Abstract:
The analysis of Windows event logs forms a vital basis today in this fast-changing cyber
landscape for obtaining control accompanied by integrity and security of IT ecosystems.
Traditional manual log analysis is, however, time-demanding, prone to errors, and very
often financially inaccessible to purchase expensive SIEM for small and medium-sized
enterprises (SMEs). To address these challenges, the automated “Event Log Analysis and
Alert System via Email” project is introduced as an innovative solution that might easy
access to automatic log analysis. It uses Python scripting and Windows PowerShell
commands to automate data collection, analysis, and distribution from event logs to
facilitate efficient and timely monitoring and response to security events. Using opensource tools and technologies within the project offers a cost-effective solution comparing
with expensive Security Information and Event Management (SIEM) systems. Upon the
first execution, clients provide inputs like email, hours, and select storage options (email
or Google Drive). The system stores these inputs for future use and executes the exe file
automatically every 24 hours using Task Scheduler, Thus continuously collecting, storing,
and sending log data without further user intervention. The system detect Critical, Warning,
Error and AuditFailure Events and then create these log data as a CSV file for send email
and stores in Google Drive. It can also store this log data in a central MySQL database on
the phpmyadmin.co site to send to the dashboard using PHP. This project has a dashboard
controlled by the SOC, or Security Administrator, which has a drop-down button where
they can select EventIDs and get detailed information of how many hosts are affected by
each EventID. This would significantly improve the speed and accuracy of identifying
threats, troubleshooting, and incident response. It tremendously enhances the overall
cybersecurity and system activity monitoring of an IT environment.
