Suspicious login detector. Parses auth logs, enriches IPs, and produces risk-scored HTML/JSON report
377
Suspicious login detector for auth logs.
AuthSentry parses authentication log files, enriches IPs with geolocation and security intelligence via ipgeolocation.io, and produces risk-scored HTML or JSON reports.
A login from a DigitalOcean IP with a VPN flag is almost certainly a credential stuffing attack.
A login from the same country as all previous sessions is probably fine.
AuthSentry tells you which is which.
docker run --rm \
-v /var/log:/data/logs:ro \
-v $(pwd)/output:/data/output \
-e IPGEOLOCATION_API_KEY=your_key \
sherlockholmes221b/authsentry \
/data/logs/auth.log --enrich-all --out /data/output/report.html
Get a free API key at ipgeolocation.io (1,000 req/day — the built-in SQLite cache means you'll rarely hit this limit on repeat runs). Uses the IP Location API and IP Security API under the hood.
| Feature | Detail |
|---|---|
| Production-safe streaming | Line-by-line parsing, bounded memory, handles GB-scale files |
| Parallel processing | Configurable worker pool (--workers) |
| Rate limiting | Token-bucket limiter, configurable RPS (--rps) |
| Intelligent caching | SQLite cache, 24h TTL — 90%+ API call reduction |
| Risk scoring | HOSTING + VPN + ThreatScore → CRITICAL / HIGH / MEDIUM / LOW |
| Multi-format parsing | Django, Laravel, Rails, Apache, Nginx, raw fallback |
| Output formats | Interactive HTML report or JSONL |
| Non-root image | Runs as unprivileged sentry user |
docker run --rm \
-v /path/to/logs:/data/logs:ro \
-v $(pwd)/output:/data/output \
-v $(pwd)/cache.db:/data/cache.db \
-e IPGEOLOCATION_API_KEY=your_key \
sherlockholmes221b/authsentry \
/data/logs/auth.log [flags]
--api-key string IPGeolocation API key (or IPGEOLOCATION_API_KEY env var)
--format string Log format: auto, django, laravel, rails, apache, nginx, raw (default "auto")
--output string Output format: html, json (default "html")
-o, --out string Output file path
--workers int Parallel enrichment workers (default 10)
--rps float Max API requests per second (default 10)
--cache string SQLite cache file (default "cache.db")
--cache-ttl-hours int Cache TTL in hours (default 24)
--max-enrich int Max IPs to enrich (0 = prompt)
--enrich-all Enrich all IPs without prompting
--no-prompt Non-interactive / CI mode
--dedupe-cap int In-memory dedup capacity (default 100000)
# HTML report from Nginx log
docker run --rm \
-v /var/log/nginx:/data/logs:ro \
-v $(pwd)/output:/data/output \
-e IPGEOLOCATION_API_KEY=your_key \
sherlockholmes221b/authsentry \
/data/logs/access.log --enrich-all --out /data/output/report.html
# JSON output — pipe to jq for CRITICAL events only
docker run --rm \
-v /var/log:/data/logs:ro \
-e IPGEOLOCATION_API_KEY=your_key \
sherlockholmes221b/authsentry \
/data/logs/auth.log --output json --enrich-all --no-prompt | \
jq '.events[] | select(.risk.level == "CRITICAL")'
# Reuse cache across runs (much faster)
docker run --rm \
-v /var/log:/data/logs:ro \
-v $(pwd)/output:/data/output \
-v $(pwd)/cache.db:/data/cache.db \
-e IPGEOLOCATION_API_KEY=your_key \
sherlockholmes221b/authsentry \
/data/logs/auth.log --cache /data/cache.db --enrich-all --out /data/output/report.html
services:
authsentry:
image: sherlockholmes221b/authsentry:latest
volumes:
- ./logs:/data/logs:ro
- ./output:/data/output
- ./cache.db:/data/cache.db
environment:
- IPGEOLOCATION_API_KEY=${IPGEOLOCATION_API_KEY}
IPGEOLOCATION_API_KEY=your_key docker compose run authsentry \
/data/logs/auth.log --enrich-all --out /data/output/report.html
| Score | Level | Recommended Action |
|---|---|---|
| 75–100 | CRITICAL | Block IP immediately |
| 50–74 | HIGH | Challenge with MFA / CAPTCHA |
| 25–49 | MEDIUM | Log, monitor, alert account owner |
| 1–24 | LOW | Log for trend analysis |
| 0 | INFO | No action required |
Signals include: hosting/datacenter ASN, VPN, proxy, Tor exit node, known attacker, known abuser, and raw threat score — sourced from the IP Location API and IP Security API.
auto (default) detects the format automatically. Explicitly supported:
WARNING django.security Failed login for user 'x' from 1.2.3.4production.WARNING: Failed login {"ip":"1.2.3.4"}Started POST "/users/sign_in" for 1.2.3.4alpine:3.19sentrylinux/amd64, linux/arm64GitHub: github.com/devjfreaks/authsentry
License: MIT
Content type
Image
Digest
sha256:ccac9aff6…
Size
7.6 MB
Last updated
6 months ago
docker pull sherlockholmes221b/authsentry