🎯 Key Capabilities

• 🔍 Incident Response & Triage

  • IOC Extraction
  • Log Parsing
  • YARA Malware Detection
  • File Integrity Monitoring

• 🌐 Attack Surface Monitoring

  • DNS Lookup
  • WHOIS Lookup
  • External Intelligence

• 🛡️ Host Hardening

  • Linux Security Audit
  • Windows Security Audit
  • SSH Hardening
  • Firewall Validation

🏗️ Core Architecture

graph TD

Root[Security Automation Scripts]

Root --> PY[🐍 Python Engine]
Root --> SH[🐧 Linux Hardening]
Root --> PS[🪟 Windows Audit]

PY --> PY1[IOC Extractor]
PY --> PY2[Log Analyzer]
PY --> PY3[YARA Scanner]
PY --> PY4[FIM Engine]

SH --> SH1[System Audit]
SH --> SH2[SSH Hardening]
SH --> SH3[Firewall Controller]

PS --> PS1[Event Log Parser]
PS --> PS2[Windows Audit]
PS --> PS3[Defender Status]

🗂️ Module Reference

🐍 Python Engine (/python)

🐧 Linux Hardening (/bash)

🪟 Windows Security (/powershell)

🚀 Deployment

📋 Prerequisites

• Python 3.10+
• PowerShell 7+
• Bash Shell
• Administrator / Root Privileges

1️⃣ Clone Repository

git clone https://github.com/kongali1720/Security-Automation-Scripts.git

cd Security-Automation-Scripts

pip install -r requirements.txt

2️⃣ IOC Extraction

python python/ioc_extractor.py \
    --input samples/suspect_payload.txt

3️⃣ Linux Security Audit

chmod +x bash/system_audit.sh

sudo ./bash/system_audit.sh

4️⃣ Windows Security Audit

Set-ExecutionPolicy Bypass -Scope Process

.\powershell\windows_audit.ps1 -Detailed

📊 Usage Examples

🔐 File Integrity Monitoring

# Monitor /etc every 30 seconds
python python/file_integrity_monitor.py \
    -d /etc \
    --monitor \
    -i 30

# Run a one-time integrity check
python python/file_integrity_monitor.py \
    -d /etc \
    --check

🦠 Malware Scanning (YARA)

python python/yara_scanner.py \
    -r malware_rules/ \
    -t /tmp \
    --recursive \
    -o report.json

📄 Log Analysis

python python/log_analyzer.py \
    -f /var/log/auth.log \
    --json \
    -o auth_report.json

🪟 Windows Security Audit

# Perform a complete Windows security audit
.\powershell\windows_audit.ps1

# Export audit results to HTML
.\powershell\windows_audit.ps1 -ExportHTML

📊 Engineering Roadmap

Security Automation Scripts

├── ✅ Core Automation Engine
│   ├── Log Analyzer
│   ├── IOC Extractor
│   ├── YARA Scanner
│   └── File Integrity Monitor
│
├── 🚧 External Threat Intelligence
│   ├── VirusTotal
│   ├── AbuseIPDB
│   └── Shodan API
│
├── 📅 SIEM Integration
│   ├── Splunk
│   ├── Elastic Stack
│   └── Graylog
│
└── 📅 Dashboard Generator

🗺️ Project Roadmap

🤝 Contributing

Contributions are welcome and greatly appreciated!

If you'd like to improve this project, please follow these guidelines before submitting a Pull Request.

Contribution Checklist

• ✅ Follow PEP 8 coding standards for Python.
• ✅ Run flake8 before committing Python code.
• ✅ Validate Bash scripts using ShellCheck.
• ✅ Use descriptive commit messages.
• ✅ Document every command-line option with argparse.
• ✅ Include practical usage examples for new modules.
• ✅ Update the README and documentation whenever new features are added.
• ✅ Ensure new scripts include comments and basic error handling.
• ✅ Test your changes before opening a Pull Request.

Development Workflow

flowchart LR

A[Fork Repository]
-->B[Create Feature Branch]
-->C[Develop Feature]
-->D[Run Tests & Linters]
-->E[Update Documentation]
-->F[Commit Changes]
-->G[Push Branch]
-->H[Open Pull Request]
-->I[Code Review]
-->J[Merge]

📂 Repository Structure

Security-Automation-Scripts/

├── python/
│   ├── log_analyzer.py
│   ├── log_parser.py
│   ├── ioc_extractor.py
│   ├── yara_scanner.py
│   ├── file_integrity_monitor.py
│   └── report_generator.py
│
├── bash/
│   ├── system_audit.sh
│   ├── ssh_hardening.sh
│   └── user_audit.sh
│
├── powershell/
│   ├── eventlog_parser.ps1
│   └── windows_audit.ps1
│
├── requirements.txt
├── LICENSE
└── README.md

👨‍💻 Author

Kong Ali

Cybersecurity Enthusiast • Security Automation Engineer • Blue Team

🎯 Focus Areas

💙 Support the Project

If you find this project useful, please consider supporting its development.

⭐ Star this Repository

Giving this repository a Star helps increase its visibility and motivates future development.

☕ Buy Me a Coffee

Every contribution helps support ongoing maintenance and the development of new security tools.

🛡️ Secure • Automate • Detect • Defend

Made with ❤️ for the Open Source Cybersecurity Community

Code Quality Standards

Thank you for helping improve Security Automation Scripts and contributing to the open-source cybersecurity community. 🚀