Python WAF Logları Python ile Nasıl Analiz Edilir?

12345678910111213141516171819202122232425262728293031323334353637383940414243444546
import csv
from datetime import datetime
from collections import Counter, defaultdict

logfile = 'waf_logs.csv'

with open(logfile, newline='') as f:
    reader = csv.DictReader(f)
    per_minute = defaultdict(int)
    tag_counter = Counter()
    ip_counter = Counter()
    endpoint_counter = Counter()

    for row in reader:
        ts = datetime.strptime(row['timestamp'], '%Y-%m-%d %H:%M:%S')
        minute = ts.replace(second=0, microsecond=0)
        per_minute[minute] += 1

        tag = row.get('alert_tag', 'NONE')
        tag_counter[tag] += 1

        ip = row.get('src_ip')
        if ip:
            ip_counter[ip] += 1

        endpoint = row.get('target')
        if endpoint:
            endpoint_counter[endpoint] += 1

[b]Önemli metrikleri çıktı olarak verin[/b]
print("Islenen istek sayısı per minute:")
for m, c in sorted(per_minute.items()):
    print(f"{m}: {c}")

print("En sık tetiklenen uyarılar:")
for t, c in tag_counter.most_common(5):
    print(f"{t}: {c}")

print("En aktif IP'ler:")
for ip, c in ip_counter.most_common(5):
    print(f"{ip}: {c}")

print("En çok hedeflenen uç noktalar:")
for ep, c in endpoint_counter.most_common(5):
    print(f"{ep}: {c}")