{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9341171979904175, "class": 0 } ], "prob": 0.9341172, "class": 0, "models": [ { "m": "az", "prob": 0.8242424, "class": 0 }, { "m": "az/scripts", "prob": 0.9341172, "class": 0 }, { "m": "az/python", "prob": 0.109311745, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-11T16:33:47Z" }, "path": "lilsplunky.py", "raw": { "v": "4", "fs": [ { "f": "H(Cm)Md(Pt)", "k": { "source.shebang": "/usr/bin/env python3", "source.imports[0]": "Console", "source.imports[1]": "LogFileHandler", "source.imports[2]": "Observer", "source.imports[3]": "Panel", "source.imports[4]": "all", "source.imports[5]": "analysis.get", "source.imports[6]": "analyze_with_deepseek", "source.imports[7]": "argparse", "source.imports[8]": "argparse.ArgumentParser", "source.imports[9]": "console.print", "source.strings[0]": "\n\n JSON Response:\n ", "source.strings[1]": "\n Busca en el archivo de eventos JSONL registros que coincidan (búsqueda simple de substring).\n ", "source.strings[2]": "\n Almacena el evento procesado (diccionario Python) como una línea JSON\n en el archivo de salida.\n ", "source.strings[3]": "\n Analyze the following single log entry and determine if it indicates suspicious activity related to system security.\n Respond ONLY with a valid JSON object containing:\n - \"suspicious\": boolean (true if suspicious, false otherwise).\n - \"reason\": string (a brief explanation ONLY if suspicious, otherwise empty string or null).\n - \"severity\": string (e.g., \"low\", \"medium\", \"high\", \"critical\" ONLY if suspicious, otherwise null).\n - \"confidence\": float (from 0.0 to 1.0, your confidence in the suspicious assessment, otherwise null).\n\n Log entry:\n ", "source.strings[4]": "\n Handles file system events, reads new lines using position tracking,\n parses, analyzes, and stores them.\n ", "source.strings[5]": "\n Intenta extraer información básica de una línea de log.\n Esto es MUY básico, idealmente se usarían regex más específicos por tipo de log.\n ", "source.strings[6]": "\n Sends a single log entry to DeepSeek for analysis.\n Returns the analysis result as a Python dictionary or None if error.\n ", "source.strings[7]": "\n Starts monitoring the specified log directory.\n ", "source.strings[8]": "\nlog_monitor_bot_v2_monolithic.py\n\nAuthor: Your Name\nEmail: youremail@example.com\nCreation Date: 14/04/2025 \nLicense: GPL v3\n\nDescription: Real-time log monitoring bot for Linux systems (Monolithic Test Version).\n Monitors logs, performs basic parsing, uses DeepSeek for analysis per line,\n and stores structured results locally.\n", "source.strings[9]": " Confidence: ", "source.has_imports": true, "source.imports[10]": "datetime", "source.imports[11]": "datetime.now", "source.imports[12]": "datetime.now().isoformat", "source.imports[13]": "display_record", "source.imports[14]": "enumerate", "source.imports[15]": "event_data.get", "source.imports[16]": "f.readlines", "source.imports[17]": "f.seek", "source.imports[18]": "f.tell", "source.imports[19]": "f.write", "source.imports[20]": "file_positions.get", "source.imports[21]": "isinstance", "source.imports[22]": "json", "source.imports[23]": "json.dump", "source.imports[24]": "json.dumps", "source.imports[25]": "json.loads", "source.imports[26]": "len", "source.imports[27]": "line.strip", "source.imports[28]": "locals", "source.imports[29]": "log_entry_data.get", "source.imports[30]": "logging", "source.imports[31]": "logging.basicConfig", "source.imports[32]": "logging.debug", "source.imports[33]": "logging.error", "source.imports[34]": "logging.info", "source.imports[35]": "logging.warning", "source.imports[36]": "match.group", "source.imports[37]": "observer.join", "source.imports[38]": "observer.schedule", "source.imports[39]": "observer.start", "source.imports[40]": "observer.stop", "source.imports[41]": "open", "source.imports[42]": "os", "source.imports[43]": "os.path.basename", "source.imports[44]": "os.path.exists", "source.imports[45]": "os.path.isdir", "source.imports[46]": "os.path.join", "source.imports[47]": "os.path.normpath", "source.imports[48]": "os.path.relpath", "source.imports[49]": "os.walk", "source.imports[50]": "parse_args", "source.imports[51]": "parser.add_argument", "source.imports[52]": "parser.parse_args", "source.imports[53]": "query.lower", "source.imports[54]": "re", "source.imports[55]": "re.fullmatch", "source.imports[56]": "re.match", "source.imports[57]": "re.search", "source.imports[58]": "record.get", "source.imports[59]": "record_str.lower", "source.imports[60]": "requests", "source.imports[61]": "requests.post", "source.imports[62]": "response.raise_for_status", "source.imports[63]": "rich.console", "source.imports[64]": "rich.panel", "source.imports[65]": "rich.syntax", "source.imports[66]": "search_logs", "source.imports[67]": "self.initialize_file_positions", "source.imports[68]": "self.is_monitored", "source.imports[69]": "self.process_file", "source.imports[70]": "simple_parse_log_line", "source.imports[71]": "socket", "source.imports[72]": "socket.gethostname", "source.imports[73]": "start_monitoring", "source.imports[74]": "store_event", "source.imports[75]": "super", "source.imports[76]": "super().__init__", "source.imports[77]": "time", "source.imports[78]": "time.sleep", "source.imports[79]": "watchdog.events", "source.imports[80]": "watchdog.observers", "source.strings[10]": " Reason: ", "source.strings[11]": " Severity: ", "source.strings[12]": " Suspicious: [bold ", "source.strings[13]": " - Error: ", "source.strings[14]": " - Response text: ", "source.strings[15]": " does not exist.", "source.strings[16]": " matching records.[/bold blue]", "source.strings[17]": " new line(s) in ", "source.strings[18]": " not found or is not a directory.", "source.strings[19]": " not found.", "source.strings[20]": " possibly truncated or rotated (new_pos \u003c current_pos). Resetting position.", "source.strings[21]": " possibly truncated/rotated. Reading from start.