Security Incident Response Questions

from dateutil import parser as dparser
from dateutil.tz import tzutc
import csv, io, re

SYSLOG_RE = re.compile(r'^(?P<ts>\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2})\s+(?P<host>\S+)\s+(?P<rest>.+)$')

def _to_utc_iso(ts_str):
    # Try dateutil first (handles many formats and timezones)
    try:
        dt = dparser.parse(ts_str, fuzzy=True)
        dt_utc = dt.astimezone(tzutc())
        return dt_utc.isoformat()
    except Exception:
        return None

def parse_log_line(line: str) -> dict:
    line = line.strip()
    if not line:
        return None

    # Try CSV (Windows Event Log export)
    try:
        reader = csv.reader(io.StringIO(line))
        row = next(reader)
        # common exported CSVs: Timestamp, Computer, EventID, TaskCategory, Level, User, Source, Message, ... 
        # we'll map best-effort
        candidates = {i: v for i, v in enumerate(row)}
        ts = candidates.get(0) or candidates.get(1)
        hostname = candidates.get(1) or candidates.get(0)
        username = None
        source_ip = None
        raw_message = candidates.get(7) if len(row) > 7 else " | ".join(row[2:])
        # try to extract username/ip from other columns or message
        for v in row:
            if '@' in v or v.lower().startswith('domain\\') or v.lower().startswith('nt authority'):
                username = username or v
            m = re.search(r'\b(?:\d{1,3}\.){3}\d{1,3}\b', v)
            if m:
                source_ip = source_ip or m.group(0)
        ts_iso = _to_utc_iso(ts) if ts else None
        if ts_iso or raw_message:
            return {
                "timestamp": ts_iso,
                "hostname": hostname or None,
                "event_type": candidates.get(2) or None,
                "username": username,
                "source_ip": source_ip,
                "raw_message": raw_message or None
            }
    except Exception:
        pass  # CSV parse failed; try syslog

    # Try syslog
    m = SYSLOG_RE.match(line)
    if m:
        ts_raw = m.group('ts')
        host = m.group('host')
        rest = m.group('rest')
        ts_iso = _to_utc_iso(ts_raw)
        # attempt to extract username and IP from message
        user = None
        ip = None
        um = re.search(r'user[=\s:"\']?([\w\\@.\-]+)', rest, re.I)
        if um: user = um.group(1)
        im = re.search(r'\b(?:\d{1,3}\.){3}\d{1,3}\b', rest)
        if im: ip = im.group(0)
        return {
            "timestamp": ts_iso,
            "hostname": host,
            "event_type": None,
            "username": user,
            "source_ip": ip,
            "raw_message": rest
        }

    # completely unparsable
    return None