AuthLogAttackMap

Tails the /var/log/auth.log, geolocates IPs found, and displays them on a web frontend.

Usage

You'll need two terminals: one for watching the auth.log and another for serving up events to a web frontend.

First terminal:

python authLogTailer/

Second terminal:

python sseClient.py

From your browser: http://localhost

Optionally you can use the CLI client:

python  rpcClient.py [<command>] [<args>]

    Valid commands:
       summary    Show a summary of hosts in the auth log (Default)
       country    Show the breakdown of entries by country
       subscribe  Show json events as they occur in realtime

    optional arguments:
      -h, --help  show this help message and exit

Screenshot