[/yellow]", "source.strings[22]": " removed or rotated.", "source.strings[23]": " | Host: ", "source.strings[24]": " | Source: ", "source.strings[25]": "%(asctime)s - %(levelname)s - %(message)s", "source.strings[26]": "--log-dir", "source.strings[27]": "--mode", "source.strings[28]": "--search", "source.strings[29]": ". Check permissions.[/bold red]", "source.strings[30]": ". Removing from tracked positions.", "source.strings[31]": ". Will start monitoring.", "source.strings[32]": "...[/bold blue]\\n", "source.strings[33]": "...[/yellow]", "source.strings[34]": ".[/yellow]", "source.strings[35]": "/var/log", "source.strings[36]": "Analysis failed or timed out", "source.strings[37]": "Check if the file path matches any of the monitored patterns.", "source.strings[38]": "DeepSeek JSON response missing expected keys: ", "source.strings[39]": "DeepSeek analysis successful for: ", "source.strings[40]": "Detected new file: ", "source.strings[41]": "Directory to monitor for logs", "source.strings[42]": "Error communicating with DeepSeek API: ", "source.strings[43]": "Error decoding DeepSeek JSON response: ", "source.strings[44]": "Error initializing position for ", "source.strings[45]": "Error processing file ", "source.strings[46]": "Error storing event to ", "source.strings[47]": "Event stored: ", "source.strings[48]": "Failed to decode JSON extracted from text: ", "source.strings[49]": "Failed to decode JSON string within 'response': ", "source.strings[50]": "File not found during processing: ", "source.strings[51]": "Initialized position for ", "source.strings[52]": "LLM analysis failed for log: ", "source.strings[53]": "Log Event Analysis", "source.strings[54]": "Log Monitor Bot v2 (Monolithic)", "source.strings[55]": "Log monitoring stopped by the user.", "source.strings[56]": "Monitored file ", "source.strings[57]": "Muestra un registro procesado de forma atractiva en la consola.", "source.strings[58]": "No raw log provided", "source.strings[59]": "No valid JSON found in DeepSeek response: ", "source.strings[60]": "Output mode (currently only console)", "source.strings[61]": "Permission denied reading file: ", "source.strings[62]": "Press Ctrl+C to stop.", "source.strings[63]": "Raw DeepSeek response: ", "source.strings[64]": "Reads new lines from a file since the last known position.", "source.strings[65]": "Search the stored event log for QUERY instead of monitoring.", "source.strings[66]": "Sending to DeepSeek: ", "source.strings[67]": "Set initial position to the end of all currently monitored files.", "source.strings[68]": "Starting log monitoring in [bold cyan]", "source.strings[69]": "Storing processed events in [bold cyan]", "source.strings[70]": "Triggered when a file or directory is created.", "source.strings[71]": "Triggered when a file or directory is modified.", "source.strings[72]": "Unexpected error during DeepSeek analysis: ", "source.strings[73]": "Using LLM: [bold cyan]", "source.strings[74]": "[/bold cyan]", "source.strings[75]": "[/bold cyan] at [bold cyan]", "source.strings[76]": "[/bold cyan]...", "source.strings[77]": "[/bold red]", "source.strings[78]": "[/dim]\\n", "source.strings[79]": "[/green]", "source.strings[80]": "[/red]", "source.strings[81]": "[/yellow]", "source.strings[82]": "[bold red]Error connecting to DeepSeek API:[/bold red] ", "source.strings[83]": "[bold red]Error decoding DeepSeek JSON:[/bold red] ", "source.strings[84]": "[bold red]Error during search:[/bold red] ", "source.strings[85]": "[bold red]Error processing file ", "source.strings[86]": "[bold red]Error storing event:[/bold red] ", "source.strings[87]": "[bold red]Error:[/bold red] Could not decode JSON from DeepSeek response.", "source.strings[88]": "[bold red]Error:[/bold red] DeepSeek response format unexpected (JSON string decode).", "source.strings[89]": "[bold red]Error:[/bold red] DeepSeek response was not valid JSON.", "source.strings[90]": "[bold red]Error:[/bold red] Event file ", "source.strings[91]": "[bold red]Error:[/bold red] Log directory ", "source.strings[92]": "[bold red]Permission denied reading ", "source.strings[93]": "[bold red]Suspicious Event Detected!", "source.strings[94]": "[bold red]Unexpected error during analysis:[/bold red] ", "source.strings[95]": "[bold yellow]Suspicious Event Detected", "source.strings[96]": "[bold]LLM Analysis:[/bold]\\n", "source.strings[97]": "[bold]Raw Log:[/bold]\\n", "source.strings[98]": "[cyan]Analyzing log entry:[/cyan] ", "source.strings[99]": "[green]Detected ", "source.functions[0]": "__init__", "source.functions[1]": "analyze_with_deepseek", "source.functions[2]": "display_record", "source.functions[3]": "initialize_file_positions", "source.functions[4]": "is_monitored", "source.functions[5]": "on_created", "source.functions[6]": "on_modified", "source.functions[7]": "parse_args", "source.functions[8]": "process_file", "source.functions[9]": "search_logs", "source.strings[100]": "[red]Error processing line ", "source.strings[101]": "[red]Skipping malformed JSON line ", "source.strings[102]": "[yellow]Detected new file: ", "source.strings[103]": "[yellow]File ", "source.strings[104]": "[yellow]Initializing file positions (reading to end)...[/yellow]", "source.strings[105]": "[yellow]LLM analysis failed for: ", "source.strings[106]": "[yellow]No records found matching ", "source.strings[107]": "[yellow]Suspicious Event Detected", "source.strings[108]": "\\n[bold blue]Found ", "source.strings[109]": "\\n[bold blue]Searching for ", "source.strings[110]": "\\n[bold yellow]Log monitoring stopped by the user.[/bold yellow]", "source.strings[111]": "\\{.*\\}", "source.strings[112]": "^(\\w{3}\\s+\\d{1,2}\\s+\\d{2}:\\d{2}:\\d{2})", "source.strings[113]": "__main__", "source.strings[114]": "apache2.*access\\.log.*", "source.strings[115]": "apache2.*error\\.log.*", "source.strings[116]": "apache2[/\\\\]access\\.log.*", "source.strings[117]": "apache2[/\\\\]error\\.log.