Add parsers for syslog, Windows firewall, CSV, and Graylog formats

c2sentinel.py

@@ -1074,30 +1074,108 @@ class LogParser:
 
     @staticmethod
     def parse_syslog(log_line: str) -> Optional[Dict]:
-        """Parse common syslog/netflow formats."""
-        patterns = [
-            r'(\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}).*?(\d+\.\d+\.\d+\.\d+):(\d+)\s*->\s*(\d+\.\d+\.\d+\.\d+):(\d+)',
-            r'src=(\d+\.\d+\.\d+\.\d+).*?dst=(\d+\.\d+\.\d+\.\d+).*?sport=(\d+).*?dport=(\d+)',
-        ]
-
-        for pattern in patterns:
-            match = re.search(pattern, log_line)
-            if match:
-                groups = match.groups()
+        """Parse common syslog/firewall formats."""
+        from datetime import datetime
+
+        # Linux iptables format: SRC=x.x.x.x DST=x.x.x.x SPT=xxx DPT=xxx LEN=xxx
+        iptables_match = re.search(
+            r'(\w{3}\s+\d+\s+\d+:\d+:\d+).*?SRC=(\d+\.\d+\.\d+\.\d+).*?DST=(\d+\.\d+\.\d+\.\d+).*?SPT=(\d+).*?DPT=(\d+)(?:.*?LEN=(\d+))?',
+            log_line, re.IGNORECASE
+        )
+        if iptables_match:
+            try:
+                ts_str = iptables_match.group(1)
+                # Parse timestamp like "Jan 18 10:00:00"
+                dt = datetime.strptime(f"2026 {ts_str}", "%Y %b %d %H:%M:%S")
+                return {
+                    'timestamp': dt.timestamp(),
+                    'src_ip': iptables_match.group(2),
+                    'dst_ip': iptables_match.group(3),
+                    'src_port': int(iptables_match.group(4)),
+                    'dst_port': int(iptables_match.group(5)),
+                    'protocol': 'tcp',
+                    'bytes_sent': int(iptables_match.group(6) or 0),
+                    'bytes_recv': 0
+                }
+            except:
+                pass
+
+        # Windows Firewall format: TimeGenerated=xxx SourceAddress=xxx DestAddress=xxx DestPort=xxx
+        win_match = re.search(
+            r'TimeGenerated=(\S+).*?(?:SourceAddress|SourceIP)=(\d+\.\d+\.\d+\.\d+).*?(?:DestAddress|DestinationIP)=(\d+\.\d+\.\d+\.\d+).*?(?:DestPort|DestinationPort)=(\d+)',
+            log_line, re.IGNORECASE
+        )
+        if win_match:
+            try:
+                ts_str = win_match.group(1)
+                dt = datetime.fromisoformat(ts_str.replace('Z', '+00:00'))
+                return {
+                    'timestamp': dt.timestamp(),
+                    'src_ip': win_match.group(2),
+                    'dst_ip': win_match.group(3),
+                    'src_port': 0,
+                    'dst_port': int(win_match.group(4)),
+                    'protocol': 'tcp',
+                    'bytes_sent': 0,
+                    'bytes_recv': 0
+                }
+            except:
+                pass
+
+        # Generic key=value format
+        kv_match = re.findall(r'(\w+)=(\S+)', log_line)
+        if kv_match:
+            kv = dict(kv_match)
+            dst_ip = kv.get('dst') or kv.get('DST') or kv.get('DestAddress') or kv.get('dest_ip')
+            dst_port = kv.get('dport') or kv.get('DPT') or kv.get('DestPort') or kv.get('dest_port')
+            if dst_ip and dst_port:
                 try:
-                    if len(groups) == 5:
-                        return {
-                            'timestamp': groups[0],
-                            'src_ip': groups[1],
-                            'src_port': int(groups[2]),
-                            'dst_ip': groups[3],
-                            'dst_port': int(groups[4]),
-                            'protocol': 'tcp',
-                            'bytes_sent': 0,
-                            'bytes_recv': 0
-                        }
+                    return {
+                        'timestamp': 0,
+                        'src_ip': kv.get('src') or kv.get('SRC') or kv.get('SourceAddress') or '',
+                        'dst_ip': dst_ip,
+                        'src_port': int(kv.get('sport') or kv.get('SPT') or kv.get('SourcePort') or 0),
+                        'dst_port': int(dst_port),
+                        'protocol': kv.get('proto') or kv.get('Protocol') or 'tcp',
+                        'bytes_sent': int(kv.get('bytes') or kv.get('LEN') or 0),
+                        'bytes_recv': 0
+                    }
                 except:
                     pass
+
+        return None
+
+    @staticmethod
+    def parse_csv(log_line: str, headers: List[str] = None) -> Optional[Dict]:
+        """Parse CSV log format."""
+        from datetime import datetime
+
+        if not headers or log_line.startswith('timestamp'):
+            return None  # Skip header row
+
+        try:
+            parts = log_line.strip().split(',')
+            if len(parts) >= 5:
+                # Try to map by position if we have standard columns
+                ts_str = parts[0].strip()
+                try:
+                    dt = datetime.fromisoformat(ts_str.replace('Z', '+00:00'))
+                    ts = dt.timestamp()
+                except:
+                    ts = 0
+
+                return {
+                    'timestamp': ts,
+                    'src_ip': parts[1].strip() if len(parts) > 1 else '',
+                    'src_port': int(parts[2].strip()) if len(parts) > 2 and parts[2].strip().isdigit() else 0,
+                    'dst_ip': parts[3].strip() if len(parts) > 3 else '',
+                    'dst_port': int(parts[4].strip()) if len(parts) > 4 and parts[4].strip().isdigit() else 0,
+                    'protocol': parts[5].strip() if len(parts) > 5 else 'tcp',
+                    'bytes_sent': int(parts[6].strip()) if len(parts) > 6 and parts[6].strip().isdigit() else 0,
+                    'bytes_recv': int(parts[7].strip()) if len(parts) > 7 and parts[7].strip().isdigit() else 0
+                }
+        except:
+            pass
         return None
 
