155.205.7 - - [27/Jul/2026:16:31:15 +0000] "GET /wp-admin/718.php HTTP/1.1" 404 200
192.168.1.223 - - [27/Jul/2026:16:28:45 +0000] "GET /api/users HTTP/1.1" 200 4447
192.168.1.89 - - [27/Jul/2026:16:09:42 +0000] "GET /index.html HTTP/1.1" 200 675
192.168.1.31 - - [27/Jul/2026:16:27:00 +0000] "GET /products HTTP/1.1" 200 4619
192.168.1.102 - - [27/Jul/2026:16:27:01 +0000] "GET / HTTP/1.1" 200 4059
192.168.1.220 - - [27/Jul/2026:16:14:34 +0000] "GET /products HTTP/1.1" 304 2795
192.168.1.242 - - [27/Jul/2026:15:46:49 +0000] "GET /products HTTP/1.1" 200 1089
192.168.1.207 - - [27/Jul/2026:15:59:57 +0000] "GET /api/users HTTP/1.1" 304 2734
192.168.1.19 - - [27/Jul/2026:16:03:18 +0000] "GET /index.html HTTP/1.1" 200 2757
192.168.1.15 - - [27/Jul/2026:15:52:29 +0000] "GET /about HTTP/1.1" 200 528
192.168.1.189 - - [27/Jul/2026:15:37:30 +0000] "GET /index.html HTTP/1.1" 200 4266
192.168.1.76 - - [27/Jul/2026:16:31:22 +0000] "GET /index.html HTTP/1.1" 304 3697
192.168.1.150 - - [27/Jul/2026:15:50:13 +0000] "GET /index.html HTTP/1.1" 200 943
192.168.1.103 - - [27/Jul/2026:15:49:52 +0000] "GET /products HTTP/1.1" 200 2901
192.168.1.47 - - [27/Jul/2026:16:08:54 +0000] "GET /products HTTP/1.1" 200 3821
192.168.1.165 - - [27/Jul/2026:15:42:49 +0000] "GET /products HTTP/1.1" 200 2975
192.168.1.12 - - [27/Jul/2026:15:51:55 +0000] "GET /about HTTP/1.1" 200 1495
192.168.1.78 - - [27/Jul/2026:15:46:47 +0000] "GET /api/users HTTP/1.1" 404 1264
45.155.205.7 - - [27/Jul/2026:16:23:44 +0000] "GET /wp-admin/401.php HTTP/1.1" 404 200
45.155.205.7 - - [27/Jul/2026:16:25:21 +0000] "GET /wp-admin/348.php HTTP/1.1" 404 200
192.168.1.166 - - [27/Jul/2026:16:26:21 +0000] "GET /index.html HTTP/1.1" 404 2005
192.168.1.151 - - [27/Jul/2026:16:18:57 +0000] "GET /about HTTP/1.1" 200 2291
192.168.1.197 - - [27/Jul/2026:15:57:05 +0000] "GET /api/users HTTP/1.1" 404 3742
198.51.100.23 - - [27/Jul/2026:16:32:33 +0000] "GET /view?page=..%2f..%2f..%2fetc%2fpasswd HTTP/1.1" 403 300
192.168.1.52 - - [27/Jul/2026:15:33:21 +0000] "GET /api/users HTTP/1.1" 200 1970
192.168.1.131 - - [27/Jul/2026:16:24:41 +0000] "GET / HTTP/1.1" 200 2387
192.168.1.71 - - [27/Jul/2026:16:28:58 +0000] "GET /about HTTP/1.1" 304 1029
192.168.1.181 - - [27/Jul/2026:16:25:06 +0000] "GET /api/users HTTP/1.1" 200 2641
192.168.1.181 - - [27/Jul/2026:16:19:52 +0000] "GET /about HTTP/1.1" 404 2959
192.168.1.4 - - [27/Jul/2026:15:50:47 +0000] "GET /login HTTP/1.1" 200 234
192.168.1.235 - - [27/Jul/2026:15:38:32 +0000] "GET / HTTP/1.1" 200 1932
192.168.1.117 - - [27/Jul/2026:16:05:46 +0000] "GET / HTTP/1.1" 200 354
192.168.1.202 - - [27/Jul/2026:16:18:38 +0000] "GET /login HTTP/1.1" 200 3548
192.168.1.139 - - [27/Jul/2026:15:54:50 +0000] "GET /products HTTP/1.1" 200 954
192.168.1.70 - - [27/Jul/2026:15:37:09 +0000] "GET / HTTP/1.1" 200 1801
192.168.1.201 - - [27/Jul/2026:15:41:59 +0000] "GET /about HTTP/1.1" 200 2234
192.168.1.198 - - [27/Jul/2026:15:35:45 +0000] "GET / HTTP/1.1" 200 290
192.168.1.175 - - [27/Jul/2026:15:48:30 +0000] "GET /about HTTP/1.1" 404 538
192.168.1.163 - - [27/Jul/2026:16:13:36 +0000] "GET /api/users HTTP/1.1" 404 2355
192.168.1.133 - - [27/Jul/2026:16:09:59 +0000] "GET /api/users HTTP/1.1" 200 2211
192.168.1.79 - - [27/Jul/2026:16:00:39 +0000] "GET /about HTTP/1.1" 200 3603
45.155.205.7 - - [27/Jul/2026:16:27:26 +0000] "GET /wp-admin/679.php HTTP/1.1" 404 200
45.155.205.7 - - [27/Jul/2026:16:32:07 +0000] "GET /wp-admin/130.php HTTP/1.1" 404 200
192.168.1.105 - - [27/Jul/2026:15:49:36 +0000] "GET /login HTTP/1.1" 200 1052
192.168.1.84 - - [27/Jul/2026:15:38:10 +0000] "GET / HTTP/1.1" 404 3798
192.168.1.42 - - [27/Jul/2026:16:23:14 +0000] "GET /api/users HTTP/1.1" 200 3742
192.168.1.138 - - [27/Jul/2026:16:29:30 +0000] "GET /login HTTP/1.1" 200 2907
192.168.1.82 - - [27/Jul/2026:16:10:37 +0000] "GET /about HTTP/1.1" 404 4025
192.168.1.188 - - [27/Jul/2026:16:32:12 +0000] "GET /index.html HTTP/1.1" 200 452
192.168.1.216 - - [27/Jul/2026:15:37:12 +0000] "GET /index.html HTTP/1.1" 200 3957
192.168.1.230 - - [27/Jul/2026:15:39:16 +0000] "GET /about HTTP/1.1" 200 1616
45.155.205.7 - - [27/Jul/2026:16:26:22 +0000] "GET /wp-admin/612.php HTTP/1.1" 404 200
192.168.1.210 - - [27/Jul/2026:16:02:26 +0000] "GET / HTTP/1.1" 200 4939
192.168.1.158 - - [27/Jul/2026:15:45:16 +0000] "GET /about HTTP/1.1" 200 3150
45.155.205.7 - - [27/Jul/2026:16:32:08 +0000] "GET /wp-admin/332.php HTTP/1.1" 404 200
192.168.1.191 - - [27/Jul/2026:15:35:02 +0000] "GET /api/users HTTP/1.1" 304 4968
192.168.1.105 - - [27/Jul/2026:16:10:11 +0000] "GET /about HTTP/1.1" 304 1988
192.168.1.212 - - [27/Jul/2026:16:04:10 +0000] "GET /login HTTP/1.1" 304 1650
192.168.1.25 - - [27/Jul/2026:16:20:20 +0000] "GET /index.html HTTP/1.1" 200 1767
192.168.1.11 - - [27/Jul/2026:15:56:50 +0000] "GET /about HTTP/1.1" 304 1536
192.168.1.247 - - [27/Jul/2026:16:22:42 +0000] "GET /index.html HTTP/1.1" 200 3316
192.168.1.73 - - [27/Jul/2026:16:04:11 +0000] "GET /index.html HTTP/1.1" 200 4471
192.168.1.123 - - [27/Jul/2026:16:30:40 +0000] "GET /index.html HTTP/1.1" 200 2787
192.168.1.129 - - [27/Jul/2026:16:23:20 +0000] "GET /about HTTP/1.1" 304 3934
192.168.1.119 - - [27/Jul/2026:16:13:09 +0000] "GET /index.html HTTP/1.1" 200 3198
192.168.1.131 - - [27/Jul/2026:16:29:45 +0000] "GET /api/users HTTP/1.1" 200 704
192.168.1.46 - - [27/Jul/2026:15:49:40 +0000] "GET /index.html HTTP/1.1" 200 3287
192.168.1.134 - - [27/Jul/2026:16:19:27 +0000] "GET /products HTTP/1.1" 404 604
192.168.1.153 - - [27/Jul/2026:15:57:55 +0000] "GET /about HTTP/1.1" 200 315
192.168.1.170 - - [27/Jul/2026:15:42:39 +0000] "GET /api/users HTTP/1.1" 200 2979
192.168.1.71 - - [27/Jul/2026:16:24:07 +0000] "GET / HTTP/1.1" 304 2928
192.168.1.59 - - [27/Jul/2026:15:46:45 +0000] "GET / HTTP/1.1" 200 4167
192.168.1.109 - - [27/Jul/2026:16:18:31 +0000] "GET /api/users HTTP/1.1" 304 2830
192.168.1.204 - - [27/Jul/2026:15:40:16 +0000] "GET / HTTP/1.1" 200 3575
192.168.1.93 - - [27/Jul/2026:16:18:45 +0000] "GET /index.html HTTP/1.1" 200 1464
192.168.1.219 - - [27/Jul/2026:15:38:25 +0000] "GET /login HTTP/1.1" 304 3105
192.168.1.130 - - [27/Jul/2026:15:36:39 +0000] "GET / HTTP/1.1" 404 3810