*", "source.strings[118]": "apache_access", "source.strings[119]": "apache_error", "source.strings[120]": "auth\\.log.*", "source.strings[121]": "bold red", "source.strings[122]": "bold yellow", "source.strings[123]": "boot\\.log.*", "source.strings[124]": "confidence", "source.strings[125]": "console", "source.strings[126]": "critical", "source.strings[127]": "deepseek-r1:1.5b", "source.strings[128]": "dpkg\\.log.*", "source.strings[129]": "f\" Confidence: {confidence:.2f}\\n", "source.strings[130]": "f\" Reason: {reason}\\n", "source.strings[131]": "f\" Severity: {severity}\\n", "source.strings[132]": "f\" Suspicious: [bold {'red' if is_suspicious else 'green'}]{is_suspicious}[/]\\n", "source.strings[133]": "f\"\"\"\n Analyze the following single log entry and determine if it indicates suspicious activity related to system security.\n Respond ONLY with a valid JSON object containing:\n - \"suspicious\": boolean (true if suspicious, false otherwise).\n - \"reason\": string (a brief explanation ONLY if suspicious, otherwise empty string or null).\n - \"severity\": string (e.g., \"low\", \"medium\", \"high\", \"critical\" ONLY if suspicious, otherwise null).\n - \"confidence\": float (from 0.0 to 1.0, your confidence in the suspicious assessment, otherwise null).\n\n Log entry:\n ```{raw_log}```\n\n JSON Response:\n ", "source.strings[134]": "f\"DeepSeek JSON response missing expected keys: {analysis_result}", "source.strings[135]": "f\"DeepSeek analysis successful for: {raw_log[:100]}...", "source.strings[136]": "f\"Detected new file: {event.src_path}. Will start monitoring.", "source.strings[137]": "f\"Error communicating with DeepSeek API: {e}", "source.strings[138]": "f\"Error decoding DeepSeek JSON response: {e} - Response text: {response.text if 'response' in locals() else 'N/A'}", "source.strings[139]": "f\"Error initializing position for {file_path}: {e}", "source.strings[140]": "f\"Error processing file {file_path}: {e}", "source.strings[141]": "f\"Error storing event to {OUTPUT_EVENTS_FILE}: {e}", "source.strings[142]": "f\"Event stored: {event_data.get('raw_log', '')[:100]}...", "source.strings[143]": "f\"Failed to decode JSON extracted from text: {match.group(0)} - Error: {e}", "source.strings[144]": "f\"Failed to decode JSON string within 'response': {analysis_result['response']}", "source.strings[145]": "f\"File not found during processing: {file_path}. Removing from tracked positions.", "source.strings[146]": "f\"File {file_path} possibly truncated or rotated (new_pos \u003c current_pos). Resetting position.", "source.strings[147]": "f\"Initialized position for {file_path} at {file_positions[file_path]}", "source.strings[148]": "f\"LLM analysis failed for log: {line.strip()}", "source.strings[149]": "f\"Monitored file {file_path} removed or rotated.", "source.strings[150]": "f\"No valid JSON found in DeepSeek response: {response_text}", "source.strings[151]": "f\"Permission denied reading file: {file_path}.", "source.strings[152]": "f\"Raw DeepSeek response: {response_text}", "source.strings[153]": "f\"Sending to DeepSeek: {raw_log}", "source.strings[154]": "f\"Starting log monitoring in [bold cyan]{log_dir}[/bold cyan]...", "source.strings[155]": "f\"Storing processed events in [bold cyan]{OUTPUT_EVENTS_FILE}[/bold cyan]", "source.strings[156]": "f\"Unexpected error during DeepSeek analysis: {e}", "source.strings[157]": "f\"Using LLM: [bold cyan]{DEEPSEEK_MODEL}[/bold cyan] at [bold cyan]{DEEPSEEK_API_URL}[/bold cyan]", "source.strings[158]": "f\"[bold red]Error connecting to DeepSeek API:[/bold red] {e}", "source.strings[159]": "f\"[bold red]Error decoding DeepSeek JSON:[/bold red] {e}", "source.strings[160]": "f\"[bold red]Error during search:[/bold red] {e}", "source.strings[161]": "f\"[bold red]Error processing file {file_path}: {e}[/bold red]", "source.strings[162]": "f\"[bold red]Error storing event:[/bold red] {e}", "source.strings[163]": "f\"[bold red]Error:[/bold red] Could not decode JSON from DeepSeek response.", "source.strings[164]": "f\"[bold red]Error:[/bold red] DeepSeek response format unexpected (JSON string decode).", "source.strings[165]": "f\"[bold red]Error:[/bold red] DeepSeek response was not valid JSON.", "source.strings[166]": "f\"[bold red]Error:[/bold red] Event file '{file_path}' not found.", "source.strings[167]": "f\"[bold red]Error:[/bold red] Log directory '{args.log_dir}' does not exist.", "source.strings[168]": "f\"[bold red]Error:[/bold red] Log directory '{log_dir}' not found or is not a directory.", "source.strings[169]": "f\"[bold red]Permission denied reading {file_path}. Check permissions.[/bold red]", "source.strings[170]": "f\"[bold red]Unexpected error during analysis:[/bold red] {e}", "source.strings[171]": "f\"[bold]LLM Analysis:[/bold]\\n", "source.strings[172]": "f\"[bold]Raw Log:[/bold]\\n{log_line}\\n\\n", "source.strings[173]": "f\"[cyan]Analyzing log entry:[/cyan] {raw_log[:150]}...", "source.strings[174]": "f\"[dim]{timestamp} | Host: {record.get('hostname')} | Source: {log_source}[/dim]\\n", "source.strings[175]": "f\"[green]Detected {len(new_lines)} new line(s) in {file_path}[/green]", "source.strings[176]": "f\"[red]Error processing line {line_num + 1}: {e}[/red]", "source.strings[177]": "f\"[red]Skipping malformed JSON line {line_num + 1}[/red]", "source.strings[178]": "f\"[yellow]Detected new file: {event.src_path}[/yellow]", "source.strings[179]": "f\"[yellow]File {file_path} possibly truncated/rotated. Reading from start.[/yellow]", "source.strings[180]": "f\"[yellow]LLM analysis failed for: {line.strip()[:100]}...[/yellow]", "source.strings[181]": "f\"[yellow]No records found matching '{query}'.[/yellow]", "source.strings[182]": "f\"\\n[bold blue]Found {found_count} matching records.[/bold blue]", "source.strings[183]": "f\"\\n[bold blue]Searching for '{query}' in {file_path}...[/bold blue]\\n", "source.strings[184]": "format", "source.strings[185]": "hostname", "source.strings[186]": "http://localhost:11434/api/generate", "source.strings[187]": "ignore", "source.strings[188]": "kern\\.log.