// SOC Portfolio — Lab 29

Python Security Automation

Three SOC automation scripts built in Python 3 — log parsing, IP reputation lookup, and triage report generation

Date: May 12, 2026

Language: Python 3.11.9

Platform: Kali Linux

API: AbuseIPDB v2

Scripts: 3

Lab Summary

3Scripts Built

6Failed Logins Detected

3Source IPs Identified

1API Integrated

4Accounts Targeted

Environment

Field	Detail
Platform	Kali Linux (VMware Workstation)
Language	Python 3.11.9
Editor	GNU nano 8.1
Log File	auth.log (simulated SSH authentication log)
External API	AbuseIPDB v2 — IP reputation lookup
Scripts	log_parser.py, ip_reputation.py, alert_summary.py
Working Directory	~/soc-lab-29-python

Script 1 — Log Parser

log_parser.py reads a simulated SSH authentication log and extracts all failed login attempts, displaying each event with full timestamp, account name, and source IP.

Key output:

6 failed login attempts detected
Events from 3 unique source IPs: 192.168.1.105, 10.0.0.22, 172.16.0.55
Accounts targeted: admin (3), root (1), guest (1), test (1)

Script 2 — IP Reputation Checker

ip_reputation.py queries the AbuseIPDB REST API to retrieve threat intelligence on a suspicious IP address identified during log analysis.

API response fields returned:

IP Address, Abuse Score, Total Reports
Country, ISP, Last Reported date
Target IP: 192.168.1.105 — private RFC 1918 address, 0% abuse score (expected)

Script 3 — Alert Summary Report

alert_summary.py combines log parsing and IP analysis into a formatted SOC triage report, automatically ranking offending accounts by attempt count and generating recommended containment actions.

Report output included:

Timestamp, log file, and total failed login count
Top offending accounts ranked by attempt count
Recommended actions: firewall block, Tier 2 escalation, lockout policy review

Findings

Account	Failed Attempts	Source IPs	Action
admin	3	192.168.1.105, 10.0.0.22	ESCALATE
root	1	192.168.1.105	MONITOR
guest	1	192.168.1.105	MONITOR
test	1	10.0.0.22	MONITOR

MITRE ATT&CK Mapping

Field	Value
Tactic	Credential Access (TA0006)
Technique	Brute Force (T1110)
Sub-technique	Password Guessing (T1110.001)
Objective	Gain unauthorized SSH access via repeated credential attempts

Screenshots

Script 1 — log_parser.py — 6 failed login attempts detected

Script 2 — ip_reputation.py — AbuseIPDB API response for 192.168.1.105

Script 3 — alert_summary.py — formatted SOC triage report with recommendations

Outcome

> log_parser.py — 6 failed SSH login attempts detected across 3 source IPs
> ip_reputation.py — AbuseIPDB API integrated and queried successfully
> alert_summary.py — triage report generated with ranked offenders and recommendations
> Python scripting demonstrated as viable SOC automation tool
> Lab 29 confirmed — all scripts functional on Kali Linux