192.168.1.238 - - [27/Jul/2026:15:38:16 +0000] "GET /api/users HTTP/1.1" 200 392
192.168.1.228 - - [27/Jul/2026:16:26:13 +0000] "GET /api/users HTTP/1.1" 200 300
192.168.1.29 - - [27/Jul/2026:16:15:29 +0000] "GET /api/users HTTP/1.1" 200 1568
192.168.1.76 - - [27/Jul/2026:15:33:10 +0000] "GET /about HTTP/1.1" 404 2582
192.168.1.125 - - [27/Jul/2026:15:49:37 +0000] "GET /login HTTP/1.1" 304 2990
45.155.205.7 - - [27/Jul/2026:16:23:31 +0000] "GET /wp-admin/478.php HTTP/1.1" 404 200
192.168.1.10 - - [27/Jul/2026:15:51:07 +0000] "GET /index.html HTTP/1.1" 200 611
203.0.113.45 - - [27/Jul/2026:16:27:08 +0000] "GET /products?id=1 OR 1=1 HTTP/1.1" 500 512
192.168.1.102 - - [27/Jul/2026:16:16:45 +0000] "GET / HTTP/1.1" 404 2937
192.168.1.112 - - [27/Jul/2026:16:21:47 +0000] "GET /products HTTP/1.1" 200 677
192.168.1.249 - - [27/Jul/2026:15:51:48 +0000] "GET /api/users HTTP/1.1" 200 4230
192.168.1.47 - - [27/Jul/2026:15:48:40 +0000] "GET / HTTP/1.1" 200 2316
192.168.1.57 - - [27/Jul/2026:16:07:48 +0000] "GET /login HTTP/1.1" 404 3876
192.168.1.33 - - [27/Jul/2026:16:08:58 +0000] "GET /login HTTP/1.1" 200 4859
192.168.1.102 - - [27/Jul/2026:16:14:16 +0000] "GET /api/users HTTP/1.1" 304 1831
192.168.1.194 - - [27/Jul/2026:15:48:42 +0000] "GET /index.html HTTP/1.1" 200 3063
192.168.1.119 - - [27/Jul/2026:15:46:34 +0000] "GET /about HTTP/1.1" 304 3915
192.168.1.168 - - [27/Jul/2026:15:48:47 +0000] "GET /api/users HTTP/1.1" 200 1402
192.168.1.240 - - [27/Jul/2026:15:53:51 +0000] "GET /api/users HTTP/1.1" 404 1454
192.168.1.107 - - [27/Jul/2026:16:03:57 +0000] "GET /login HTTP/1.1" 200 4713
192.168.1.229 - - [27/Jul/2026:15:47:47 +0000] "GET /login HTTP/1.1" 200 1255
192.168.1.133 - - [27/Jul/2026:16:00:45 +0000] "GET /api/users HTTP/1.1" 200 2459
45.155.205.7 - - [27/Jul/2026:16:29:22 +0000] "GET /wp-admin/868.php HTTP/1.1" 404 200
192.168.1.14 - - [27/Jul/2026:16:04:57 +0000] "GET /api/users HTTP/1.1" 200 1857
192.168.1.194 - - [27/Jul/2026:15:45:24 +0000] "GET /api/users HTTP/1.1" 304 2551
45.155.205.7 - - [27/Jul/2026:16:31:57 +0000] "GET /wp-admin/176.php HTTP/1.1" 404 200
192.168.1.127 - - [27/Jul/2026:16:26:52 +0000] "GET /login HTTP/1.1" 404 1661
192.168.1.48 - - [27/Jul/2026:16:01:43 +0000] "GET /products HTTP/1.1" 200 1821
192.168.1.185 - - [27/Jul/2026:15:37:09 +0000] "GET /products HTTP/1.1" 200 3352
192.168.1.100 - - [27/Jul/2026:15:54:11 +0000] "GET / HTTP/1.1" 200 829
192.168.1.43 - - [27/Jul/2026:15:53:27 +0000] "GET /about HTTP/1.1" 200 3668
192.168.1.2 - - [27/Jul/2026:16:21:37 +0000] "GET /index.html HTTP/1.1" 304 4685
192.168.1.10 - - [27/Jul/2026:16:24:20 +0000] "GET /api/users HTTP/1.1" 200 2700
192.168.1.4 - - [27/Jul/2026:16:19:04 +0000] "GET / HTTP/1.1" 200 377
192.168.1.134 - - [27/Jul/2026:16:10:17 +0000] "GET / HTTP/1.1" 404 3471
192.168.1.53 - - [27/Jul/2026:16:29:53 +0000] "GET /api/users HTTP/1.1" 304 1184
192.168.1.33 - - [27/Jul/2026:15:33:58 +0000] "GET /api/users HTTP/1.1" 304 1380
192.168.1.235 - - [27/Jul/2026:16:09:09 +0000] "GET / HTTP/1.1" 200 2162
192.168.1.51 - - [27/Jul/2026:15:43:22 +0000] "GET / HTTP/1.1" 404 1806
45.155.205.7 - - [27/Jul/2026:16:31:29 +0000] "GET /wp-admin/189.php HTTP/1.1" 404 200
192.168.1.221 - - [27/Jul/2026:16:03:03 +0000] "GET / HTTP/1.1" 404 4055
45.155.205.7 - - [27/Jul/2026:16:23:30 +0000] "GET /wp-admin/335.php HTTP/1.1" 404 200
192.168.1.53 - - [27/Jul/2026:15:45:41 +0000] "GET /index.html HTTP/1.1" 200 4514
192.168.1.101 - - [27/Jul/2026:15:34:53 +0000] "GET /api/users HTTP/1.1" 404 3070
198.51.100.23 - - [27/Jul/2026:16:30:48 +0000] "GET /download?file=../../../../etc/passwd HTTP/1.1" 403 300
192.168.1.244 - - [27/Jul/2026:16:24:50 +0000] "GET /index.html HTTP/1.1" 200 2261
192.168.1.180 - - [27/Jul/2026:16:32:35 +0000] "GET /index.html HTTP/1.1" 200 2223
192.168.1.56 - - [27/Jul/2026:15:39:52 +0000] "GET /index.html HTTP/1.1" 200 4911
45.155.205.7 - - [27/Jul/2026:16:29:13 +0000] "GET /wp-admin/339.php HTTP/1.1" 404 200
192.168.1.152 - - [27/Jul/2026:15:44:07 +0000] "GET /login HTTP/1.1" 304 3569
192.168.1.106 - - [27/Jul/2026:15:50:29 +0000] "GET /index.html HTTP/1.1" 304 3255
192.168.1.116 - - [27/Jul/2026:16:32:09 +0000] "GET /products HTTP/1.1" 200 2001
192.168.1.35 - - [27/Jul/2026:16:05:42 +0000] "GET /login HTTP/1.1" 404 1478
192.168.1.165 - - [27/Jul/2026:16:20:04 +0000] "GET /index.html HTTP/1.1" 200 3331
45.155.205.7 - - [27/Jul/2026:16:29:47 +0000] "GET /wp-admin/990.php HTTP/1.1" 404 200
192.168.1.134 - - [27/Jul/2026:16:13:47 +0000] "GET /api/users HTTP/1.1" 200 3898
192.168.1.200 - - [27/Jul/2026:15:52:33 +0000] "GET / HTTP/1.1" 304 587
192.168.1.177 - - [27/Jul/2026:15:50:47 +0000] "GET /about HTTP/1.1" 404 2572
192.168.1.120 - - [27/Jul/2026:15:55:34 +0000] "GET /api/users HTTP/1.1" 200 3979
203.0.113.45 - - [27/Jul/2026:16:26:12 +0000] "GET /search?q=SELECT * FROM accounts HTTP/1.1" 500 512
192.168.1.12 - - [27/Jul/2026:15:47:33 +0000] "GET /index.html HTTP/1.1" 404 3465
192.168.1.26 - - [27/Jul/2026:16:23:15 +0000] "GET / HTTP/1.1" 200 3811
192.168.1.32 - - [27/Jul/2026:15:52:18 +0000] "GET / HTTP/1.1" 304 894
192.168.1.246 - - [27/Jul/2026:16:22:32 +0000] "GET /api/users HTTP/1.1" 404 2709
192.168.1.147 - - [27/Jul/2026:15:37:43 +0000] "GET /products HTTP/1.1" 200 4652
192.168.1.211 - - [27/Jul/2026:16:11:50 +0000] "GET /about HTTP/1.1" 404 4623
45.155.205.7 - - [27/Jul/2026:16:23:55 +0000] "GET /wp-admin/253.php HTTP/1.1" 404 200
192.168.1.56 - - [27/Jul/2026:16:19:46 +0000] "GET / HTTP/1.1" 200 2965
192.168.1.38 - - [27/Jul/2026:16:29:34 +0000] "GET /products HTTP/1.1" 200 2947
192.168.1.168 - - [27/Jul/2026:16:25:07 +0000] "GET /login HTTP/1.1" 200 3966
192.168.1.17 - - [27/Jul/2026:16:15:10 +0000] "GET /login HTTP/1.1" 200 4692
192.168.1.84 - - [27/Jul/2026:16:29:17 +0000] "GET /about HTTP/1.1" 304 4771
192.168.1.228 - - [27/Jul/2026:15:43:57 +0000] "GET /index.html HTTP/1.1" 404 862
45.155.205.7 - - [27/Jul/2026:16:29:47 +0000] "GET /wp-admin/557.php HTTP/1.1" 404 200
192.168.1.202 - - [27/Jul/2026:15:36:05 +0000] "GET /login HTTP/1.1" 200 4410
192.168.1.244 - - [27/Jul/2026:16:23:27 +0000] "GET /login HTTP/1.1" 304 4208
192.168.1.103 - - [27/Jul/2026:16:25:05 +0000] "GET /api/users HTTP/1.1" 404 3744