     @staticmethod
@@ -1719,39 +1797,62 @@ class C2Sentinel:
         threshold: float = 0.5
     ) -> List[Dict]:
         """Analyze raw log lines for C2 activity."""
+        from datetime import datetime
         connections = []
 
-        # First try to parse as a complete JSON array
+        # First try to parse as complete JSON (array or object with messages)
         full_content = ''.join(log_lines)
         try:
             data = json.loads(full_content)
+
+            # Handle Graylog-style nested JSON: {"messages": [...]}
+            if isinstance(data, dict) and 'messages' in data:
+                data = data['messages']
+
             if isinstance(data, list):
                 for item in data:
                     if isinstance(item, dict):
+                        # Parse timestamp
+                        ts = item.get('timestamp', item.get('@timestamp', 0))
+                        if isinstance(ts, str):
+                            try:
+                                dt = datetime.fromisoformat(ts.replace('Z', '+00:00'))
+                                ts = dt.timestamp()
+                            except:
+                                ts = 0
+
+                        # Handle 'bytes' field (combined) vs separate sent/recv
+                        bytes_val = int(item.get('bytes', 0))
+                        bytes_sent = int(item.get('bytes_sent', item.get('bytes_out', bytes_val)))
+                        bytes_recv = int(item.get('bytes_recv', item.get('bytes_in', 0)))
+
                         conn = {
-                            'timestamp': item.get('timestamp', item.get('@timestamp', 0)),
+                            'timestamp': ts,
                             'src_ip': item.get('src_ip', item.get('source_ip', '')),
                             'dst_ip': item.get('dst_ip', item.get('dest_ip', '')),
                             'src_port': int(item.get('src_port', item.get('source_port', 0))),
                             'dst_port': int(item.get('dst_port', item.get('dest_port', 0))),
                             'protocol': item.get('protocol', 'tcp'),
-                            'bytes_sent': int(item.get('bytes_sent', item.get('bytes_out', 0))),
-                            'bytes_recv': int(item.get('bytes_recv', item.get('bytes_in', 0))),
+                            'bytes_sent': bytes_sent,
+                            'bytes_recv': bytes_recv,
                             'duration': float(item.get('duration', 0))
                         }
                         if conn.get('dst_ip'):
                             connections.append(conn)
-        except (json.JSONDecodeError, TypeError):
+        except (json.JSONDecodeError, TypeError, ValueError):
             pass
 
         # Fall back to line-by-line parsing
         if not connections:
+            has_csv_header = log_lines and log_lines[0].strip().startswith('timestamp,')
             for line in log_lines:
                 conn = self.log_parser.parse_json(line)
                 if not conn:
                     conn = self.log_parser.parse_zeek_conn(line)
                 if not conn:
                     conn = self.log_parser.parse_syslog(line)
+                if not conn and has_csv_header:
+                    conn = self.log_parser.parse_csv(line, headers=['timestamp'])
                 if conn:
                     connections.append(conn)