LogLens/tests/fixtures/report_contracts/syslog_legacy/report.json at main · stacknil/LogLens · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
{
  "tool": "LogLens",
  "schema": "loglens.report.v3",
  "schema_version": 3,
  "input": "tests/fixtures/report_contracts/syslog_legacy/input.log",
  "input_mode": "syslog_legacy",
  "assume_year": 2026,
  "timezone_present": false,
  "parser_quality": {
    "total_input_lines": 16,
    "total_lines": 16,
    "skipped_blank_lines": 0,
    "parsed_lines": 14,
    "unparsed_lines": 2,
    "parse_success_rate": 0.8750,
    "top_unknown_patterns": [
      {"pattern": "sshd_connection_closed_preauth", "count": 1},
      {"pattern": "sshd_timeout_or_disconnection", "count": 1}
    ],
    "failure_categories": [
      {"category": "known_program_unknown_message", "count": 2}
    ]
  },
  "parsed_event_count": 14,
  "warning_count": 2,
  "finding_count": 3,
  "event_counts": [
    {"event_type": "ssh_failed_password", "count": 4},
    {"event_type": "ssh_accepted_password", "count": 1},
    {"event_type": "ssh_invalid_user", "count": 3},
    {"event_type": "ssh_failed_publickey", "count": 1},
    {"event_type": "pam_auth_failure", "count": 1},
    {"event_type": "session_opened", "count": 1},
    {"event_type": "sudo_command", "count": 3}
  ],
  "findings": [
    {
      "finding_id": "finding:brute_force:4e6aec401a0d45ca",
      "rule_id": "brute_force",
      "rule": "brute_force",
      "episode_index": 1,
      "subject_kind": "source_ip",
      "subject": "203.0.113.10",
      "grouping_key": "source_ip",
      "threshold": 5,
      "observed_count": 5,
      "event_count": 5,
      "window_start": "2026-03-10 08:11:22",
      "window_end": "2026-03-10 08:18:05",
      "evidence_event_ids": ["line:1", "line:2", "line:3", "line:4", "line:5"],
      "verdict_boundary": "triage_signal_not_compromise_or_attribution",
      "usernames": [],
      "summary": "5 failed SSH attempts from 203.0.113.10 within 10 minutes."
    },
    {
      "finding_id": "finding:multi_user_probing:d63d2a332522d0e3",
      "rule_id": "multi_user_probing",
      "rule": "multi_user_probing",
      "episode_index": 1,
      "subject_kind": "source_ip",
      "subject": "203.0.113.10",
      "grouping_key": "source_ip",
      "threshold": 3,
      "observed_count": 5,
      "event_count": 5,
      "window_start": "2026-03-10 08:11:22",
      "window_end": "2026-03-10 08:18:05",
      "evidence_event_ids": ["line:1", "line:2", "line:3", "line:4", "line:5"],
      "verdict_boundary": "triage_signal_not_intent_or_attribution",
      "usernames": ["admin", "deploy", "guest", "root", "test"],
      "summary": "203.0.113.10 targeted 5 usernames within 15 minutes."
    },
    {
      "finding_id": "finding:sudo_burst:12c5005a84ce3296",
      "rule_id": "sudo_burst",
      "rule": "sudo_burst",
      "episode_index": 1,
      "subject_kind": "username",
      "subject": "alice",
      "grouping_key": "username",
      "threshold": 3,
      "observed_count": 3,
      "event_count": 3,
      "window_start": "2026-03-10 08:21:00",
      "window_end": "2026-03-10 08:24:15",
      "evidence_event_ids": ["line:7", "line:8", "line:9"],
      "verdict_boundary": "triage_signal_not_maliciousness_or_authorization",
      "usernames": [],
      "summary": "alice ran 3 sudo commands within 5 minutes."
    }
  ],
  "warnings": [
    {"line_number": 15, "category": "known_program_unknown_message", "reason": "unrecognized auth pattern: sshd_connection_closed_preauth"},
    {"line_number": 16, "category": "known_program_unknown_message", "reason": "unrecognized auth pattern: sshd_timeout_or_disconnection"}
  ]
}