192.168.1.48 - - [27/Jul/2026:15:48:03 +0000] "GET /products HTTP/1.1" 304 3074
192.168.1.155 - - [27/Jul/2026:16:05:52 +0000] "GET /login HTTP/1.1" 200 1548
192.168.1.151 - - [27/Jul/2026:16:27:47 +0000] "GET / HTTP/1.1" 404 3321
192.168.1.38 - - [27/Jul/2026:16:28:15 +0000] "GET /login HTTP/1.1" 404 1797
192.168.1.224 - - [27/Jul/2026:16:15:08 +0000] "GET /login HTTP/1.1" 200 3260
192.168.1.7 - - [27/Jul/2026:15:54:23 +0000] "GET /login HTTP/1.1" 200 4584
192.168.1.196 - - [27/Jul/2026:16:16:50 +0000] "GET /index.html HTTP/1.1" 200 3997
192.168.1.65 - - [27/Jul/2026:16:28:44 +0000] "GET /about HTTP/1.1" 304 1110
192.168.1.234 - - [27/Jul/2026:16:15:07 +0000] "GET / HTTP/1.1" 200 4756
192.168.1.199 - - [27/Jul/2026:15:45:52 +0000] "GET / HTTP/1.1" 304 3470
192.168.1.140 - - [27/Jul/2026:15:43:09 +0000] "GET /index.html HTTP/1.1" 200 4476
192.168.1.20 - - [27/Jul/2026:15:38:34 +0000] "GET /products HTTP/1.1" 200 1686
192.168.1.43 - - [27/Jul/2026:15:54:07 +0000] "GET /index.html HTTP/1.1" 304 4486
192.168.1.221 - - [27/Jul/2026:16:05:07 +0000] "GET /login HTTP/1.1" 200 817
192.168.1.105 - - [27/Jul/2026:16:10:37 +0000] "GET /api/users HTTP/1.1" 404 3423
192.168.1.85 - - [27/Jul/2026:15:49:14 +0000] "GET /login HTTP/1.1" 200 3876
192.168.1.166 - - [27/Jul/2026:16:13:01 +0000] "GET /products HTTP/1.1" 200 2653
192.168.1.128 - - [27/Jul/2026:15:45:26 +0000] "GET / HTTP/1.1" 200 2750
192.168.1.88 - - [27/Jul/2026:16:17:18 +0000] "GET /index.html HTTP/1.1" 200 1240
192.168.1.6 - - [27/Jul/2026:15:37:57 +0000] "GET /api/users HTTP/1.1" 304 1124
192.168.1.58 - - [27/Jul/2026:15:39:36 +0000] "GET /index.html HTTP/1.1" 200 4119
192.168.1.201 - - [27/Jul/2026:15:39:09 +0000] "GET /products HTTP/1.1" 200 1308
192.168.1.175 - - [27/Jul/2026:15:35:07 +0000] "GET /products HTTP/1.1" 200 1344
192.168.1.196 - - [27/Jul/2026:16:14:56 +0000] "GET /about HTTP/1.1" 200 2202
192.168.1.218 - - [27/Jul/2026:16:09:58 +0000] "GET /products HTTP/1.1" 200 500
192.168.1.50 - - [27/Jul/2026:15:57:38 +0000] "GET /products HTTP/1.1" 200 4677
192.168.1.239 - - [27/Jul/2026:15:40:16 +0000] "GET /products HTTP/1.1" 200 3416
192.168.1.109 - - [27/Jul/2026:16:27:41 +0000] "GET /about HTTP/1.1" 404 391
192.168.1.144 - - [27/Jul/2026:16:07:44 +0000] "GET /index.html HTTP/1.1" 200 4741
192.168.1.207 - - [27/Jul/2026:16:10:47 +0000] "GET /api/users HTTP/1.1" 304 2454

98
q4-siem-log-analysis/alerts.json Normal file
عرض الملف

@@ -0,0 +1,98 @@
{
"generated_at": "2026-07-27T16:33:08.411673",
"stats": {
"total_alerts": 9,
"by_source": {
"web": 7,
"auth": 1,
"firewall": 1
},
"by_severity": {
"high": 8,
"medium": 1
},
"unique_suspicious_ips": 3
},
"alerts": [
{
"source": "web",
"type": "Directory Traversal",
"ip": "198.51.100.23",
"detail": "/download?file=../../../../etc/passwd",
"severity": "high"
},
{
"source": "web",
"type": "Directory Traversal",
"ip": "198.51.100.23",
"detail": "/download?file=../../../../etc/passwd",
"severity": "high"
},
{
"source": "web",
"type": "Directory Traversal",
"ip": "198.51.100.23",
"detail": "/view?page=..%2f..%2f..%2fetc%2fpasswd",
"severity": "high"
},
{
"source": "web",
"type": "Directory Traversal",
"ip": "198.51.100.23",
"detail": "/view?page=..%2f..%2f..%2fetc%2fpasswd",
"severity": "high"
},
{
"source": "web",
"type": "Directory Traversal",
"ip": "198.51.100.23",
"detail": "/view?page=..%2f..%2f..%2fetc%2fpasswd",
"severity": "high"
},
{
"source": "web",
"type": "Directory Traversal",
"ip": "198.51.100.23",
"detail": "/download?file=../../../../etc/passwd",
"severity": "high"
},
{
"source": "auth",
"type": "Brute Force (SSH)",
"ip": "198.51.100.99",
"detail": "10 محاولة فاشلة",
"severity": "high"
},
{
"source": "firewall",
"type": "Port Scanning",
"ip": "45.155.205.7",
"detail": "محاولة الاتصال بـ 35 منفذ مختلف",
"severity": "high"
},
{
"source": "web",
"type": "Scanning/Fuzzing",
"ip": "45.155.205.7",
"detail": "40 طلب 404/403 من نفس المصدر",
"severity": "medium"
}
],
"suspicious_ips": [
{
"ip": "198.51.100.23",
"score": 18,
"alert_count": 6
},
{
"ip": "45.155.205.7",
"score": 5,
"alert_count": 2
},
{
"ip": "198.51.100.99",
"score": 3,
"alert_count": 1
}
]
}

31
q4-siem-log-analysis/auth.log Normal file
عرض الملف

@@ -0,0 +1,31 @@
Jul 27 16:31:18 server sshd[9992]: Failed password for root from 198.51.100.99 port 44442 ssh2
Jul 27 15:51:47 server sshd[1234]: Accepted password for admin from 192.168.1.42 port 55000 ssh2
Jul 27 16:31:08 server sshd[9990]: Failed password for root from 198.51.100.99 port 44440 ssh2
Jul 27 16:31:23 server sshd[9993]: Failed password for root from 198.51.100.99 port 44443 ssh2
Jul 27 16:32:08 server sshd[9999]: Accepted password for root from 198.51.100.99 port 44450 ssh2
Jul 27 15:50:35 server sshd[1234]: Accepted password for admin from 192.168.1.56 port 55000 ssh2
Jul 27 15:34:46 server sshd[1234]: Accepted password for admin from 192.168.1.34 port 55000 ssh2
Jul 27 16:17:58 server sshd[1234]: Accepted password for admin from 192.168.1.17 port 55000 ssh2
Jul 27 15:42:24 server sshd[1234]: Accepted password for admin from 192.168.1.171 port 55000 ssh2
Jul 27 16:23:21 server sshd[1234]: Accepted password for admin from 192.168.1.104 port 55000 ssh2
Jul 27 16:31:13 server sshd[9991]: Failed password for root from 198.51.100.99 port 44441 ssh2
Jul 27 16:12:07 server sshd[1234]: Accepted password for admin from 192.168.1.27 port 55000 ssh2
Jul 27 16:31:28 server sshd[9994]: Failed password for root from 198.51.100.99 port 44444 ssh2
Jul 27 15:47:44 server sshd[1234]: Accepted password for admin from 192.168.1.59 port 55000 ssh2
Jul 27 15:57:23 server sshd[1234]: Accepted password for admin from 192.168.1.56 port 55000 ssh2
Jul 27 16:20:48 server sshd[1234]: Accepted password for admin from 192.168.1.6 port 55000 ssh2
Jul 27 15:38:33 server sshd[1234]: Accepted password for admin from 192.168.1.113 port 55000 ssh2
Jul 27 16:31:38 server sshd[9996]: Failed password for root from 198.51.100.99 port 44446 ssh2
Jul 27 16:31:53 server sshd[9999]: Failed password for root from 198.51.100.99 port 44449 ssh2
Jul 27 16:31:48 server sshd[9998]: Failed password for root from 198.51.100.99 port 44448 ssh2
