أنهيت الإمتحان

q4-siem-log-analysis/alerts.json

@@ -0,0 +1,98 @@
+{
+  "generated_at": "2026-07-27T16:33:08.411673",
+  "stats": {
+    "total_alerts": 9,
+    "by_source": {
+      "web": 7,
+      "auth": 1,
+      "firewall": 1
+    },
+    "by_severity": {
+      "high": 8,
+      "medium": 1
+    },
+    "unique_suspicious_ips": 3
+  },
+  "alerts": [
+    {
+      "source": "web",
+      "type": "Directory Traversal",
+      "ip": "198.51.100.23",
+      "detail": "/download?file=../../../../etc/passwd",
+      "severity": "high"
+    },
+    {
+      "source": "web",
+      "type": "Directory Traversal",
+      "ip": "198.51.100.23",
+      "detail": "/download?file=../../../../etc/passwd",
+      "severity": "high"
+    },
+    {
+      "source": "web",
+      "type": "Directory Traversal",
+      "ip": "198.51.100.23",
+      "detail": "/view?page=..%2f..%2f..%2fetc%2fpasswd",
+      "severity": "high"
+    },
+    {
+      "source": "web",
+      "type": "Directory Traversal",
+      "ip": "198.51.100.23",
+      "detail": "/view?page=..%2f..%2f..%2fetc%2fpasswd",
+      "severity": "high"
+    },
+    {
+      "source": "web",
+      "type": "Directory Traversal",
+      "ip": "198.51.100.23",
+      "detail": "/view?page=..%2f..%2f..%2fetc%2fpasswd",
+      "severity": "high"
+    },
+    {
+      "source": "web",
+      "type": "Directory Traversal",
+      "ip": "198.51.100.23",
+      "detail": "/download?file=../../../../etc/passwd",
+      "severity": "high"
+    },
+    {
+      "source": "auth",
+      "type": "Brute Force (SSH)",
+      "ip": "198.51.100.99",
+      "detail": "10 محاولة فاشلة",
+      "severity": "high"
+    },
+    {
+      "source": "firewall",
+      "type": "Port Scanning",
+      "ip": "45.155.205.7",
+      "detail": "محاولة الاتصال بـ 35 منفذ مختلف",
+      "severity": "high"
+    },
+    {
+      "source": "web",
+      "type": "Scanning/Fuzzing",
+      "ip": "45.155.205.7",
+      "detail": "40 طلب 404/403 من نفس المصدر",
+      "severity": "medium"
+    }
+  ],
+  "suspicious_ips": [
+    {
+      "ip": "198.51.100.23",
+      "score": 18,
+      "alert_count": 6
+    },
+    {
+      "ip": "45.155.205.7",
+      "score": 5,
+      "alert_count": 2
+    },
+    {
+      "ip": "198.51.100.99",
+      "score": 3,
+      "alert_count": 1
+    }
+  ]
+}