l4r1k / citrixnetscaleranalysis Goto Github PK

Larger data sets (50MB+) currently cause instability with the notebook and extremely long processing times. Refactoring to dask will help via parallelization of both the log reading and analysis.

The first time for log time ranges is missing a row for the HTTP error logs.

There is inconsistency between tabs regarding the order of the columns. As a preference, I believe the SuspiciousNotice tab represents a common order as it begins with a timestamp.

Please submit any new issues separately - this issue only exists as a transition of my todo list to github

Todo:

• Some lines in httpaccess where there's quotes in the request are breaking the parsing (mostly malicious scanning for example)
• Add parsing of /tmp xmls
• Added automatic path making if triage script is used for evidence collection (standardized output)
• Added required evidence to readme
• Support for httperror timestamp
• Add ui widgets for configuration section (improve ease of use)
• Change timestamp tab output to have summary of key findings as well based available dataframes
• Auth.log and sslvpn message parsing from notice.log
• Add 'sesame', 'vmlinuz', 'omelette' to search terms for httperror logs
  • related to observed XMRig miner activity
• Add consolidation of observed Ips from logs + Geoip location
• Add parsing of Nsvpn logs
• HTTP Logs - grab php request attempts related to shell
• Add parsing of httperror
• Add retrieval of times from all logs
• Add separate vars for parsing of different xml locations

Bugs:

• Append TEMPLATEPATH/BOOKMARKPATH to fp.name before appending to payloadDict to avoid overwriting XMLs if they exist in both