Jul 27 15:44:07 server sshd[1234]: Accepted password for admin from 192.168.1.25 port 55000 ssh2
Jul 27 15:35:32 server sshd[1234]: Accepted password for admin from 192.168.1.157 port 55000 ssh2
Jul 27 15:39:49 server sshd[1234]: Accepted password for admin from 192.168.1.33 port 55000 ssh2
Jul 27 15:54:56 server sshd[1234]: Accepted password for admin from 192.168.1.220 port 55000 ssh2
Jul 27 16:01:40 server sshd[1234]: Accepted password for admin from 192.168.1.2 port 55000 ssh2
Jul 27 16:19:47 server sshd[1234]: Accepted password for admin from 192.168.1.202 port 55000 ssh2
Jul 27 16:31:33 server sshd[9995]: Failed password for root from 198.51.100.99 port 44445 ssh2
Jul 27 16:13:24 server sshd[1234]: Accepted password for admin from 192.168.1.130 port 55000 ssh2
Jul 27 16:15:23 server sshd[1234]: Accepted password for admin from 192.168.1.17 port 55000 ssh2
Jul 27 16:32:40 server sshd[1234]: Accepted password for admin from 192.168.1.9 port 55000 ssh2
Jul 27 16:31:43 server sshd[9997]: Failed password for root from 198.51.100.99 port 44447 ssh2

214
q4-siem-log-analysis/dashboard.html Normal file
عرض الملف

@@ -0,0 +1,214 @@
<!DOCTYPE html>
<html lang="ar" dir="rtl">
<head>
<meta charset="UTF-8">
<title>SIEM Dashboard | لوحة المراقبة الأمنية</title>
<style>
:root{
--bg:#0b0f0d;
--panel:#101613;
--line:#1d2622;
--text:#d7e4dc;
--dim:#7b9384;
--amber:#f0b429;
--green:#3ddc84;
--red:#ff5c5c;
--crit:#ff2d55;
}
*{box-sizing:border-box;}
body{
margin:0; background:var(--bg); color:var(--text);
font-family:'IBM Plex Mono','Courier New',monospace;
font-size:14px;
}
header{
display:flex; justify-content:space-between; align-items:center;
padding:18px 28px; border-bottom:1px solid var(--line);
background:linear-gradient(180deg,#0d1310,#0b0f0d);
}
header h1{
margin:0; font-size:18px; letter-spacing:2px; font-weight:600;
color:var(--amber); text-transform:uppercase;
}
header h1 span{color:var(--dim); font-weight:400; font-size:12px; letter-spacing:1px;}
.status{display:flex; align-items:center; gap:8px; font-size:12px; color:var(--dim);}
.dot{width:8px; height:8px; border-radius:50%; background:var(--green); animation:pulse 1.6s infinite;}
@keyframes pulse{0%,100%{opacity:1;} 50%{opacity:.25;}}
.toolbar{
display:flex; gap:12px; align-items:center; padding:12px 28px;
border-bottom:1px solid var(--line); flex-wrap:wrap;
}
button, label.filebtn{
background:var(--panel); color:var(--text); border:1px solid var(--line);
padding:7px 14px; border-radius:3px; cursor:pointer; font-family:inherit; font-size:12px;
}
button:hover, label.filebtn:hover{border-color:var(--amber); color:var(--amber);}
#source-note{color:var(--dim); font-size:12px;}
main{padding:20px 28px;}
.cards{display:grid; grid-template-columns:repeat(auto-fit,minmax(160px,1fr)); gap:14px; margin-bottom:22px;}
.card{
background:var(--panel); border:1px solid var(--line); border-radius:4px;
padding:14px 16px;
}
.card .label{color:var(--dim); font-size:11px; text-transform:uppercase; letter-spacing:1px;}
.card .value{font-size:28px; font-weight:700; margin-top:6px;}
.card.high .value{color:var(--red);}
.card.crit .value{color:var(--crit);}
.card.ips .value{color:var(--amber);}
.card.ok .value{color:var(--green);}
.grid2{display:grid; grid-template-columns:1.4fr 1fr; gap:18px;}
@media (max-width:900px){.grid2{grid-template-columns:1fr;}}
.panel{background:var(--panel); border:1px solid var(--line); border-radius:4px; overflow:hidden;}
.panel h2{
margin:0; padding:12px 16px; font-size:12px; letter-spacing:1px;
text-transform:uppercase; color:var(--dim); border-bottom:1px solid var(--line);
}
table{width:100%; border-collapse:collapse; font-size:12.5px;}
th,td{padding:9px 14px; text-align:right; border-bottom:1px solid var(--line);}
th{color:var(--dim); font-weight:500; font-size:11px; text-transform:uppercase;}
tr:hover td{background:#131a16;}
.sev{padding:2px 8px; border-radius:10px; font-size:10.5px; font-weight:700; letter-spacing:.5px;}
.sev.critical{background:rgba(255,45,85,.15); color:var(--crit);}
.sev.high{background:rgba(255,92,92,.15); color:var(--red);}
.sev.medium{background:rgba(240,180,41,.15); color:var(--amber);}
.sev.low{background:rgba(61,220,132,.15); color:var(--green);}
.src-tag{color:var(--dim); font-size:11px;}
.ipcell{font-weight:700; color:var(--text);}
.bar-wrap{padding:14px 16px;}
.bar-row{display:flex; align-items:center; gap:10px; margin-bottom:9px; font-size:12px;}
.bar-row .lbl{width:90px; color:var(--dim); flex-shrink:0;}
.bar-track{flex:1; background:#1a221d; border-radius:3px; height:10px; overflow:hidden;}
.bar-fill{height:100%; background:var(--amber); border-radius:3px;}
.empty{padding:30px; text-align:center; color:var(--dim);}
</style>
</head>
<body>
<header>
<h1>SIEM <span>/ نظام مراقبة الأحداث الأمنية</span></h1>
<div class="status"><span class="dot" id="live-dot"></span><span id="last-update">لم يتم التحميل بعد</span></div>
</header>
<div class="toolbar">
<button id="refresh-btn">تحديث الآن ⟳</button>
<label class="filebtn">
تحميل alerts.json يدويًا
<input type="file" id="file-input" accept=".json" style="display:none;">
</label>
<span id="source-note">يحاول تحميل alerts.json تلقائيًا كل 10 ثوانٍ (يتطلب تشغيل عبر خادم محلي)</span>
</div>
<main>
<div class="cards" id="cards"></div>
<div class="grid2">
<div class="panel">
<h2>التنبيهات (Alerts)</h2>
<div id="alerts-table"></div>
</div>
<div class="panel">
<h2>عناوين IP المشبوهة</h2>
<div id="ips-table"></div>
<div class="panel" style="border:none; margin-top:4px;">
<h2>التنبيهات حسب المصدر</h2>
<div class="bar-wrap" id="source-bars"></div>
</div>
</div>
</div>
</main>
<script>
const SEV_LABEL = {critical:"حرج", high:"عالي", medium:"متوسط", low:"منخفض"};
const SRC_LABEL = {web:"Web Server", auth:"Auth / OS", firewall:"Firewall"};
let autoTimer = null;
function render(data){
document.getElementById("last-update").textContent =
"آخر تحديث: " + new Date(data.generated_at).toLocaleString("ar-EG");
const s = data.stats || {};
const bySeverity = s.by_severity || {};
document.getElementById("cards").innerHTML = `
<div class="card"><div class="label">إجمالي التنبيهات</div><div class="value">${s.total_alerts ?? 0}</div></div>
