🛡️ IR-Sim — Incident Response Simulation Tool

Analyze real-world log files to detect attacks, extract IOCs, build attack timelines, and generate professional IR reports. A-Tier portfolio project for SOC Analyst and DFIR roles.

---

📌 What This Tool Does

IR-Sim simulates the work of a SOC Analyst or Incident Responder analyzing logs after a security event. It parses Apache, SSH, and firewall logs, runs 7 detection modules, extracts IOCs, builds a chronological attack timeline, and generates a professional HTML IR report.

---

⚡ Detection Modules

Module	What It Detects	Severity
SSH Brute Force	≥5 failed logins from same IP in 60s	CRITICAL/HIGH
Port Scan	≥8 distinct ports blocked from same IP	HIGH
Web Scanner	Nikto, sqlmap, and other tool signatures	HIGH
SQL Injection	SQLi patterns in HTTP request paths	CRITICAL/HIGH
XSS Attempts	JavaScript injection in HTTP requests	HIGH/MEDIUM
Sensitive File Access	.git, .env, backup files exposed (HTTP 200)	CRITICAL
Privilege Escalation	Root SSH login, sudo to shell	CRITICAL

---

🚀 Quick Start

git clone https://github.com/raza360ahmed/IR-Sim.git
cd IR-Sim

# No dependencies needed! Pure Python standard library.
# Run against the included sample logs
python main.py --logs logs/samples/

# Specific files
python main.py --logs logs/samples/apache_access.log logs/samples/auth.log

# Run tests
python -m pytest tests/ -v

---

📁 Project Structure

IR-Sim/
├── main.py                  # Entry point — orchestrates the pipeline
├── requirements.txt         # pytest only
├── README.md
├── .gitignore
│
├── src/
│   ├── parser.py            # Multi-format log parser (Apache, SSH, Firewall)
│   ├── detector.py          # 7 attack detection modules
│   ├── ioc.py               # IOC extraction + timeline builder
│   └── reporter.py          # HTML + JSON report generator
│
├── logs/
│   └── samples/             # Realistic sample logs for testing
│       ├── apache_access.log
│       ├── auth.log
│       └── firewall.log
│
├── tests/
│   └── test_irsim.py        # 22 unit tests
│
└── reports/                 # Generated reports (auto-created)

---

📊 Report Includes

• Incident Confirmed/Denied banner with overall severity
• Executive Summary with immediate action items
• IP IOC Table — all IPs classified as internal/external/malicious
• Attack Timeline — chronological events with MITRE ATT&CK phase labels
• 7 Alert modules — each with evidence lines and remediation steps
• IOC tables — targeted usernames, attacker tools, attacked paths, ports

---

🔬 Log Formats Supported

Format	Example Source
Apache Combined Log Format	/var/log/apache2/access.log
SSH Auth Log	/var/log/auth.log (Ubuntu) or /var/log/secure (CentOS)
UFW/iptables Firewall	/var/log/ufw.log or dmesg

Auto-detection reads the first line and identifies format automatically.

---

🧠 Concepts Demonstrated

• Log normalization — same technique used by Splunk, Elastic SIEM
• Correlation rules — sliding window brute force detection
• MITRE ATT&CK framework — attack phase classification
• IOC extraction — the core output of any IR engagement
• Regex for forensics — extracting structure from unstructured log data

---

⚠️ Legal Note

For educational and authorized use only. Use against your own infrastructure or lab environments.

---

👤 Author

Ahmed Raza
BS Digital Forensics & Cyber Security — Hamdard University
GitHub · LinkedIn