*", "source.strings[189]": "llm_analysis", "source.strings[190]": "log_monitor_bot.log", "source.strings[191]": "log_source_path", "source.strings[192]": "log_type", "source.strings[193]": "medium", "source.strings[194]": "nginx.*access\\.log.*", "source.strings[195]": "nginx.*error\\.log.*", "source.strings[196]": "nginx[/\\\\]access\\.log.*", "source.strings[197]": "nginx[/\\\\]error\\.log.*", "source.strings[198]": "nginx_access", "source.strings[199]": "nginx_error", "source.strings[200]": "processed_events.jsonl", "source.strings[201]": "prompt", "source.strings[202]": "r\"^(\\w{3}\\s+\\d{1,2}\\s+\\d{2}:\\d{2}:\\d{2})", "source.strings[203]": "r\"apache2.*access\\.log.*", "source.strings[204]": "r\"apache2.*error\\.log.*", "source.strings[205]": "r\"apache2[/\\\\]access\\.log.*", "source.strings[206]": "r\"apache2[/\\\\]error\\.log.*", "source.strings[207]": "r\"auth\\.log.*", "source.strings[208]": "r\"boot\\.log.*", "source.strings[209]": "r\"dpkg\\.log.*", "source.strings[210]": "r\"kern\\.log.*", "source.strings[211]": "r\"nginx.*access\\.log.*", "source.strings[212]": "r\"nginx.*error\\.log.*", "source.strings[213]": "r\"nginx[/\\\\]access\\.log.*", "source.strings[214]": "r\"nginx[/\\\\]error\\.log.*", "source.strings[215]": "r\"syslog.*", "source.strings[216]": "r'\\{.*\\}", "source.strings[217]": "raw_log", "source.strings[218]": "reason", "source.strings[219]": "response", "source.strings[220]": "severity", "source.strings[221]": "stream", "source.strings[222]": "suspicious", "source.strings[223]": "syslog", "source.strings[224]": "syslog.*", "source.strings[225]": "timestamp_processed", "source.strings[226]": "unknown", "source.strings[227]": "yellow", "source.functions[10]": "simple_parse_log_line", "source.functions[11]": "start_monitoring", "source.functions[12]": "store_event" }, "x": 5, "id": 0, "is": [ "logging.basicConfig", "Console", "socket.gethostname", "os.path.basename", "re.match", "re.match", "re.match", "re.match", "re.match", "re.match", "datetime.now().isoformat", "datetime.now", "re.match", "line.strip", "open", "json.dump", "f.write", "logging.info", "event_data.get", "logging.error", "console.print", "log_entry_data.get", "console.print", "logging.info", "requests.post", "response.raise_for_status", "logging.debug", "json.loads", "isinstance", "json.loads", "logging.error", "console.print", "re.search", "json.loads", "match.group", "logging.error", "match.group", "console.print", "logging.error", "console.print", "all", "logging.warning", "logging.info", "logging.error", "console.print", "logging.error", "locals", "console.print", "logging.error", "console.print", "super().__init__", "super", "self.initialize_file_positions", "console.print", "os.walk", "os.path.join", "self.is_monitored", "open", "f.seek", "f.tell", "logging.info", "logging.error", "os.path.normpath", "os.path.relpath", "re.fullmatch", "re.fullmatch", "os.path.basename", "self.is_monitored", "file_positions.get", "os.path.exists", "logging.info", "open", "f.seek", "f.readlines", "f.tell", "logging.warning", "console.print", "open", "f.readlines", "f.tell", "console.print", "len", "line.strip", "simple_parse_log_line", "analyze_with_deepseek", "store_event", "display_record", "store_event", "logging.warning", "line.strip", "console.print", "line.strip", "logging.warning", "logging.error", "console.print", "logging.error", "console.print", "self.process_file", "logging.info", "console.print", "self.process_file", "record.get", "record.get", "analysis.get", "analysis.get", "analysis.get", "analysis.get", "record.get", "record.get", "record.get", "console.print", "Panel", "console.print", "open", "enumerate", "json.loads", "json.dumps", "query.lower", "record_str.lower", "display_record", "console.print", "console.print", "console.print", "console.print", "console.print", "console.print", "os.path.isdir", "console.print", "console.print", "console.print", "console.print", "console.print", "LogFileHandler", "Observer", "observer.schedule", "observer.start", "time.sleep", "observer.stop", "logging.info", "console.print", "observer.join", "argparse.ArgumentParser", "parser.add_argument", "parser.add_argument", "parser.add_argument", "parser.parse_args", "parse_args", "search_logs", "os.path.isdir", "console.print", "start_monitoring", "rich.panel", "time", "re", "json", "argparse", "datetime", "logging", "watchdog.observers", "socket", "requests", "os", "watchdog.events", "rich.console", "rich.syntax" ], "ms": { "file": { "size": 20873.0 }, "text": { "digit_ratio": 0.01, "space_count": 5138.0, "total_lines": 451.0, "char_entropy": 4.68, "unique_chars": 95.0, "import_density": 36.59, "string_density": 1.08, "avg_line_length": 45.28, "high_byte_ratio": 0.01, "max_line_length": 138.0, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.14, "last_line_length": 66.0, "most_common_char": "e", "whitespace_ratio": 0.27, "most_common_ratio": 0.07, "identifier_density": 1.56, "line_length_stddev": 33.63, "normalized_import_count": 7.77, "normalized_string_count": 22.88, "repeated_char_sequences": 141.0, "suspicious_string_ratio": 0.01, "suspicious_comment_ratio": 0.01, "max_inline_whitespace_run": 12.0, "normalized_function_count": 0.61, "trailing_whitespace_lines": 1.0, "imports_to_functions_ratio": 12.69, "strings_to_functions_ratio": 37.38, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 19.39, "identifiers_to_functions_ratio": 13.15 }, "imports": { "total": 165.0, "stdlib_count": 61.0, "stdlib_ratio": 0.37, "unique_modules": 81.0, "third_party_count": 104.0, "third_party_ratio": 0.63 }, "strings": { "total": 486.0, "url_count": 2.0, "avg_length": 26.17, "max_length": 616.0, "path_count": 4.0, "avg_entropy": 2.66, "email_count": 2.0, "sql_strings": 2.0, "total_bytes": 12721.0, "entropy_stddev": 1.49, "shell_command_strings": 3.0 }, "comments": { "chars": 3207.0, "lines": 73.0, "total": 73.0, "to_code_ratio": 0.19, "high_entropy_comments": 1.0 }, "functions": { "total": 