<div class="card crit"><div class="label">حرجة</div><div class="value">${bySeverity.critical ?? 0}</div></div>
<div class="card high"><div class="label">عالية الخطورة</div><div class="value">${bySeverity.high ?? 0}</div></div>
<div class="card ok"><div class="label">متوسطة/منخفضة</div><div class="value">${(bySeverity.medium ?? 0) + (bySeverity.low ?? 0)}</div></div>
<div class="card ips"><div class="label">IP مشبوهة</div><div class="value">${s.unique_suspicious_ips ?? 0}</div></div>
`;
const alerts = data.alerts || [];
document.getElementById("alerts-table").innerHTML = alerts.length ? `
<table>
<thead><tr><th>الخطورة</th><th>النوع</th><th>IP</th><th>المصدر</th><th>التفاصيل</th></tr></thead>
<tbody>
${alerts.map(a => `
<tr>
<td><span class="sev ${a.severity}">${SEV_LABEL[a.severity] || a.severity}</span></td>
<td>${a.type}</td>
<td class="ipcell">${a.ip}</td>
<td class="src-tag">${SRC_LABEL[a.source] || a.source}</td>
<td>${a.detail}</td>
</tr>`).join("")}
</tbody>
</table>` : `<div class="empty">لا توجد تنبيهات حاليًا</div>`;
const ips = data.suspicious_ips || [];
document.getElementById("ips-table").innerHTML = ips.length ? `
<table>
<thead><tr><th>IP</th><th>عدد التنبيهات</th><th>درجة الخطورة</th></tr></thead>
<tbody>
${ips.map(i => `<tr><td class="ipcell">${i.ip}</td><td>${i.alert_count}</td><td>${i.score}</td></tr>`).join("")}
</tbody>
</table>` : `<div class="empty">لا توجد عناوين مشبوهة</div>`;
const bySource = s.by_source || {};
const maxVal = Math.max(1, ...Object.values(bySource));
document.getElementById("source-bars").innerHTML = Object.keys(SRC_LABEL).map(key => {
const val = bySource[key] || 0;
const pct = Math.round((val / maxVal) * 100);
return `<div class="bar-row">
<div class="lbl">${SRC_LABEL[key]}</div>
<div class="bar-track"><div class="bar-fill" style="width:${pct}%"></div></div>
<div>${val}</div>
</div>`;
}).join("");
}
async function fetchData(){
try{
const res = await fetch("output/alerts.json", {cache:"no-store"});
if(!res.ok) throw new Error("HTTP " + res.status);
const data = await res.json();
render(data);
document.getElementById("live-dot").style.background = "var(--green)";
}catch(e){
document.getElementById("source-note").textContent =
"تعذّر تحميل alerts.json تلقائيًا (" + e.message + "). استخدم زر التحميل اليدوي، أو شغّل خادم محلي: python3 -m http.server";
document.getElementById("live-dot").style.background = "var(--red)";
}
}
document.getElementById("refresh-btn").addEventListener("click", fetchData);
document.getElementById("file-input").addEventListener("change", (ev) => {
const file = ev.target.files[0];
if(!file) return;
const reader = new FileReader();
reader.onload = () => {
try{
render(JSON.parse(reader.result));
document.getElementById("source-note").textContent = "تم التحميل يدويًا من ملف: " + file.name;
}catch(e){
alert("ملف JSON غير صالح: " + e.message);
}
};
reader.readAsText(file);
});
fetchData();
autoTimer = setInterval(fetchData, 10000);
</script>
</body>
</html>

95
q4-siem-log-analysis/firewall.log Normal file
عرض الملف

@@ -0,0 +1,95 @@
Jul 27 16:03:12 kernel: IN=eth0 OUT= SRC=192.168.1.167 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 15:59:26 kernel: IN=eth0 OUT= SRC=192.168.1.29 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 15:36:52 kernel: IN=eth0 OUT= SRC=192.168.1.230 DST=10.0.0.5 PROTO=TCP DPT=443 ACTION=ACCEPT
Jul 27 16:29:12 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1007 ACTION=DROP
Jul 27 15:36:19 kernel: IN=eth0 OUT= SRC=192.168.1.16 DST=10.0.0.5 PROTO=TCP DPT=80 ACTION=ACCEPT
Jul 27 16:16:10 kernel: IN=eth0 OUT= SRC=192.168.1.200 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 16:29:59 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1024 ACTION=DROP
Jul 27 16:06:48 kernel: IN=eth0 OUT= SRC=192.168.1.79 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 15:37:48 kernel: IN=eth0 OUT= SRC=192.168.1.97 DST=10.0.0.5 PROTO=TCP DPT=443 ACTION=ACCEPT
Jul 27 16:18:19 kernel: IN=eth0 OUT= SRC=192.168.1.38 DST=10.0.0.5 PROTO=TCP DPT=443 ACTION=ACCEPT
Jul 27 16:27:14 kernel: IN=eth0 OUT= SRC=192.168.1.118 DST=10.0.0.5 PROTO=TCP DPT=443 ACTION=ACCEPT
Jul 27 15:48:38 kernel: IN=eth0 OUT= SRC=192.168.1.118 DST=10.0.0.5 PROTO=TCP DPT=443 ACTION=ACCEPT
Jul 27 16:32:35 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1031 ACTION=DROP
Jul 27 16:31:12 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1033 ACTION=DROP
Jul 27 15:46:00 kernel: IN=eth0 OUT= SRC=192.168.1.35 DST=10.0.0.5 PROTO=TCP DPT=443 ACTION=ACCEPT
Jul 27 16:18:46 kernel: IN=eth0 OUT= SRC=192.168.1.238 DST=10.0.0.5 PROTO=TCP DPT=443 ACTION=ACCEPT
Jul 27 16:31:21 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1028 ACTION=DROP
Jul 27 16:25:19 kernel: IN=eth0 OUT= SRC=192.168.1.51 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 16:03:13 kernel: IN=eth0 OUT= SRC=192.168.1.187 DST=10.0.0.5 PROTO=TCP DPT=443 ACTION=ACCEPT
Jul 27 16:30:48 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1003 ACTION=DROP
Jul 27 16:31:08 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1001 ACTION=DROP
Jul 27 15:36:40 kernel: IN=eth0 OUT= SRC=192.168.1.175 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 16:31:07 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1025 ACTION=DROP
Jul 27 16:29:06 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1023 ACTION=DROP
Jul 27 16:31:00 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1014 ACTION=DROP
Jul 27 16:32:09 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1005 ACTION=DROP
Jul 27 16:27:56 kernel: IN=eth0 OUT= SRC=192.168.1.182 DST=10.0.0.5 PROTO=TCP DPT=80 ACTION=ACCEPT
Jul 27 15:49:22 kernel: IN=eth0 OUT= SRC=192.168.1.45 DST=10.0.0.5 PROTO=TCP DPT=80 ACTION=ACCEPT
Jul 27 16:00:54 kernel: IN=eth0 OUT= SRC=192.168.1.250 DST=10.0.0.5 PROTO=TCP DPT=443 ACTION=ACCEPT
Jul 27 16:30:42 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1019 ACTION=DROP
Jul 27 16:28:08 kernel: IN=eth0 OUT= SRC=192.168.1.41 DST=10.0.0.5 PROTO=TCP DPT=80 ACTION=ACCEPT
Jul 27 15:39:55 kernel: IN=eth0 OUT= SRC=192.168.1.172 DST=10.0.0.5 PROTO=TCP DPT=80 ACTION=ACCEPT
Jul 27 16:28:15 kernel: IN=eth0 OUT= SRC=192.168.1.193 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 16:30:10 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1021 ACTION=DROP
