Windows Event Log Analyzer Python

A beginner-friendly SOC Analyst / Blue Team project that analyzes Windows Security Event Logs and detects suspicious activity.

SOC Skills Demonstrated

• Windows Event Log analysis
• Failed login detection
• Account lockout investigation
• Privilege escalation monitoring
• Event ID analysis
• Threat hunting
• Incident response documentation
• Python scripting

Project Files

• windows_event_log_analyzer.py - Main Python script
• sample_logs/security_events.csv - Sample Windows Security logs
• reports/event_log_report.txt - Report created after running the tool
• requirements.txt - Python requirements

Important Event IDs

• 4625 → Failed logon
• 4624 → Successful logon
• 4720 → User account created
• 4728 → User added to privileged group
• 4740 → Account locked out

How to Run

python windows_event_log_analyzer.py sample_logs/security_events.csv

Why This Project Matters

SOC Analysts investigate Windows event logs daily to detect brute-force attacks, unauthorized access, account lockouts, and suspicious administrative activity. This project demonstrates real-world SOC monitoring concepts.