13.0, "length_stddev": 25.51, "avg_name_length": 14.0, "no_params_count": 13.0, "avg_length_lines": 27.31, "max_length_lines": 89.0, "min_length_lines": 4.0, "high_entropy_names": 2.0, "density_per_100_lines": 2.88, "code_in_functions_ratio": 0.79 }, "identifiers": { "total": 705.0, "avg_length": 8.33, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.52, "reuse_ratio": 0.24, "unique_count": 171.0, "length_stddev": 4.5, "sequential_names": 3.0, "single_char_count": 4.0, "single_char_ratio": 0.02, "high_entropy_count": 8.0, "high_entropy_ratio": 0.05, "all_lowercase_ratio": 0.85, "all_uppercase_ratio": 0.07, "double_underscore_count": 2.0, "underscore_prefix_count": 3.0 } }, "ss": [ [ 24, "\nlog_monitor_bot_v2_monolithic.py\n\nAuthor: Your Name\nEmail: youremail@example.com\nCreation Date: 14/04/2025 \nLicense: GPL v3\n\nDe" ], [ 27, "\nlog_monitor_bot_v2_monolithic.py\n\nAuthor: Your Name\nEmail: youremail@example.com\nCreation Date: 14/04/2025 \nLicense: GPL v3\n\nDe" ], [ 741, "log_monitor_bot.log" ], [ 742, "log_monitor_bot.log" ], [ 784, "processed_events.jsonl" ], [ 785, "processed_events.jsonl" ], [ 863, "http://localhost:11434/api/generate" ], [ 864, "http://localhost:11434/api/generate" ], [ 918, "deepseek-r1:1.5b" ], [ 919, "deepseek-r1:1.5b" ], [ 1285, "r\"auth\\.log.*" ], [ 1285, "r" ], [ 1287, "auth\\.log.*" ], [ 1368, "r\"syslog.*" ], [ 1368, "r" ], [ 1370, "syslog.*" ], [ 1425, "r\"kern\\.log.*" ], [ 1425, "r" ], [ 1427, "kern\\.log.*" ], [ 1472, "r\"nginx[/\\\\]access\\.log.*" ], [ 1472, "r" ], [ 1474, "nginx[/\\\\]access\\.log.*" ], [ 1559, "r\"nginx[/\\\\]error\\.log.*" ], [ 1559, "r" ], [ 1561, "nginx[/\\\\]error\\.log.*" ], [ 1610, "r\"apache2[/\\\\]access\\.log.*" ], [ 1610, "r" ], [ 1612, "apache2[/\\\\]access\\.log.*" ], [ 1664, "r\"apache2[/\\\\]error\\.log.*" ], [ 1664, "r" ], [ 1666, "apache2[/\\\\]error\\.log.*" ], [ 1717, "r\"dpkg\\.log.*" ], [ 1717, "r" ], [ 1719, "dpkg\\.log.*" ], [ 1776, "r\"boot\\.log.*" ], [ 1776, "r" ], [ 1778, "boot\\.log.*" ], [ 1990, "%(asctime)s - %(levelname)s - %(message)s" ], [ 1991, "%(asctime)s - %(levelname)s - %(message)s" ], [ 2230, "\n Intenta extraer información básica de una línea de log.\n Esto es MUY básico, idealmente se usarían regex más espec" ], [ 2233, "\n Intenta extraer información básica de una línea de log.\n Esto es MUY básico, idealmente se usarían regex más espec" ], [ 2409, "unknown" ], [ 2410, "unknown" ], [ 2553, "r\"auth\\.log.*" ], [ 2553, "r" ], [ 2555, "auth\\.log.*" ], [ 2600, "auth" ], [ 2601, "auth" ], [ 2625, "r\"syslog.*" ], [ 2625, "r" ], [ 2627, "syslog.*" ], [ 2669, "syslog" ], [ 2670, "syslog" ], [ 2696, "r\"nginx.*access\\.log.*" ], [ 2696, "r" ], [ 2698, "nginx.*access\\.log.*" ], [ 2752, "nginx_access" ], [ 2753, "nginx_access" ], [ 2785, "r\"nginx.*error\\.log.*" ], [ 2785, "r" ], [ 2787, "nginx.*error\\.log.*" ], [ 2840, "nginx_error" ], [ 2841, "nginx_error" ], [ 2872, "r\"apache2.*access\\.log.*" ], [ 2872, "r" ], [ 2874, "apache2.*access\\.log.*" ], [ 2930, "apache_access" ], [ 2931, "apache_access" ], [ 2964, "r\"apache2.*error\\.log.*" ], [ 2964, "r" ], [ 2966, "apache2.*error\\.log.*" ], [ 3021, "apache_error" ], [ 3022, "apache_error" ], [ 3227, "r\"^(\\w{3}\\s+\\d{1,2}\\s+\\d{2}:\\d{2}:\\d{2})" ], [ 3227, "r" ], [ 3229, "^(\\w{3}\\s+\\d{1,2}\\s+\\d{2}:\\d{2}:\\d{2})" ], [ 3497, "timestamp_processed" ], [ 3498, "timestamp_processed" ], [ 3543, "hostname" ], [ 3544, "hostname" ], [ 3573, "log_source_path" ], [ 3574, "log_source_path" ], [ 3611, "log_type" ], [ 3612, "log_type" ], [ 3641, "raw_log" ], [ 3642, "raw_log" ], [ 3706, "\n Almacena el evento procesado (diccionario Python) como una línea JSON\n en el archivo de salida.\n " ], [ 3709, "\n Almacena el evento procesado (diccionario Python) como una línea JSON\n en el archivo de salida.\n " ], [ 3869, "a" ], [ 3870, "a" ], [ 3937, "\\n" ], [ 3938, "\\n" ], [ 3964, "f\"Event stored: {event_data.get('raw_log', '')[:100]}..." ], [ 3964, "f" ], [ 3966, "Event stored: " ], [ 3996, "raw_log" ], [ 3997, "raw_log" ], [ 4017, "..." ], [ 4092, "f\"Error storing event to {OUTPUT_EVENTS_FILE}: {e}" ], [ 4092, "f" ], [ 4094, "Error storing event to " ], [ 4137, " " ], [ 4167, "f\"[bold red]Error storing event:[/bold red] {e}" ], [ 4167, "f" ], [ 4169, "[bold red]Error storing event:[/bold red] " ], [ 4265, "\n Sends a single log entry to DeepSeek for analysis.\n Returns the analysis result as a Python dictionary or None if error." ], [ 4268, "\n Sends a single log entry to DeepSeek for analysis.\n Returns the analysis result as a Python dictionary or None if error." ], [ 4438, "raw_log" ], [ 4439, "raw_log" ], [ 4449, "No raw log provided" ], [ 4450, "No raw log provided" ], [ 4485, "f\"\"\"\n Analyze the following single log entry and determine if it indicates suspicious activity related to system security.\n " ], [ 4485, "f" ], [ 4489, "\n Analyze the following single log entry and determine if it indicates suspicious activity related to system security.\n Re" ], [ 5073, "\n\n JSON Response:\n " ], [ 5124, "f\"[cyan]Analyzing log entry:[/cyan] {raw_log[:150]}..." ], [ 5124, "f" ], [ 5126, "[cyan]Analyzing log entry:[/cyan] " ], [ 5175, "..." ], [ 5228, "f\"Sending to DeepSeek: {raw_log}" ], [ 5228, "f" ], [ 5230, "Sending to DeepSeek: " ], [ 5372, "model" ], [ 5373, "model" ], [ 5413, "prompt" ], [ 5414, "prompt" ], [ 5447, "stream" ], [ 5448, "stream" ], [ 5537, "format" ], [ 5538, "format" ], [ 5547, "json" ], [ 5548, "json" ], [ 5816, "f\"Raw DeepSeek response: {response_text}" ], [ 5816, "f" ], [ 5818, "Raw DeepSeek response: " ], [ 6114, "response" ], [ 6115, "response" ], [ 6175, "response" ], [ 6176, "response" ], [ 6377, "response" ], [ 6378, "response" ], [ 6468, "f\"Failed to decode JSON string within 'response': {analysis_result['response']}" ], [ 6468, "f" ], [ 6470, "Failed to decode JSON string within 'response': " ], [ 6535, "response" ], [ 6536, "response" ], [ 6583, "f\"[bold red]Error:[/bold red] DeepSeek response format unexpected (JSON string decode)." ], [ 6583, "f" ], [ 6585, "[bold red]Error:[/bold red] DeepSeek response format unexpected (JSON string decode)." ], [ 6859, "r'\\{.