SOC-Log-Analyzer-Python/report.py at main · SuchirBob/SOC-Log-Analyzer-Python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
"""
report.py
Generates terminal-friendly and text-file security reports from alerts.
"""

from utils import timestamp, ensure_dir
import os

BANNER = "=" * 42
DIVIDER = "-" * 42


def format_alert(alert: dict) -> str:
    lines = [
        "",
        f"[{alert['severity']}]",
        "",
        alert["title"],
        "",
        "IP Address:",
        alert["ip"],
        "",
        alert["detail"],
        "",
        DIVIDER,
    ]
    return "\n".join(lines)


def build_report_text(alerts, source_files=None) -> str:
    lines = [
        BANNER,
        "SOC Log Analyzer",
        BANNER,
        "",
        f"Generated: {timestamp()}",
    ]

    if source_files:
        lines.append("Sources: " + ", ".join(source_files))

    if not alerts:
        lines.append("")
        lines.append("No suspicious activity detected.")
    else:
        for alert in alerts:
            lines.append(format_alert(alert))

    high = sum(1 for a in alerts if a["severity"] == "HIGH")
    medium = sum(1 for a in alerts if a["severity"] == "MEDIUM")
    low = sum(1 for a in alerts if a["severity"] == "LOW")

    lines += [
        "",
        "Summary",
        "",
        f"High Alerts   : {high}",
        f"Medium Alerts : {medium}",
        f"Low Alerts    : {low}",
        "",
    ]

    return "\n".join(lines)


def print_report(alerts, source_files=None) -> None:
    print(build_report_text(alerts, source_files))


def save_report(alerts, output_path="reports/report.txt", source_files=None) -> str:
    ensure_dir(os.path.dirname(output_path) or ".")
    text = build_report_text(alerts, source_files)
    with open(output_path, "w", encoding="utf-8") as f:
        f.write(text)
    return output_path