Jul 27 15:38:30 kernel: IN=eth0 OUT= SRC=192.168.1.246 DST=10.0.0.5 PROTO=TCP DPT=443 ACTION=ACCEPT
Jul 27 15:58:16 kernel: IN=eth0 OUT= SRC=192.168.1.160 DST=10.0.0.5 PROTO=TCP DPT=80 ACTION=ACCEPT
Jul 27 16:11:21 kernel: IN=eth0 OUT= SRC=192.168.1.115 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 16:32:49 kernel: IN=eth0 OUT= SRC=192.168.1.127 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 16:31:19 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1000 ACTION=DROP
Jul 27 15:48:01 kernel: IN=eth0 OUT= SRC=192.168.1.228 DST=10.0.0.5 PROTO=TCP DPT=80 ACTION=ACCEPT
Jul 27 16:30:48 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1027 ACTION=DROP
Jul 27 16:19:52 kernel: IN=eth0 OUT= SRC=192.168.1.178 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 15:59:49 kernel: IN=eth0 OUT= SRC=192.168.1.154 DST=10.0.0.5 PROTO=TCP DPT=80 ACTION=ACCEPT
Jul 27 16:30:57 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1009 ACTION=DROP
Jul 27 16:02:28 kernel: IN=eth0 OUT= SRC=192.168.1.191 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 16:15:06 kernel: IN=eth0 OUT= SRC=192.168.1.241 DST=10.0.0.5 PROTO=TCP DPT=443 ACTION=ACCEPT
Jul 27 16:30:16 kernel: IN=eth0 OUT= SRC=192.168.1.130 DST=10.0.0.5 PROTO=TCP DPT=80 ACTION=ACCEPT
Jul 27 16:31:50 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1012 ACTION=DROP
Jul 27 15:45:51 kernel: IN=eth0 OUT= SRC=192.168.1.71 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 15:48:51 kernel: IN=eth0 OUT= SRC=192.168.1.231 DST=10.0.0.5 PROTO=TCP DPT=443 ACTION=ACCEPT
Jul 27 16:32:53 kernel: IN=eth0 OUT= SRC=192.168.1.24 DST=10.0.0.5 PROTO=TCP DPT=80 ACTION=ACCEPT
Jul 27 16:31:49 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1020 ACTION=DROP
Jul 27 15:54:16 kernel: IN=eth0 OUT= SRC=192.168.1.227 DST=10.0.0.5 PROTO=TCP DPT=443 ACTION=ACCEPT
Jul 27 15:54:06 kernel: IN=eth0 OUT= SRC=192.168.1.105 DST=10.0.0.5 PROTO=TCP DPT=443 ACTION=ACCEPT
Jul 27 16:30:04 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1006 ACTION=DROP
Jul 27 16:32:51 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1018 ACTION=DROP
Jul 27 16:30:32 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1013 ACTION=DROP
Jul 27 16:13:59 kernel: IN=eth0 OUT= SRC=192.168.1.187 DST=10.0.0.5 PROTO=TCP DPT=443 ACTION=ACCEPT
Jul 27 16:25:14 kernel: IN=eth0 OUT= SRC=192.168.1.135 DST=10.0.0.5 PROTO=TCP DPT=443 ACTION=ACCEPT
Jul 27 15:35:05 kernel: IN=eth0 OUT= SRC=192.168.1.145 DST=10.0.0.5 PROTO=TCP DPT=443 ACTION=ACCEPT
Jul 27 16:31:51 kernel: IN=eth0 OUT= SRC=192.168.1.122 DST=10.0.0.5 PROTO=TCP DPT=80 ACTION=ACCEPT
Jul 27 16:03:22 kernel: IN=eth0 OUT= SRC=192.168.1.9 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 16:27:41 kernel: IN=eth0 OUT= SRC=192.168.1.89 DST=10.0.0.5 PROTO=TCP DPT=80 ACTION=ACCEPT
Jul 27 15:53:52 kernel: IN=eth0 OUT= SRC=192.168.1.226 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 16:14:48 kernel: IN=eth0 OUT= SRC=192.168.1.109 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 16:30:38 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1008 ACTION=DROP
Jul 27 16:32:05 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1030 ACTION=DROP
Jul 27 16:31:55 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1017 ACTION=DROP
Jul 27 16:31:14 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1016 ACTION=DROP
Jul 27 15:52:30 kernel: IN=eth0 OUT= SRC=192.168.1.84 DST=10.0.0.5 PROTO=TCP DPT=443 ACTION=ACCEPT
Jul 27 15:47:16 kernel: IN=eth0 OUT= SRC=192.168.1.3 DST=10.0.0.5 PROTO=TCP DPT=80 ACTION=ACCEPT
Jul 27 16:31:04 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1029 ACTION=DROP
Jul 27 16:32:53 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1010 ACTION=DROP
Jul 27 16:00:19 kernel: IN=eth0 OUT= SRC=192.168.1.23 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 16:30:16 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1032 ACTION=DROP
Jul 27 16:20:28 kernel: IN=eth0 OUT= SRC=192.168.1.119 DST=10.0.0.5 PROTO=TCP DPT=80 ACTION=ACCEPT
Jul 27 16:30:59 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1004 ACTION=DROP
Jul 27 16:30:15 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1022 ACTION=DROP
Jul 27 16:14:31 kernel: IN=eth0 OUT= SRC=192.168.1.241 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 15:50:41 kernel: IN=eth0 OUT= SRC=192.168.1.204 DST=10.0.0.5 PROTO=TCP DPT=80 ACTION=ACCEPT
Jul 27 16:31:34 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1011 ACTION=DROP
Jul 27 15:47:24 kernel: IN=eth0 OUT= SRC=192.168.1.69 DST=10.0.0.5 PROTO=TCP DPT=80 ACTION=ACCEPT
Jul 27 15:38:28 kernel: IN=eth0 OUT= SRC=192.168.1.4 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 15:44:58 kernel: IN=eth0 OUT= SRC=192.168.1.63 DST=10.0.0.5 PROTO=TCP DPT=80 ACTION=ACCEPT
Jul 27 16:25:51 kernel: IN=eth0 OUT= SRC=192.168.1.106 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 16:29:04 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1034 ACTION=DROP
Jul 27 15:35:29 kernel: IN=eth0 OUT= SRC=192.168.1.93 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 16:29:19 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1026 ACTION=DROP
Jul 27 15:42:51 kernel: IN=eth0 OUT= SRC=192.168.1.181 DST=10.0.0.5 PROTO=TCP DPT=443 ACTION=ACCEPT
Jul 27 15:57:22 kernel: IN=eth0 OUT= SRC=192.168.1.245 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 16:23:44 kernel: IN=eth0 OUT= SRC=192.168.1.101 DST=10.0.0.5 PROTO=TCP DPT=80 ACTION=ACCEPT
Jul 27 16:29:13 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1015 ACTION=DROP
Jul 27 15:33:35 kernel: IN=eth0 OUT= SRC=192.168.1.221 DST=10.0.0.5 PROTO=TCP DPT=80 ACTION=ACCEPT
Jul 27 15:55:22 kernel: IN=eth0 OUT= SRC=192.168.1.43 DST=10.0.0.5 PROTO=TCP DPT=22 ACTION=ACCEPT
Jul 27 16:31:22 kernel: IN=eth0 OUT= SRC=45.155.205.7 DST=10.0.0.5 PROTO=TCP DPT=1002 ACTION=DROP

130
q4-siem-log-analysis/generate_sample_logs.py Normal file
عرض الملف

@@ -0,0 +1,130 @@
#!/usr/bin/env python3
"""
generate_sample_logs.py
------------------------
يولد سجلات تجريبية واقعية (Web / Auth / Firewall) تحتوي على سلوك طبيعي
+ هجمات مصطنعة، لاختبار محرك التحليل siem_analyzer.py قبل تسليم الامتحان.