*\\}" ], [ 6859, "r" ], [ 6861, "\\{.*\\}" ], [ 7093, "f\"Failed to decode JSON extracted from text: {match.group(0)} - Error: {e}" ], [ 7093, "f" ], [ 7095, "Failed to decode JSON extracted from text: " ], [ 7154, " - Error: " ], [ 7205, "f\"[bold red]Error:[/bold red] Could not decode JSON from DeepSeek response." ], [ 7205, "f" ], [ 7207, "[bold red]Error:[/bold red] Could not decode JSON from DeepSeek response." ], [ 7365, "f\"No valid JSON found in DeepSeek response: {response_text}" ], [ 7365, "f" ], [ 7367, "No valid JSON found in DeepSeek response: " ], [ 7457, "f\"[bold red]Error:[/bold red] DeepSeek response was not valid JSON." ], [ 7457, "f" ], [ 7459, "[bold red]Error:[/bold red] DeepSeek response was not valid JSON." ], [ 7655, "suspicious" ], [ 7656, "suspicious" ], [ 7669, "reason" ], [ 7670, "reason" ], [ 7679, "severity" ], [ 7680, "severity" ], [ 7691, "confidence" ], [ 7692, "confidence" ], [ 7736, "f\"DeepSeek JSON response missing expected keys: {analysis_result}" ], [ 7736, "f" ], [ 7738, "DeepSeek JSON response missing expected keys: " ], [ 7962, "f\"DeepSeek analysis successful for: {raw_log[:100]}..." ], [ 7962, "f" ], [ 7964, "DeepSeek analysis successful for: " ], [ 8013, "..." ], [ 8127, "f\"Error communicating with DeepSeek API: {e}" ], [ 8127, "f" ], [ 8129, "Error communicating with DeepSeek API: " ], [ 8196, "f\"[bold red]Error connecting to DeepSeek API:[/bold red] {e}" ], [ 8196, "f" ], [ 8198, "[bold red]Error connecting to DeepSeek API:[/bold red] " ], [ 8339, "f\"Error decoding DeepSeek JSON response: {e} - Response text: {response.text if 'response' in locals() else 'N/A'}" ], [ 8339, "f" ], [ 8341, "Error decoding DeepSeek JSON response: " ], [ 8383, " - Response text: " ], [ 8419, "response" ], [ 8420, "response" ], [ 8447, "N/A" ], [ 8448, "N/A" ], [ 8478, "f\"[bold red]Error decoding DeepSeek JSON:[/bold red] {e}" ], [ 8478, "f" ], [ 8480, "[bold red]Error decoding DeepSeek JSON:[/bold red] " ], [ 8606, "f\"Unexpected error during DeepSeek analysis: {e}" ], [ 8606, "f" ], [ 8608, "Unexpected error during DeepSeek analysis: " ], [ 8679, "f\"[bold red]Unexpected error during analysis:[/bold red] {e}" ], [ 8679, "f" ], [ 8681, "[bold red]Unexpected error during analysis:[/bold red] " ], [ 8814, "\n Handles file system events, reads new lines using position tracking,\n parses, analyzes, and stores them.\n " ], [ 8817, "\n Handles file system events, reads new lines using position tracking,\n parses, analyzes, and stores them.\n " ], [ 8975, "console" ], [ 8976, "console" ], [ 9161, "Set initial position to the end of all currently monitored files." ], [ 9164, "Set initial position to the end of all currently monitored files." ], [ 9255, "[yellow]Initializing file positions (reading to end)...[/yellow]" ], [ 9256, "[yellow]Initializing file positions (reading to end)...[/yellow]" ], [ 9587, "r" ], [ 9588, "r" ], [ 9601, "utf-8" ], [ 9602, "utf-8" ], [ 9617, "ignore" ], [ 9618, "ignore" ], [ 9845, "f\"Initialized position for {file_path} at {file_positions[file_path]}" ], [ 9845, "f" ], [ 9847, "Initialized position for " ], [ 9883, " at " ], [ 9998, "f\"Error initializing position for {file_path}: {e}" ], [ 9998, "f" ], [ 10000, "Error initializing position for " ], [ 10043, " " ], [ 10190, "Check if the file path matches any of the monitored patterns." ], [ 10193, "Check if the file path matches any of the monitored patterns." ], [ 10788, "Reads new lines from a file since the last known position." ], [ 10791, "Reads new lines from a file since the last known position." ], [ 11341, "f\"Monitored file {file_path} removed or rotated." ], [ 11341, "f" ], [ 11343, "Monitored file " ], [ 11369, " removed or rotated." ], [ 11451, "r" ], [ 11452, "r" ], [ 11465, "utf-8" ], [ 11466, "utf-8" ], [ 11481, "ignore" ], [ 11482, "ignore" ], [ 11840, "f\"File {file_path} possibly truncated or rotated (new_pos \u003c current_pos). Resetting position." ], [ 11840, "f" ], [ 11842, "File " ], [ 11858, " possibly truncated or rotated (new_pos \u003c current_pos). Resetting position." ], [ 11968, "f\"[yellow]File {file_path} possibly truncated/rotated. Reading from start.[/yellow]" ], [ 11968, "f" ], [ 11970, "[yellow]File " ], [ 11994, " possibly truncated/rotated. Reading from start.[/yellow]" ], [ 12127, "r" ], [ 12128, "r" ], [ 12141, "utf-8" ], [ 12142, "utf-8" ], [ 12157, "ignore" ], [ 12158, "ignore" ], [ 12397, "f\"[green]Detected {len(new_lines)} new line(s) in {file_path}[/green]" ], [ 12397, "f" ], [ 12399, "[green]Detected " ] ], "sz": 20873, "ts": [ { "c": 0.699999988079071, "d": "\"directory\" path-target noun", "e": [ "directory" ], "i": "micro-behaviors/data/text/llm/action::llm-path-noun-directory", "l": 1 }, { "c": 1.0, "d": "Python 3 shebang line", "e": [ "#!/usr/bin/env python3" ], "i": "metadata/lang/shebang::python3", "l": 2 }, { "a": "T1027", "d": "except keyword", "e": [ "except Exception" ], "i": "micro-behaviors/data/control-flow/error-handling::except-keyword-dup", "l": 2, "m": "C0027" }, { "a": "T1041", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "system" ], "i": "objectives/exfiltration/http/upload::system-data-post-platform--rx-5", "l": 1 }, { "c": 0.8999999761581421, "d": "Generic env-based shebang line", "e": [ "#!