mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
43 lines
2.1 KiB
Python
43 lines
2.1 KiB
Python
#!/usr/bin/env python3
|
|
"""Linux Log Forensic Analyzer - Parses auth.log for forensic investigation."""
|
|
import re, json, os, sys
|
|
from datetime import datetime
|
|
from collections import defaultdict
|
|
|
|
def parse_auth_log(path: str, output_dir: str) -> str:
|
|
os.makedirs(output_dir, exist_ok=True)
|
|
successful, failed, sudo_cmds = [], [], []
|
|
ssh_ok = re.compile(r'(\w+\s+\d+\s+[\d:]+)\s+\S+\s+sshd\[\d+\]:\s+Accepted\s+(\S+)\s+for\s+(\S+)\s+from\s+([\d.]+)')
|
|
ssh_fail = re.compile(r'(\w+\s+\d+\s+[\d:]+)\s+\S+\s+sshd\[\d+\]:\s+Failed\s+password\s+for\s+(\S*)\s+from\s+([\d.]+)')
|
|
sudo_re = re.compile(r'(\w+\s+\d+\s+[\d:]+)\s+\S+\s+sudo:\s+(\S+)\s+:.*COMMAND=(.*)')
|
|
with open(path, "r", errors="replace") as f:
|
|
for line in f:
|
|
m = ssh_ok.search(line)
|
|
if m:
|
|
successful.append({"time": m.group(1), "method": m.group(2), "user": m.group(3), "ip": m.group(4)})
|
|
continue
|
|
m = ssh_fail.search(line)
|
|
if m:
|
|
failed.append({"time": m.group(1), "user": m.group(2), "ip": m.group(3)})
|
|
continue
|
|
m = sudo_re.search(line)
|
|
if m:
|
|
sudo_cmds.append({"time": m.group(1), "user": m.group(2), "command": m.group(3).strip()})
|
|
# Brute force detection
|
|
ip_counts = defaultdict(int)
|
|
for e in failed:
|
|
ip_counts[e["ip"]] += 1
|
|
brute_force = [{"ip": k, "attempts": v} for k, v in ip_counts.items() if v >= 10]
|
|
report = {"successful_logins": len(successful), "failed_logins": len(failed),
|
|
"sudo_commands": len(sudo_cmds), "brute_force_ips": brute_force,
|
|
"top_successful": successful[:50], "top_failed": failed[:50], "top_sudo": sudo_cmds[:50]}
|
|
out = os.path.join(output_dir, "linux_auth_forensics.json")
|
|
with open(out, "w") as f:
|
|
json.dump(report, f, indent=2)
|
|
print(f"[*] OK:{len(successful)} FAIL:{len(failed)} SUDO:{len(sudo_cmds)} BruteForce:{len(brute_force)}")
|
|
return out
|
|
|
|
if __name__ == "__main__":
|
|
if len(sys.argv) < 3: print("Usage: process.py <auth.log> <output_dir>"); sys.exit(1)
|
|
parse_auth_log(sys.argv[1], sys.argv[2])
|