securityjoes / masterparser Goto Github PK

View Code? Open in Web Editor NEW

446.0 9.0 48.0 234 KB

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

Home Page: https://github.com/YosfanEilay

License: MIT License

PowerShell 100.00%

dfir dfir-automation infosec ir mdr soc cyber-security powershell reporting tools

masterparser's Introduction

MasterParser v2.5

Stop wasting time, let MasterParser do the work!

What is MasterParser ?

MasterParser stands as a robust Digital Forensics and Incident Response tool meticulously crafted for the analysis of Linux logs within the var/log directory. Specifically designed to expedite the investigative process for security incidents on Linux systems, MasterParser adeptly scans supported logs, such as auth.log for example, extract critical details including SSH logins, user creations, event names, IP addresses and much more. The tool's generated summary presents this information in a clear and concise format, enhancing efficiency and accessibility for Incident Responders. Beyond its immediate utility for DFIR teams, MasterParser proves invaluable to the broader InfoSec and IT community, contributing significantly to the swift and comprehensive assessment of security events on Linux platforms.

MasterParser Wallpapers

Love MasterParser as much as we do?
Dive into the fun and jazz up your screen with our exclusive MasterParser wallpapers!
Click the link below and get ready to add a splash of excitement to your device!
Download Wallpaper

Supported Logs Format

This is the list of supported log formats within the var/log directory that MasterParser can analyze.
In future updates, MasterParser will support additional log formats for analysis.

Supported Log Formats List
auth.log

Feature & Log Format Requests:

If you wish to propose the addition of a new feature \ log format,
kindly submit your request by creating an issue
Click here to create a request

How To Use ?

How To Use - Text Guide

From this GitHub repository press on "<> Code" and then press on "Download ZIP".
From "MasterParser-main.zip" export the folder "MasterParser-main" to you Desktop.
Open a PowerSehll terminal and navigate to the "MasterParser-main" folder.

# How to navigate to "MasterParser-main" folder from the PS terminal
PS C:\> cd "C:\Users\user\Desktop\MasterParser-main\"

Now you can execute the tool, for example see the tool command menu, do this:

# How to show MasterParser menu
PS C:\Users\user\Desktop\MasterParser-main> .\MasterParser.ps1 -O Menu

To run the tool, put all your /var/log/* logs in to the 01-Logs folder, and execute the tool like this:

# How to run MasterParser
PS C:\Users\user\Desktop\MasterParser-main> .\MasterParser.ps1 -O Start

That's it, enjoy the tool!

How To Use - Video Guide

How.To.Use.-.Video.Guide.mp4

MasterParser Social Media Publications

Social Media Posts
1. First Tool Post
2. First Tool Story Publication By Help Net Security
3. Second Tool Story Publication By Forensic Focus
4. MasterParser featured in Help Net Security: 20 Essential Open-Source Cybersecurity Tools That Save You Time

masterparser's People

Contributors

Stargazers

Watchers

Forkers

erangoldman p4n7h3rx shabeebpm p2x3yz cybersecops sreuben04 xenoxavier uguronduc aankitpatel tomyang9 blade3 mynameisjimmy rafiq0007 mbaroudi whitehatzone zha0 nealpoz dark0pcodes morpheusc straysheep-dev emadyay ramirezrick allesanddro 0999ad eyalatox blue-infosec timb-machine-mirrors tmichett carmelofdz swanoop wagneroliveira2000 5l1v3r1 youngjun-chang malikvivek rihab03 tobey123 juanlegrange1994 west-wind jason-yung red-spect3r zhnathaniellee acti0nus jawczan dmore caliskanfurkan

masterparser's Issues

Centos Support

Hi,

Does this tool supports CentOS and RedHat systems?
By the looks of it, secure logs are not supported.

Warm Regards

AuthLogParser doesn't working

Hello YosfanEilay,

I have tried to test the tool as per the recommendations on a Windows machine but it didn't work. I have used auth.log from 2 Linux machines. Out as below:

AuthLogParser Banner

Write-Output " ___ __ __ __ "
Write-Output " / | __ __/ // / / / ____ ____ _ "
Write-Output ' / /| |/ / / / __/ __ \ / / / __ / __ / ' Write-Output " / ___ / /_/ / /_/ / / / / /___/ /_/ / /_/ / " Write-Output "/_/ |_\__,_/\__/_/ /_(_)_____/\____/\__, / " Write-Output " ____ /____/ " Write-Output " / __ \____ ______________ _____ " Write-Output ' / /_/ / __ / / / _ / / '
Write-Output " / / // / / ( ) __/ / "
Write-Output " // _,// //_/_/ "
Write-Output "
Write-Output " github.com/YosfanEilay"
Write-Output " Version: 1.0v"
Write-Output "

NotFoundHashTable

$NotFoundHashTable = @{}

Variable to store where AuthLogParser is running from.

$RunningPath = Get-Location

save path from execution and move the variable to dot source -> CreateLogCopy.ps1

$AuthLogPath = $($args[0])

if statement to check if $args[0] is empty

if ($AuthLogPath.Length -ge 1) {
}

if empty, execute instructions

else {
Write-Output "[!] Auth.Log file not found."
Start-Sleep -Milliseconds 500
Write-Output "How to execute AuthLogParser ?"
Start-Sleep -Milliseconds 500
Write-Output "+----------------------------------------------------------------------------------------+"
Write-Output "| PS C:\Users{user}\Desktop\AuthLogParser> .\AuthLogParser.ps1 C:\PATH\TO\Auth.Log\File |"
Write-Output "+----------------------------------------------------------------------------------------+"
Write-Output ""
Start-Sleep -Milliseconds 500
exit
}

Dot Sourcing -> 01-TimePatch.ps1

. "$RunningPath\03-TimePatch\01-TimePatch.ps1"

if statement to check if TimePatch is needed

if ($CreateLogCopy_Flag -eq "True") {

Dot Sourcing -> CreateLogCopy.ps1

. "$RunningPath\01-LogCopy\CreateLogCopy.ps1"
}

Dot Sourcing -> FileSummaryReport.ps1

. "$RunningPath\02-Features\01-FileSummaryReport.ps1"

Dot Sourcing -> 02-EventNameTable.ps1

. "$RunningPath\02-Features\02-EventNameTable.ps1"

Dot Sourcing -> 03-IPAddressTable.ps1

. "$RunningPath\02-Features\03-IPAddressTable.ps1"

Dot Sourcing -> 04-SSHTable.ps1

. "$RunningPath\02-Features\04-SSHTable.ps1"

Dot Sourcing -> 05-UsersGroupsActivity.ps1

. "$RunningPath\02-Features\05-UsersGroupsActivity.ps1"

Dot Sourcing -> 06-GeneralActivity.ps1

. "$RunningPath\02-Features\06-GeneralActivity.ps1"

if ($NotFoundHashTable.Values.Count -ge 1) {

Element That Does Not Exist in This auth.log File

Write-Output "
Write-Output "Element That Does Not Exist in This auth.log File"
Write-Output "+-----------------------------------------------+"
$NotFoundHashTable.Values
}

delete the auth.log copy after using it.

Start-Sleep -Seconds 1
Remove-Item -Path $AuthLogCopyLocation

Please advise what is wrong with this.

Linux Support

It will be great if this tool can run on Linux (Ubuntu and Redhat-based)