/usr/bin/env python3" ], "i": "metadata/lang/shebang::env-interpreter", "l": 2 }, { "a": "T1572", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "loads" ], "i": "objectives/command-and-control/channel/tunnel/proxy::python-websocket-json-base64--rx-6", "l": 1 }, { "a": "T1027", "c": 0.9200000166893005, "d": "HOST URL component identifier", "e": [ "HOST" ], "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12", "l": 1, "m": "B0032" }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "nginx web server", "e": [ "nginx" ], "i": "micro-behaviors/communications/http/server/listener::nginx-keyword", "l": 3, "m": "C0002" }, { "a": "T1480", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ "host" ], "i": "objectives/anti-analysis/geofencing/target-gating::fqdn-substring-gate--rx-9", "l": 1, "m": "B0003" }, { "c": 0.949999988079071, "d": "Source imports requests library", "e": [ "[Console, LogFileHandler, Observer, Panel, all, analysis.get, analyze_with_deepseek, argparse, argparse.ArgumentParser, console." ], "i": "metadata/lang/source::imports-requests", "l": 3 }, { "d": "POSIX \"Permission denied\" error message", "e": [ "Permission denied" ], "i": "micro-behaviors/os/message/error::permission-denied", "l": 2 }, { "c": 0.8199999928474426, "d": "Hostname profile field", "e": [ "hostname" ], "i": "objectives/discovery/system/profile::host-profile-hostname-field", "l": 1 }, { "a": "T1555.003", "c": 1.0, "d": "requests module import", "e": [ "requests" ], "i": "objectives/credential-access/browser/multi-target::requests-module-import", "l": 1 }, { "a": "T1105", "c": 0.9399999976158142, "d": "path.isdir call", "e": [ ".path.isdir(" ], "i": "well-known/malware/dropper/cryptoaitools::path-isdir-call", "l": 1, "m": "B0024" }, { "c": 0.75, "d": "Hardcoded localhost network host", "e": [ "localhost" ], "i": "micro-behaviors/communications/ip/literal::localhost-source", "l": 2 }, { "c": 0.8999999761581421, "d": "Python json.loads call", "e": [ "json.loads" ], "i": "micro-behaviors/data/serialize/json::json-loads-call", "l": 2 }, { "a": "T1497.003", "c": 0.8500000238418579, "d": "Python datetime now call", "e": [ "datetime.now" ], "i": "objectives/anti-analysis/timing/timer::py-datetime-now-call", "l": 1 }, { "c": 0.8500000238418579, "d": "Directory traversal operation", "e": [ "os.walk" ], "i": "micro-behaviors/fs/directory/traverse::traverse-readdir-walk-find", "l": 2 }, { "a": "T1082", "d": "Invokes hostname shell command", "e": [ "hostname" ], "i": "micro-behaviors/os/sysinfo/hostname::hostname-cmd", "l": 3, "m": "E1082" }, { "a": "T1041", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "post" ], "i": "objectives/exfiltration/http/upload::system-data-post-platform--rx-8", "l": 1 }, { "a": "T1056.001", "c": 0.4000000059604645, "d": ".write() call (file handle)", "e": [ "f.write(" ], "i": "objectives/collection/keylog/capture::dot-write-1", "l": 1, "m": "B0015" }, { "a": "T1041", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "request" ], "i": "objectives/exfiltration/http/upload::system-data-post-platform--rx-4", "l": 1 }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://" ], "i": "micro-behaviors/communications/http/protocol::http-prefix", "l": 2 }, { "c": 1.0, "d": "open() function call", "e": [ "open" ], "i": "objectives/command-and-control/dropper/builder::open-paren-dup", "l": 1 }, { "c": 0.8999999761581421, "d": "Python json.load call", "e": [ "json.loads" ], "i": "micro-behaviors/data/serialize/json::json-load-call", "l": 2 }, { "c": 0.30000001192092896, "d": "for loop (AST)", "e": [ "for filename in files:\n file_path = os.path.join(root, filename)\n if s...", "for pattern in TEXT_LOG_FILES_PATTERNS:\n # Intentar hacer match con la ruta relativa o e...", "for line in new_lines:\n if not line.strip(): # Saltar líneas vacías\n ...", "for line_num, line in enumerate(f):\n try:\n record = json.loads(l...", "for root, _, files in os.walk(self.log_dir):\n for filename in files:\n file..." ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-ast", "l": 2 }, { "a": "T1195.002", "c": 0.6000000238418579, "d": "requests.post call", "e": [ "requests.post(" ], "i": "objectives/supply-chain/impersonation/core-module::requests-post-call", "l": 1 }, { "a": "T1499.004", "c": 0.6000000238418579, "d": "Import os module", "e": [ "import os" ], "i": "objectives/impact/dos/fork-bomb::import-os", "l": 1 }, { "a": "T1480", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ "local" ], "i": "objectives/anti-analysis/geofencing/target-gating::fqdn-substring-gate--rx-6", "l": 1, "m": "B0003" }, { "c": 0.30000001192092896, "d": "for loop (content)", "e": [ " for k in " ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-content", "l": 2 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "except" ], "i": "objectives/command-and-control/dropper/staging/encrypted::dual-crypto-libcrypto-fallback--rx-8", "l": 1, "m": "B0032" }, { "a": "T1195.002", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "with" ], "i": "objectives/supply-chain/impersonation/core-module::write-password-file--rx-6", "l": 1 }, { "a": "T1071.001", "c": 0.6499999761581421, "d": "HTTP response text extraction", "e": [ "text = response" ], "i": "objectives/command-and-control/beacon/network/json::http-response-text", "l": 1, "m": "B0030" }, { "a": "T1071", "c": 0.6000000238418579, "d": "import socket module", "e": [ "import socket" ], "i": "micro-behaviors/communications/socket/connect::socket-module-import", "l": 3, "m": "C0001" }, { "c": 0.75, "d": "Python substring membership check", "e": [ "if file_path in file_positions:" ], "i": "objectives/anti-static/obfuscation/string/recovery::python-substring-membership-check", "l": 1 }, { "a": "T1005", "c": 0.6000000238418579, "d": "Opens a file (Python)", "e": [ "with open(" ], "i": "micro-behaviors/fs/read/file::file-open-content", "l": 2, "m": "E1005" }, { "c": 0.75, "d": "Regex component marker", "e": [ "socket" ], "i": "objectives/command-and-control/backdoor/shell/socket::python-recv-call--rx-2", "l": 1 }, { "a": "T1071", "c": 0.6000000238418579, "d": "socket.gethostname() call", "e": [ "socket.gethostname" ], "i": "micro-behaviors/communications/socket/connect::socket-gethostname", "l": 3, "m": "C0001" }, { "c": 0.8399999737739563, "d": "\"store\" doc cue (storage instruction)", "e": [ "store" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11769", "l": 1 }, { "a": "T1497", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "os.path.exists" ], "i": "objectives/anti-analysis/sandbox-detect/script::vm-artifact-vbox-file-check--rx-30", "l": 