Now I want to cover some of the opportunities where
we can automate log analysis.
System administrators have relied for a very long time on command‑line tools,
such as cat, grep, or xargs, to analyze log files.
Well, all this manual work can be codified with Python.
Another good use case where Python can be leveraged is for log enrichment.
This is where we can generate more insight based on field values,
as well as correlation.
When it comes to SIEM or XDR to some extent you are limited in your
analytics by the features or licensing model of the solution,
whereas with Python you can leverage existing information to
perform analysis and go beyond these limitations.
I also encourage you to have an entrepreneurial spirit.
It may be that you identify a problem and you can build an
entire solution for detection and analysis.
This is another good use case where you can add more value to your organization.
At the same time,
I do want to provide some constructive feedback on
how not to reinvent the wheel.
So let me explain this in a bit more detail.
For example,
creating a single‑purpose script that focuses only on one
type of log file and hard coding indicators,
that might be useful one time,
but if you need to alter the code each and every time,
it might be time consuming.
Instead,
focus on implementing reusable components where the detection logic can be
reused with different parameters for different use cases.
You may also get excited and want to rewrite a particular tool.
Well, this is a great idea,
one that will be appreciated by the security community,
but it will require regular maintaining as well.
And also another topic, that I'm guilty of myself,
is trying to implement log shipping agents.
There is nothing wrong with this,
but at some point you are wasting your efforts and
resources on solutions which already exist and are
maintained by the organizations behind them.