msticpy.analysis.syslog_utils module

syslog_utils - Syslog parsing and utility module.

Functions required to correct collect, parse and visualize syslog data.

Designed to support standard linux syslog for investigations where auditd is not available.

msticpy.analysis.syslog_utils.cluster_syslog_logons_df(logon_events: DataFrame) DataFrame

Cluster logon sessions in syslog by start/end time based on PAM events.


logon_events (pd.DataFrame) – A DataFrame of all syslog logon events (can be generated with LinuxSyslog.user_logon query)


logon_sessions – A dictionary of logon sessions including start and end times and logged on user

Return type:



MsticpyException – There are no logon sessions in the supplied data set

msticpy.analysis.syslog_utils.create_host_record(syslog_df: DataFrame, heartbeat_df: DataFrame, az_net_df: DataFrame | None = None) Host

Generate host_entity record for selected computer.

  • syslog_df (pd.DataFrame) – A dataframe of all syslog events for the host in the time window requried

  • heartbeat_df (pd.DataFrame) – A dataframe of heartbeat data for the host

  • az_net_df (pd.DataFrame) – Option dataframe of Azure network data for the host


Details of the host data collected

Return type:


msticpy.analysis.syslog_utils.risky_sudo_sessions(sudo_sessions: DataFrame, risky_actions: dict | None = None, suspicious_actions: list | None = None) dict

Detect if a sudo session occurs at the point of a suspicious event.

  • sudo_sessions (dict) – Dictionary of sudo sessions (as generated by cluster_syslog_logons)

  • risky_actions (dict (Optional)) – Dictionary of risky sudo commands (as generated by cmd_line.risky_cmd_line)

  • suspicious_actions (list (Optional)) – List of risky sudo commands (as generated by cmd_line.cmd_speed)


risky_sessions – A dictionary of sudo sessions with flags denoting risk

Return type: