Security Incident Log Analyzer

Build a security incident log analyzer that processes various security logs and converts them into structured threat intelligence objects suitable for sharing.

Requirements

Create a Python program that accepts different types of security log data and generates structured objects for each log type. The program should handle three different log formats:

1. Ban Events: Process authentication failure logs containing:

   • Banned IP address
   • Ban timestamp
   • Number of failed attempts
   • Protocol used (ssh, http, etc.)

2. Git Repository Vulnerabilities: Process git vulnerability findings containing:

   • Repository URL
   • Commit hash
   • Vulnerability description
   • Discovered timestamp

3. Sandbox Detection Signatures: Process sandbox detection results containing:

   • Signature name
   • Signature type
   • Detection result (detected/not detected)
   • Analysis timestamp

Functional Requirements

Your solution must:

• Accept input data as Python dictionaries for each log type
• Generate appropriately structured objects for threat intelligence sharing
• Include relevant metadata (timestamps, UUIDs where applicable)
• Return objects that can be serialized to JSON
• Handle missing optional fields gracefully

Test Cases

• Given a ban event with IP "192.0.2.100", timestamp "2025-01-01T10:30:00", 5 attempts, and protocol "ssh", the program generates a valid ban event object with these fields @test

• Given a git vulnerability with repository "https://github.com/example/repo", commit "abc123def456", description "Hardcoded API key", and timestamp "2025-01-01T14:20:00", the program generates a valid git vulnerability object with these fields @test

• Given a sandbox signature with name "VMWare detection", type "behavioral", result "detected", and timestamp "2025-01-01T09:15:00", the program generates a valid sandbox signature object with these fields @test

Implementation

@generates

API

def create_ban_event_object(ip: str, timestamp: str, attempts: int, protocol: str) -> dict:
    """
    Create a structured ban event object from authentication failure logs.

    Args:
        ip: The banned IP address
        timestamp: ISO 8601 formatted timestamp
        attempts: Number of failed authentication attempts
        protocol: Protocol used (e.g., 'ssh', 'http')

    Returns:
        A dictionary representing the structured ban event object
    """
    pass

def create_git_vuln_object(repository: str, commit: str, description: str, timestamp: str) -> dict:
    """
    Create a structured git vulnerability object from vulnerability findings.

    Args:
        repository: Git repository URL
        commit: Commit hash where vulnerability was found
        description: Description of the vulnerability
        timestamp: ISO 8601 formatted timestamp

    Returns:
        A dictionary representing the structured git vulnerability object
    """
    pass

def create_sandbox_signature_object(name: str, sig_type: str, result: str, timestamp: str) -> dict:
    """
    Create a structured sandbox signature object from sandbox detection results.

    Args:
        name: Signature name
        sig_type: Type of signature (e.g., 'behavioral', 'static')
        result: Detection result ('detected' or 'not detected')
        timestamp: ISO 8601 formatted timestamp

    Returns:
        A dictionary representing the structured sandbox signature object
    """
    pass

Dependencies { .dependencies }

pymisp { .dependency }

Python library for MISP (Malware Information Sharing Platform) threat intelligence platform.

@satisfied-by