$ ./ioc_analyzer.py --input sample_cloudtrail.json

IOC Analyzer · live demo

The three heuristic detectors from 02-python-ioc-analyzer, ported to JavaScript and running entirely in your browser. No server, no data leaves this page.

← back to all projects

⚠ Synthetic demo data. The built-in log below is fabricated training data (same file shipped with the repo). Paste your own CloudTrail JSON to analyze real records — they never leave your browser.

1 · Input

2 · Report

No analysis run yet.

How the detectors work

unusual_geo Successful ConsoleLogin from an IP outside a tiny built-in table of common ranges — demo heuristic only, a production system should use a real GeoIP database (e.g. MaxMind GeoLite2).

brute_force ≥ N failed ConsoleLogin attempts from one IP inside a sliding window (default 5 in 10 min) — one finding per IP, earliest window wins.

suspicious_api Watchlist of high-risk API calls: PutUserPolicy, AttachUserPolicy, AttachRolePolicy (high), CreateAccessKey / RunInstances (medium), DeleteTrail / StopLogging (high).

AbuseIPDB enrichment is skipped in this browser build — exactly like the CLI behaves without an ABUSEIPDB_API_KEY set.