الاستخدام:
python3 generate_sample_logs.py
سينشئ الملفات داخل مجلد logs/:
logs/access.log (Nginx)
logs/auth.log (Linux SSH)
logs/firewall.log (iptables)
"""
import random
from datetime import datetime, timedelta
OUT_DIR = "logs"
def rand_ip(bad=False):
if bad:
# نفس مجموعة IPs الخبيثة تتكرر لتصبح واضحة الأنماط
return random.choice(["203.0.113.45", "198.51.100.23", "45.155.205.7"])
return f"192.168.1.{random.randint(2, 250)}"
def gen_access_log(out_path, lines=400):
normal_paths = ["/", "/index.html", "/products", "/login", "/api/users", "/about"]
sqli_payloads = [
"/login?id=1' UNION SELECT username,password FROM users--",
"/products?id=1 OR 1=1",
"/search?q=SELECT * FROM accounts",
]
traversal_payloads = [
"/download?file=../../../../etc/passwd",
"/view?page=..%2f..%2f..%2fetc%2fpasswd",
]
now = datetime.now()
rows = []
for i in range(lines):
ts = now - timedelta(seconds=random.randint(0, 3600))
ip = rand_ip()
req_path = random.choice(normal_paths)
status = random.choice([200, 200, 200, 304, 404])
rows.append(f'{ip} - - [{ts.strftime("%d/%b/%Y:%H:%M:%S +0000")}] '
f'"GET {req_path} HTTP/1.1" {status} {random.randint(200,5000)}')
# هجوم SQL Injection من IP واحد
attacker = "203.0.113.45"
for payload in sqli_payloads * 3:
ts = now - timedelta(seconds=random.randint(0, 600))
rows.append(f'{attacker} - - [{ts.strftime("%d/%b/%Y:%H:%M:%S +0000")}] '
f'"GET {payload} HTTP/1.1" 500 512')
# هجوم Directory Traversal
attacker2 = "198.51.100.23"
for payload in traversal_payloads * 3:
ts = now - timedelta(seconds=random.randint(0, 600))
rows.append(f'{attacker2} - - [{ts.strftime("%d/%b/%Y:%H:%M:%S +0000")}] '
f'"GET {payload} HTTP/1.1" 403 300')
# هجوم Scanning/Fuzzing: نفس IP يولد عشرات 404
scanner = "45.155.205.7"
for _ in range(40):
ts = now - timedelta(seconds=random.randint(0, 600))
rows.append(f'{scanner} - - [{ts.strftime("%d/%b/%Y:%H:%M:%S +0000")}] '
f'"GET /wp-admin/{random.randint(1,999)}.php HTTP/1.1" 404 200')
random.shuffle(rows)
with open(out_path, "w") as f:
f.write("\n".join(rows) + "\n")
def gen_auth_log(out_path):
now = datetime.now()
rows = []
# محاولات دخول عادية ناجحة
for _ in range(20):
ts = now - timedelta(seconds=random.randint(0, 3600))
ip = rand_ip()
rows.append(f'{ts.strftime("%b %d %H:%M:%S")} server sshd[1234]: '
f'Accepted password for admin from {ip} port 55000 ssh2')
# هجوم Brute Force: نفس IP، فشل متكرر خلال دقيقة ثم نجاح
attacker = "198.51.100.99"
base = now - timedelta(minutes=2)
for i in range(10):
ts = base + timedelta(seconds=i * 5)
rows.append(f'{ts.strftime("%b %d %H:%M:%S")} server sshd[999{i}]: '
f'Failed password for root from {attacker} port 4444{i} ssh2')
rows.append(f'{(base + timedelta(seconds=60)).strftime("%b %d %H:%M:%S")} server sshd[9999]: '
f'Accepted password for root from {attacker} port 44450 ssh2')
random.shuffle(rows)
with open(out_path, "w") as f:
f.write("\n".join(rows) + "\n")
def gen_firewall_log(out_path):
now = datetime.now()
rows = []
# حركة طبيعية مسموحة
for _ in range(60):
ts = now - timedelta(seconds=random.randint(0, 3600))
ip = rand_ip()
port = random.choice([80, 443, 22])
rows.append(f'{ts.strftime("%b %d %H:%M:%S")} kernel: IN=eth0 OUT= '
f'SRC={ip} DST=10.0.0.5 PROTO=TCP DPT={port} ACTION=ACCEPT')
# هجوم Port Scan: IP واحد يحاول عشرات المنافذ المغلقة
scanner = "45.155.205.7"
for port in range(1000, 1035):
ts = now - timedelta(seconds=random.randint(0, 300))
rows.append(f'{ts.strftime("%b %d %H:%M:%S")} kernel: IN=eth0 OUT= '
f'SRC={scanner} DST=10.0.0.5 PROTO=TCP DPT={port} ACTION=DROP')
random.shuffle(rows)
with open(out_path, "w") as f:
f.write("\n".join(rows) + "\n")
if __name__ == "__main__":
import os
os.makedirs(OUT_DIR, exist_ok=True)
gen_access_log(f"{OUT_DIR}/access.log")
gen_auth_log(f"{OUT_DIR}/auth.log")
gen_firewall_log(f"{OUT_DIR}/firewall.log")
print("تم إنشاء سجلات تجريبية داخل مجلد logs/")

218
q4-siem-log-analysis/siem_analyzer.py Normal file
عرض الملف

@@ -0,0 +1,218 @@
#!/usr/bin/env python3
"""
siem_analyzer.py
-----------------
نظام SIEM مبسط: يجمع السجلات من 3 مصادر (Web Server / Auth-OS / Firewall)،
يحللها لاكتشاف أنماط مشبوهة، ويحفظ النتائج في alerts.json ليقرأها الـ Dashboard.
