Log Sentinel

Inspiration

I'm a beginner in cybersecurity — this is my very first solo project. While studying networking fundamentals, I kept running into the same idea: authentication logs contain everything you need to catch an attack, but they're incredibly noisy. A human can spot one suspicious login line, but a coordinated brute-force attempt, a rapid account takeover, or a privilege escalation attack hides easily inside hundreds of ordinary log entries.

I wanted to build something that could surface those patterns automatically — and, since this is an OpenAI hackathon, explain them the way a human security analyst would, in plain English.

What it does

Log Sentinel scans SSH and sudo authentication logs and detects three attack patterns using transparent, rule-based logic:

• Possible brute force — 8+ failed login attempts from one IP within a 5-minute window
• Rapid login IP change — the same user account logging in from two different IPs within 15 minutes
• Suspicious sudo command burst — 3+ sudo commands in a short window that occur overnight or touch sensitive targets like /etc/shadow or /etc/passwd

Each detected finding is then sent to GPT-5.6, which returns a plain-English diagnosis, a severity rating (Low/Medium/High), and specific recommended remediation steps — all through a simple Streamlit interface where you can upload or paste a log file and get results instantly.

How I built it

I designed and manually tested the detection logic myself first — the regex-based log parsing and the three detection rules — to make sure I actually understood why each pattern is suspicious before writing a single line asking AI for help. I tested this against both synthetic and realistic sample log data to confirm accuracy.

From there, I used Codex to build out the rest: refining my detection rules into cleaner sliding-window logic, building the GPT-5.6 integration with a structured JSON schema for reliable output, and building the Streamlit interface end-to-end. This let me focus my own learning on the security concepts, while accelerating the parts of development I had zero prior experience with.

Challenges I ran into

The biggest challenge wasn't technical — it was billing. I couldn't complete a live test of the GPT-5.6 API call before submission due to a regional payment method limitation (UPI isn't supported by OpenAI's billing, and I didn't have another way to add funds in time). To validate that my entire pipeline actually worked end-to-end, I temporarily swapped in an equivalent free-tier model as a stand-in, confirmed the full system — parsing, detection, AI diagnosis, and UI — worked correctly, and then reverted back to the real GPT-5.6 integration for submission. The ai_recommendations.py code is complete, correctly structured, and ready to run the moment billing is resolved.

What I learned

This project taught me far more than I expected for a first attempt: how authentication logs are structured, how brute-force and privilege-escalation attacks actually look in raw data, why IP addresses alone can't prove physical location, and how the NIST incident-response lifecycle (detect → contain → recover) maps onto a real tool. I also learned the value of a hybrid AI approach — keeping detection deterministic and auditable, and using AI only for explanation, rather than letting a model make the actual security decision.

Built With

• codex
• cybersecurity
• python
• streamlit