firewall_log_analysis.py
def src_ip_analysis(self):
        """
        Use-case:- Analytics based on Source IP. Look for all connections from source-ip perspective
        Includes the count, whether blacklisted or not, country, etc...
        :return:
        """
        src_df = self.data.groupby(['src_ip', 'dest_ip', 'dest_port'])\
                        .rolling(WINDOW_SLICE)\
                        .agg({'action': 'count'})\
                        .groupby(['src_ip', 'dest_ip', 'dest_port'])\
                        .max()\
                        .reset_index()
        src_df = src_df.rename(columns={'action': 'traffic_count'})
        src_df['bl_src_ip'] = src_df['src_ip'].map(lambda x: self.check_blacklisted_ip(x))
        src_df['bl_dest_ip'] = src_df['dest_ip'].map(lambda x: self.check_blacklisted_ip(x))
        dest_location = src_df['dest_ip'].map(lambda x: self.get_geo_location(x))
        dest_country, dest_city = self.get_country_city(dest_location)
        src_location = src_df['src_ip'].map(lambda x: self.get_geo_location(x))
        src_country, src_city = self.get_country_city(src_location)
        src_df['dest_country'] = dest_country
        src_df['dest_city'] = dest_city
        src_df['src_country'] = src_country
        src_df['src_city'] = src_city
        src_df = src_df[['src_country', 'src_city', 'src_ip', 'bl_src_ip',
                         'dest_country', 'dest_city', 'dest_ip', 'bl_dest_ip',
                         'dest_port', 'traffic_count']]
        src_df.to_csv(os.path.join(OUTPUT_DIR, 'BlockedTrafficForEachSourceIP_' + self.timestamp + '.csv'), index=None)

        Use-case:- Analytics based on Source IP. Look for all connections from source-ip perspective
        Includes the count, whether blacklisted or not, country, etc...
        :return:
        
Use-case:- Analytics based on Source IP. Look for all connections from source-ip perspective
Includes the count, whether blacklisted or not, country, etc
Use - case : - Analytics based on Source IP . Look for all connections from source - ip perspective Includes the count whether blacklisted or not country etc
def src_ip_analysis(self):
        src_df = self.data.groupby(['src_ip', 'dest_ip', 'dest_port'])\
                        .rolling(WINDOW_SLICE)\
                        .agg({'action': 'count'})\
                        .groupby(['src_ip', 'dest_ip', 'dest_port'])\
                        .max()\
                        .reset_index()
        src_df = src_df.rename(columns={'action': 'traffic_count'})
        src_df['bl_src_ip'] = src_df['src_ip'].map(lambda x: self.check_blacklisted_ip(x))
        src_df['bl_dest_ip'] = src_df['dest_ip'].map(lambda x: self.check_blacklisted_ip(x))
        dest_location = src_df['dest_ip'].map(lambda x: self.get_geo_location(x))
        dest_country, dest_city = self.get_country_city(dest_location)
        src_location = src_df['src_ip'].map(lambda x: self.get_geo_location(x))
        src_country, src_city = self.get_country_city(src_location)
        src_df['dest_country'] = dest_country
        src_df['dest_city'] = dest_city
        src_df['src_country'] = src_country
        src_df['src_city'] = src_city
        src_df = src_df[['src_country', 'src_city', 'src_ip', 'bl_src_ip',
                         'dest_country', 'dest_city', 'dest_ip', 'bl_dest_ip',
                         'dest_port', 'traffic_count']]
        src_df.to_csv(os.path.join(OUTPUT_DIR, 'BlockedTrafficForEachSourceIP_' + self.timestamp + '.csv'), index=None)
def src_ip_analysis ( self ) : src_df = self . data . groupby ( [ 'src_ip' , 'dest_ip' , 'dest_port' ] ) . rolling ( WINDOW_SLICE ) . agg ( { 'action' : 'count' } ) . groupby ( [ 'src_ip' , 'dest_ip' , 'dest_port' ] ) . max ( ) . reset_index ( ) src_df = src_df . rename ( columns = { 'action' : 'traffic_count' } ) src_df [ 'bl_src_ip' ] = src_df [ 'src_ip' ] . map ( lambda x : self . check_blacklisted_ip ( x ) ) src_df [ 'bl_dest_ip' ] = src_df [ 'dest_ip' ] . map ( lambda x : self . check_blacklisted_ip ( x ) ) dest_location = src_df [ 'dest_ip' ] . map ( lambda x : self . get_geo_location ( x ) ) dest_country , dest_city = self . get_country_city ( dest_location ) src_location = src_df [ 'src_ip' ] . map ( lambda x : self . get_geo_location ( x ) ) src_country , src_city = self . get_country_city ( src_location ) src_df [ 'dest_country' ] = dest_country src_df [ 'dest_city' ] = dest_city src_df [ 'src_country' ] = src_country src_df [ 'src_city' ] = src_city src_df = src_df [ [ 'src_country' , 'src_city' , 'src_ip' , 'bl_src_ip' , 'dest_country' , 'dest_city' , 'dest_ip' , 'bl_dest_ip' , 'dest_port' , 'traffic_count' ] ] src_df . to_csv ( os . path . join ( OUTPUT_DIR , 'BlockedTrafficForEachSourceIP_' + self . timestamp + '.csv' ) , index = None )
Use-case:- Analytics based on Source IP.
Use - case : - Analytics based on Source IP .
"""
        Use-case:- Analytics based on Source IP. Look for all connections from source-ip perspective
        Includes the count, whether blacklisted or not, country, etc...
        :return:
        """
None
self