Security Log Analysis and Incident Response Tool
Security event data arrives from several sources in inconsistent formats, which slows investigation.
A Python parser that ingests logs, normalizes timestamps into a single timeline, and extracts indicators of compromise: IP addresses, domains, file hashes and usernames.
A chronological, SIEM-ready view of an incident, validated against sample datasets, with edge cases and limitations documented.