1, "m": "B0007" }, { "a": "T1572", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "dumps" ], "i": "objectives/command-and-control/channel/tunnel/proxy::python-websocket-json-base64--rx-5", "l": 1 }, { "a": "T1555.003", "c": 1.0, "d": "time module import", "e": [ "time" ], "i": "objectives/credential-access/browser/multi-target::time-module-import", "l": 1 }, { "a": "T1210", "c": 0.8600000143051147, "d": "Redis KEYS command", "e": [ "keys" ], "i": "objectives/lateral-movement/exploit/container::redis-keys-command", "l": 1 }, { "c": 0.949999988079071, "d": "Python source extension basename", "e": [ "lilsplunky.py" ], "i": "objectives/anti-static/obfuscation/payload/bytecode::py-extension-basename", "l": 1 }, { "c": 0.699999988079071, "d": "GPL license reference", "e": [ "GPL" ], "i": "metadata/package/license::gpl-word", "l": 2 }, { "c": 1.0, "d": "Python infinite while True loop", "e": [ "while True:" ], "i": "micro-behaviors/data/control-flow/loop::python-while-true", "l": 2 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 451.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1195.002", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "open" ], "i": "objectives/supply-chain/impersonation/core-module::write-password-file--rx-5", "l": 1 }, { "c": 0.8999999761581421, "d": "Opens a file", "e": [ "open(" ], "i": "micro-behaviors/fs/file/open::generic-dup", "l": 2 }, { "c": 0.699999988079071, "d": "\"following\" instruction cue", "e": [ "following" ], "i": "micro-behaviors/data/text/llm/action::llm-instruction-cue-following", "l": 1 }, { "c": 0.699999988079071, "d": "requests.post call (Python)", "e": [ "requests.post" ], "i": "micro-behaviors/communications/http/lib/requests::requests-post", "l": 3 }, { "c": 0.75, "d": "Regex component marker", "e": [ "conn" ], "i": "objectives/command-and-control/backdoor/shell/socket::python-recv-call--rx-3", "l": 1 }, { "a": "T1059", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "json.loads" ], "i": "well-known/malware/backdoor/snow::snowglaze-tunnel-markers--rx-16", "l": 1 }, { "c": 0.75, "d": "Write file to persistent storage", "e": [ "open(OUTPUT_EVENTS_FILE, 'a" ], "i": "micro-behaviors/communications/http/server/request::file-write-storage", "l": 2 }, { "a": "T1046", "c": 0.4000000059604645, "d": "socket function symbol", "e": [ "socket" ], "i": "objectives/discovery/network/scan/port::sym-socket", "l": 1, "m": "E1046" }, { "c": 0.6600000262260437, "d": "Traverse filesystem hierarchy (os.walk)", "e": [ "os.walk" ], "i": "micro-behaviors/fs/directory/traverse::traverse-walk", "l": 2 }, { "c": 0.8399999737739563, "d": "\"to the\" doc cue", "e": [ "to the" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11768", "l": 1 }, { "c": 0.30000001192092896, "d": "while loop pattern", "e": [ " while True:" ], "i": "micro-behaviors/data/control-flow/analysis::while-loop", "l": 2 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "except" ], "i": "objectives/command-and-control/dropper/staging/encrypted::dual-crypto-bcrypt-fallback--rx-4", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Python os.path.basename call", "e": [ "os.path.basename" ], "i": "micro-behaviors/fs/path/basename::os-path-basename", "l": 1 }, { "a": "T1555.003", "c": 1.0, "d": "json module import", "e": [ "json" ], "i": "objectives/credential-access/browser/multi-target::json-module-import", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Checks HTTP response status before payload handling", "e": [ "raise_for_status" ], "i": "objectives/command-and-control/dropper/delivery/fetch-eval::raise-for-status", "l": 1, "m": "E1105" }, { "c": 0.6499999761581421, "d": "Python sleep call", "e": [ ".sleep(" ], "i": "micro-behaviors/time/sleep/interval::python-sleep-call", "l": 2 }, { "a": "T1082", "c": 0.6000000238418579, "d": "Linux platform detection marker", "e": [ "\nlog_monitor_bot_v2_monolithic.py\n\nAuthor: Your Name\nEmail: youremail@example.com\nCreation Date: 14/04/2025 \nLicense: GPL v3\n\nDe" ], "i": "objectives/discovery/system/fingerprint/os::os-check-linux", "l": 2, "m": "B0012" }, { "c": 0.949999988079071, "d": "imports rich.panel", "e": [ "rich.panel" ], "i": "metadata/import/python::rich/panel", "l": 2 }, { "c": 0.949999988079071, "d": "imports time", "e": [ "time" ], "i": "metadata/import/python::time", "l": 2 }, { "c": 0.949999988079071, "d": "imports re", "e": [ "re" ], "i": "metadata/import/python::re", "l": 2 }, { "c": 0.949999988079071, "d": "imports json", "e": [ "json" ], "i": "metadata/import/python::json", "l": 2 }, { "c": 0.949999988079071, "d": "imports argparse", "e": [ "argparse" ], "i": "metadata/import/python::argparse", "l": 2 }, { "c": 0.949999988079071, "d": "imports datetime", "e": [ "datetime" ], "i": "metadata/import/python::datetime", "l": 2 }, { "c": 0.949999988079071, "d": "imports logging", "e": [ "logging" ], "i": "metadata/import/python::logging", "l": 2 }, { "c": 0.949999988079071, "d": "imports watchdog.observers", "e": [ "watchdog.observers" ], "i": "metadata/import/python::watchdog/observers", "l": 2 }, { "c": 0.949999988079071, "d": "imports socket", "e": [ "socket" ], "i": "metadata/import/python::socket", "l": 2 }, { "c": 0.949999988079071, "d": "imports requests", "e": [ "requests" ], "i": "metadata/import/python::requests", "l": 2 }, { "c": 0.949999988079071, "d": "imports os", "e": [ "os" ], "i": "metadata/import/python::os", "l": 2 }, { "c": 0.949999988079071, "d": "imports watchdog.events", "e": [ "watchdog.events" ], "i": "metadata/import/python::watchdog/events", "l": 2 }, { "c": 0.949999988079071, "d": "imports rich.console", "e": [ "rich.console" ], "i": "metadata/import/python::rich/console", "l": 2 }, { "c": 0.949999988079071, "d": "imports rich.syntax", "e": [ "rich.syntax" ], "i": "metadata/import/python::rich/syntax", "l": 2 } ], "sha": "e4d825d902e371c199d991708c5a92568925b7991c38f564ecb7f3646ad472bc", "path": "lilsplunky.py", "type": "python" } ], "tv": "46790" } }