securitylogai 0.1.0__py3-none-any.whl

securitylogai/__init__.py

@@ -0,0 +1,13 @@
+from .parser import parse_apache_log
+from .detector import detect_bruteforce
+from .reporter import generate_report
+from .ai import explain_attack
+from .utils import normalize_ip
+
+__all__ = [
+    "parse_apache_log",
+    "detect_bruteforce",
+    "generate_report",
+    "explain_attack",
+    "normalize_ip",
+]

securitylogai/ai.py

@@ -0,0 +1,8 @@
+def explain_attack(data):
+    return {
+        "attack_type": data.get("attack_type", "Brute Force"),
+        "risk": data.get("risk", "High"),
+        "mitre_attack": data.get("mitre_attack", "T1110"),
+        "recommendation": data.get("recommendation", ["Enable MFA", "Block IP", "Monitor Login Attempts"]),
+        "summary": f"Potential {data.get('attack_type', 'Brute Force').lower()} activity detected from {data.get('ip', 'unknown IP')}."
+    }

securitylogai/detector.py

@@ -0,0 +1,13 @@
+def detect_bruteforce(events, threshold=20):
+    counts = {}
+    for event in events:
+        ip = event.get("ip")
+        if not ip:
+            continue
+        counts[ip] = counts.get(ip, 0) + 1
+
+    suspicious = []
+    for ip, count in counts.items():
+        if count > threshold:
+            suspicious.append({"ip": ip, "count": count, "risk": "HIGH", "attack_type": "Brute Force"})
+    return suspicious

securitylogai/parser.py

@@ -0,0 +1,11 @@
+import re
+
+IP_RE = re.compile(r"(\d{1,3}(?:\.\d{1,3}){3})")
+
+
+def parse_apache_log(log_line):
+    match = IP_RE.search(log_line)
+    if not match:
+        return None
+
+    return {"ip": match.group(1), "raw": log_line.strip()}

securitylogai/reporter.py

@@ -0,0 +1,12 @@
+def generate_report(findings):
+    sections = []
+    for item in findings:
+        sections.append(
+            f"""
+IP: {item['ip']}
+Attempts: {item['count']}
+Risk: {item['risk']}
+Attack Type: {item.get('attack_type', 'Unknown')}
+""".strip()
+        )
+    return "\n\n".join(sections)

securitylogai/utils.py

@@ -0,0 +1,2 @@
+def normalize_ip(ip):
+    return ip.strip() if isinstance(ip, str) else ip

securitylogai-0.1.0.dist-info/METADATA

@@ -0,0 +1,87 @@
+Metadata-Version: 2.4
+Name: securitylogai
+Version: 0.1.0
+Summary: AI-powered security log analysis toolkit
+Author: Isaac Talb
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/IsaacTalb/securitylogai
+Project-URL: Repository, https://github.com/IsaacTalb/securitylogai
+Project-URL: Issues, https://github.com/IsaacTalb/securitylogai/issues
+Keywords: security,logs,ai,cybersecurity,fastapi
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# securitylogai
+
+Reusable Python engine for parsing logs, detecting suspicious activity, generating reports, and producing AI explanations.
+
+## What it does
+
+- Parse Apache-style logs
+- Detect brute-force style patterns
+- Generate readable reports
+- Produce AI-ready summaries
+
+## Install from PyPI
+
+```bash
+pip install securitylogai
+```
+
+## Install from TestPyPI
+
+```bash
+pip install -i https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple securitylogai
+```
+
+## Usage
+
+```python
+from securitylogai import parse_apache_log, detect_bruteforce, generate_report, explain_attack
+
+log = "127.0.0.1 - - [30/May/2026:12:00:00 +0630] \"POST /login HTTP/1.1\" 401 532"
+event = parse_apache_log(log)
+findings = detect_bruteforce([event] * 25)
+report = generate_report(findings)
+summary = explain_attack(findings[0]) if findings else None
+```
+
+## Build and publish
+
+```bash
+python -m pip install --upgrade build twine
+python -m build
+python -m twine check dist/*
+python -m twine upload dist/*
+```
+
+## Publish to TestPyPI first
+
+```bash
+python -m twine upload --repository testpypi dist/*
+```
+
+## Package structure
+
+- `parser.py` - parse log lines
+- `detector.py` - detect suspicious patterns
+- `reporter.py` - create text reports
+- `ai.py` - AI explanation layer
+- `utils.py` - shared helpers
+
+## Roadmap
+
+- add Nginx / SSH / Windows parsing
+- add provider adapters for OpenAI, Gemini, Ollama
+- add CLI and JSON output
+- add tests and release workflow

securitylogai-0.1.0.dist-info/RECORD

@@ -0,0 +1,11 @@
+securitylogai/__init__.py,sha256=cR0d2UIEzaE-Idluv4SlHGAihznffkg6GzFxffohP3o,308
+securitylogai/ai.py,sha256=dpxYL7OsYEnCeURMiQ4wU_Rt_dx0gJ01gAULZhHtonw,454
+securitylogai/detector.py,sha256=JOSxn-FV5ngRhsZAm3yDJokx4MKFwX7Rgtiqgc-Fnk0,413
+securitylogai/parser.py,sha256=t03xVeJz3bePHbl6zhqAnJTdGQa0VWx-617v0TyF40c,228
+securitylogai/reporter.py,sha256=QIB7tnssd8I0FE-okMmAAOivQKyVwFiaBV39uwFAH8Y,287
+securitylogai/utils.py,sha256=Vn6L0rKThX7jpiI5rMOu7nLIzNLm2F30-U2TZCDWbKk,76
+securitylogai-0.1.0.dist-info/licenses/LICENSE,sha256=Ac3lhgXOLBB_KEvJcLxqE8Xo_gBpyJrVVRS_grOdU8A,13
+securitylogai-0.1.0.dist-info/METADATA,sha256=BYpHFsGbKSJ3adtGev7fStS1kuIIXSWhOGpF9O0DQbM,2452
+securitylogai-0.1.0.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
+securitylogai-0.1.0.dist-info/top_level.txt,sha256=f6MNe09RexBOybRbUVsdpLMVM3wdJ-vSjLrW6ScyeVM,14
+securitylogai-0.1.0.dist-info/RECORD,,

securitylogai-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (82.0.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

securitylogai-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1 @@
+MIT License

securitylogai-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+securitylogai