{"id":30450076,"url":"https://github.com/hq969/cyber-threat-intelligence-analyzer","last_synced_at":"2026-05-03T22:34:10.549Z","repository":{"id":311256944,"uuid":"1043171069","full_name":"hq969/Cyber-Threat-Intelligence-Analyzer","owner":"hq969","description":"Cybersecurity Threat Intelligence Analyzer — Log analysis tool with rule-based detections and ML anomaly detection, featuring a Streamlit dashboard and CLI support.","archived":false,"fork":false,"pushed_at":"2025-08-23T11:38:52.000Z","size":74,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-11-01T04:21:36.301Z","etag":null,"topics":["cybersecurity","docker","machine-learning","pytest","security-monitoring","streamlit","threat-intelligence"],"latest_commit_sha":null,"homepage":"http://localhost:8501","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hq969.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-08-23T09:35:59.000Z","updated_at":"2025-09-05T08:40:15.000Z","dependencies_parsed_at":"2025-08-23T12:56:06.493Z","dependency_job_id":"a9306314-479d-4d07-8dbf-cbc2b61ec312","html_url":"https://github.com/hq969/Cyber-Threat-Intelligence-Analyzer","commit_stats":null,"previous_names":["hq969/cyber-threat-intelligence-analyzer"],"tags_count":0,"template":true,"template_full_name":null,"purl":"pkg:github/hq969/Cyber-Threat-Intelligence-Analyzer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hq969%2FCyber-Threat-Intelligence-Analyzer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hq969%2FCyber-Threat-Intelligence-Analyzer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hq969%2FCyber-Threat-Intelligence-Analyzer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hq969%2FCyber-Threat-Intelligence-Analyzer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hq969","download_url":"https://codeload.github.com/hq969/Cyber-Threat-Intelligence-Analyzer/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hq969%2FCyber-Threat-Intelligence-Analyzer/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32587820,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-03T22:12:39.696Z","status":"ssl_error","status_checked_at":"2026-05-03T22:09:10.534Z","response_time":103,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cybersecurity","docker","machine-learning","pytest","security-monitoring","streamlit","threat-intelligence"],"created_at":"2025-08-23T13:23:26.771Z","updated_at":"2026-05-03T22:34:10.535Z","avatar_url":"https://github.com/hq969.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 🔒 Cybersecurity Threat Intelligence Analyzer\n\nA Python-based **threat intelligence tool** that ingests logs (CSV, JSON, Apache access logs), normalizes them, applies **rule-based detections** (brute-force, error spikes, suspicious UAs/paths, request floods), and runs **ML anomaly detection** (IsolationForest) to highlight unusual IP behavior.  \n\nIncludes:\n- 📊 **Streamlit dashboard** for interactive analysis  \n- ⚡ **CLI mode** for headless batch processing  \n- 🐳 **Dockerfile** for containerized deployment  \n- ✅ **Tests** with pytest  \n- 📁 **Sample logs** for quick testing  \n\n---\n\n## 🚀 Features\n- **Multiple log formats** supported (CSV, JSON, Apache combined log format)\n- **Rule-based detections**:\n  - Brute-force login attempts (failed-login bursts)\n  - High error ratios (e.g. HTTP 5xx floods)\n  - Suspicious paths (`/wp-admin`, `/phpmyadmin`, `.env`, etc.)\n  - Suspicious user agents (e.g., `sqlmap`, `nmap`, curl, requests)\n  - Request floods (per-IP spikes)\n- **ML anomaly detection**:\n  - IsolationForest on per-IP request features\n  - Flags outliers in traffic patterns\n- **Exportable results** (CSV outputs)\n- **Interactive dashboard** with charts\n\n---\n\n## 📦 Installation\n\n```bash\ngit clone https://github.com/your-username/cyber-threat-intel-analyzer.git\ncd cyber-threat-intel-analyzer\n\n# Setup venv (optional)\npython -m venv .venv\nsource .venv/bin/activate   # Windows: .venv\\Scripts\\activate\n\n# Install dependencies\npip install -r requirements.txt\n````\n\n---\n\n## 🎛️ Usage\n\n### 1. Streamlit UI (Dashboard)\n\n```bash\nstreamlit run cyber_threat_intel_analyzer.py\n```\n\nOpen [http://localhost:8501](http://localhost:8501) in your browser.\nUpload logs and explore results visually.\n\n---\n\n### 2. CLI Mode (Headless Batch Processing)\n\n```bash\npython cli_ingest.py --in samples/sample_access.log --out results/\n```\n\nOutputs:\n\n* `normalized_events.csv` – normalized logs\n* `rule_hits.csv` – rule detections\n* `ml_anomalies.csv` – ML-based anomalies\n\n---\n\n### 3. Docker Deployment\n\n```bash\ndocker build -t threat-analyzer .\ndocker run --rm -p 8501:8501 -v \"$PWD:/data\" threat-analyzer\n```\n\n---\n\n## 🧪 Running Tests\n\n```bash\npytest tests/\n```\n\n---\n\n## 📁 Repository Structure\n\n```\n.\n├── cyber_threat_intel_analyzer.py   # Streamlit app\n├── cli_ingest.py                    # CLI tool\n├── requirements.txt\n├── Dockerfile\n├── README.md\n├── tests/\n│   └── test_rules.py                # Rule-based detection tests\n└── samples/\n    └── sample_access.log            # Example Apache log\n```\n\n---\n\n## 📊 Example Detection Output\n\nFrom the included `samples/sample_access.log`:\n\n* 🚨 Brute-force login attempts (401 spam from `203.0.113.5`)\n* 🚨 Suspicious paths (`/wp-admin`, `/phpmyadmin`, `.env`)\n* 🚨 Suspicious UAs (`sqlmap`, `nmap`, `requests`)\n* ⚠️ Request floods from aggressive scanners\n\n---\n\n## 🔮 Roadmap\n\n* [ ] Add **Syslog \u0026 NGINX error log parsing**\n* [ ] Geo-IP enrichment (map attacker IPs)\n* [ ] Sigma rule integration\n* [ ] Slack/Email alerting for rule hits\n\n---\n\n## 📜 License\n\nMIT License © 2025\n\n---\n\n### 👨‍💻 Author\n\nHarsh Sonkar\n🚀 Data Science • Cybersecurity • Cloud Engineer\n\n```\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhq969%2Fcyber-threat-intelligence-analyzer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhq969%2Fcyber-threat-intelligence-analyzer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhq969%2Fcyber-threat-intelligence-analyzer/lists"}