Automated Event Log Analysis And Alert System Via Email

Abstract

The analysis of Windows event logs forms a vital basis today in this fast-changing cyber landscape for obtaining control accompanied by integrity and security of IT ecosystems. Traditional manual log analysis is, however, time-demanding, prone to errors, and very often financially inaccessible to purchase expensive SIEM for small and medium-sized enterprises (SMEs). To address these challenges, the automated “Event Log Analysis and Alert System via Email” project is introduced as an innovative solution that might easy access to automatic log analysis. It uses Python scripting and Windows PowerShell commands to automate data collection, analysis, and distribution from event logs to facilitate efficient and timely monitoring and response to security events. Using opensource tools and technologies within the project offers a cost-effective solution comparing with expensive Security Information and Event Management (SIEM) systems. Upon the first execution, clients provide inputs like email, hours, and select storage options (email or Google Drive). The system stores these inputs for future use and executes the exe file automatically every 24 hours using Task Scheduler, Thus continuously collecting, storing, and sending log data without further user intervention. The system detect Critical, Warning, Error and AuditFailure Events and then create these log data as a CSV file for send email and stores in Google Drive. It can also store this log data in a central MySQL database on the phpmyadmin.co site to send to the dashboard using PHP. This project has a dashboard controlled by the SOC, or Security Administrator, which has a drop-down button where they can select EventIDs and get detailed information of how many hosts are affected by each EventID. This would significantly improve the speed and accuracy of identifying threats, troubleshooting, and incident response. It tremendously enhances the overall cybersecurity and system activity monitoring of an IT environment.