الاستخدام:
python3 siem_analyzer.py --once # تشغيل مرة واحدة
python3 siem_analyzer.py --watch 30 # تشغيل دوري كل 30 ثانية (مثل خدمة حقيقية)
يمكن تعديل مسارات ومحددات (thresholds) الكشف في قسم CONFIG أدناه.
"""
import re
import json
import argparse
import time
from collections import defaultdict, Counter
from datetime import datetime
# ================== CONFIG ==================
CONFIG = {
"web_log_path": "logs/access.log",
"auth_log_path": "logs/auth.log",
"firewall_log_path": "logs/firewall.log",
"output_path": "output/alerts.json",
"thresholds": {
"web_404_403_count": 15, # عدد 404/403 من نفس IP يعتبر Scanning
"brute_force_fails": 5, # عدد محاولات فاشلة من نفس IP قبل التنبيه
"port_scan_ports": 15, # عدد منافذ مختلفة محظورة من نفس IP
},
}
SQLI_PATTERN = re.compile(
r"(\bunion\b.*\bselect\b|\bselect\b.*\bfrom\b|\bor\b\s+1=1|--\s*$|'.*or.*'.*=.*')",
re.IGNORECASE,
)
TRAVERSAL_PATTERN = re.compile(r"(\.\./|%2e%2e%2f|\.\.%2f)", re.IGNORECASE)
WEB_LOG_LINE = re.compile(
r'(?P<ip>\d{1,3}(?:\.\d{1,3}){3}).*\[(?P<time>[^\]]+)\]\s+"(?P<method>\w+)\s+'
r'(?P<path>\S+)\s+HTTP/[\d.]+"\s+(?P<status>\d{3})'
)
AUTH_FAILED = re.compile(
r"(?P<time>\w+\s+\d+\s+[\d:]+).*Failed password.*from (?P<ip>\d{1,3}(?:\.\d{1,3}){3})"
)
AUTH_ACCEPTED = re.compile(
r"(?P<time>\w+\s+\d+\s+[\d:]+).*Accepted password.*from (?P<ip>\d{1,3}(?:\.\d{1,3}){3})"
)
FW_LINE = re.compile(
r"(?P<time>\w+\s+\d+\s+[\d:]+).*SRC=(?P<ip>\d{1,3}(?:\.\d{1,3}){3}).*"
r"DPT=(?P<port>\d+)\s+ACTION=(?P<action>\w+)"
)
# ================== ANALYZERS ==================
def analyze_web_log(path, thresholds):
"""يحلل سجلات خادم الويب: SQLi, Directory Traversal, Scanning عبر 404/403 مرتفعة."""
alerts = []
error_counts = Counter()
try:
with open(path, "r", errors="ignore") as f:
for line in f:
m = WEB_LOG_LINE.search(line)
if not m:
continue
ip, path_req, status = m["ip"], m["path"], m["status"]
if SQLI_PATTERN.search(path_req):
alerts.append({
"source": "web", "type": "SQL Injection",
"ip": ip, "detail": path_req[:120], "severity": "high",
})
if TRAVERSAL_PATTERN.search(path_req):
alerts.append({
"source": "web", "type": "Directory Traversal",
"ip": ip, "detail": path_req[:120], "severity": "high",
})
if status in ("404", "403"):
error_counts[ip] += 1
except FileNotFoundError:
print(f"[!] تحذير: ملف السجل غير موجود: {path}")
return alerts
for ip, count in error_counts.items():
if count >= thresholds["web_404_403_count"]:
alerts.append({
"source": "web", "type": "Scanning/Fuzzing",
"ip": ip, "detail": f"{count} طلب 404/403 من نفس المصدر",
"severity": "medium",
})
return alerts
def analyze_auth_log(path, thresholds):
"""يحلل سجلات المصادقة: Brute Force على SSH، ونجاح دخول بعد فشل متكرر."""
alerts = []
fail_counts = defaultdict(int)
fail_then_success = defaultdict(int)
try:
with open(path, "r", errors="ignore") as f:
for line in f:
mf = AUTH_FAILED.search(line)
if mf:
fail_counts[mf["ip"]] += 1
continue
ms = AUTH_ACCEPTED.search(line)
if ms and fail_counts[ms["ip"]] >= thresholds["brute_force_fails"]:
fail_then_success[ms["ip"]] = fail_counts[ms["ip"]]
except FileNotFoundError:
print(f"[!] تحذير: ملف السجل غير موجود: {path}")
return alerts
for ip, count in fail_counts.items():
if count >= thresholds["brute_force_fails"]:
alerts.append({
"source": "auth", "type": "Brute Force (SSH)",
"ip": ip, "detail": f"{count} محاولة فاشلة", "severity": "high",
})
for ip, count in fail_then_success.items():
alerts.append({
"source": "auth", "type": "Successful login after failures",
"ip": ip, "detail": f"دخول ناجح بعد {count} محاولة فاشلة",
"severity": "critical",
})
return alerts
def analyze_firewall_log(path, thresholds):
"""يحلل سجلات الجدار الناري: Port Scanning عبر تعدد المنافذ المحظورة من نفس IP."""
alerts = []
blocked_ports = defaultdict(set)
try:
with open(path, "r", errors="ignore") as f:
for line in f:
m = FW_LINE.search(line)
if not m:
continue
if m["action"] in ("DROP", "REJECT", "BLOCK"):
blocked_ports[m["ip"]].add(m["port"])
except FileNotFoundError:
print(f"[!] تحذير: ملف السجل غير موجود: {path}")
return alerts
for ip, ports in blocked_ports.items():
if len(ports) >= thresholds["port_scan_ports"]:
alerts.append({
"source": "firewall", "type": "Port Scanning",
"ip": ip, "detail": f"محاولة الاتصال بـ {len(ports)} منفذ مختلف",
"severity": "high",
})
return alerts
# ================== AGGREGATION ==================
def run_analysis(cfg):
alerts = []
alerts += analyze_web_log(cfg["web_log_path"], cfg["thresholds"])
alerts += analyze_auth_log(cfg["auth_log_path"], cfg["thresholds"])
alerts += analyze_firewall_log(cfg["firewall_log_path"], cfg["thresholds"])
ip_scores = Counter()
severity_weight = {"low": 1, "medium": 2, "high": 3, "critical": 5}
for a in alerts:
ip_scores[a["ip"]] += severity_weight.get(a["severity"], 1)
suspicious_ips = [
{"ip": ip, "score": score, "alert_count": sum(1 for a in alerts if a["ip"] == ip)}
for ip, score in ip_scores.most_common()
]
result = {
"generated_at": datetime.now().isoformat(),
"stats": {
"total_alerts": len(alerts),
"by_source": dict(Counter(a["source"] for a in alerts)),
"by_severity": dict(Counter(a["severity"] for a in alerts)),
"unique_suspicious_ips": len(suspicious_ips),
},
"alerts": sorted(alerts, key=lambda a: severity_weight.get(a["severity"], 0), reverse=True),
"suspicious_ips": suspicious_ips,
}
return result
def save_result(result, output_path):
import os
os.makedirs(os.path.dirname(output_path) or ".", exist_ok=True)
with open(output_path, "w", encoding="utf-8") as f:
json.dump(result, f, ensure_ascii=False, indent=2)
print(f"[+] تم حفظ {result['stats']['total_alerts']} تنبيه في {output_path}")
def main():
parser = argparse.ArgumentParser(description="نظام SIEM مبسط")
parser.add_argument("--once", action="store_true", help="تشغيل مرة واحدة فقط")
parser.add_argument("--watch", type=int, default=0,
help="تشغيل دوري كل N ثانية (محاكاة خدمة حية)")
args = parser.parse_args()
if args.watch > 0:
print(f"[*] وضع المراقبة الدورية: كل {args.watch} ثانية. اضغط Ctrl+C للإيقاف.")
try:
while True:
result = run_analysis(CONFIG)
save_result(result, CONFIG["output_path"])
time.sleep(args.watch)
except KeyboardInterrupt:
print("\n[*] تم إيقاف المراقبة.")
else:
result = run_analysis(CONFIG)
save_result(result, CONFIG["output_path"])
if __name__ == "__main__":
main()