Search Results for "parse files"

This is a collection of command line and web based tools for use in incident response and long term analysis use as part of ongoing situational awareness. Often when responding to a security incident the only files available are web server and proxy server logs. The tools here will aid you in detecting odd traffic such as botnet beaconing and SQL Injection attempts. The large amount of data can be overwhelming and the tools in the Log Analysis Tool Kit can be used to parse these files and build a MySQL database for querying. Currently the log formats supported are: Proxy Logs: Squid Bluecoat Web Server Logs: Apache IIS Your feedback is always appreciated. ...