Stop 13 · Security Tools & AutomationTopics · 1/8

Python for Security Automation

In short

Security work is full of boring, repeated steps: reading logs, checking lists, calling APIs. A little Python turns an hour of copy paste into a ten second script.

Building custom scripts for tasks generic tools don't cover — parsing logs, automating repetitive investigation steps, or integrating multiple security tools together via their APIs.

The blob feeds a stack of papers into a cute machine that sorts them into piles.

Think of it like this

The sorting machine in the mail room

A college office gets a mountain of letters every morning. One clerk sorts them by hand till lunch. Then someone buys a small sorting machine: letters go in, neat piles come out. Python is that machine for logs, alerts and lists.

Watch it happen

Turning a log into an answer

Read

Match

Count

Rank

Report

1/5Open the SSH auth log from your own lab server, one line at a time so big files stay cheap.

The big ideas

What you need to know

Standard library first

re, json, csv, pathlib, hashlib and ipaddress cover a huge share of security scripts with nothing to install.

A few great packages

requests for APIs, and well known libraries like scapy or python-nmap for lab work. Pin versions in requirements.txt.

Read big files lazily

Loop over a file line by line instead of reading it all at once. Log files can be gigabytes.

Scripts need care too

Never hard code passwords or API keys. Read them from environment variables or a secrets manager.

See it in code

Walk through the code

python

1import re2from collections import Counter3 4pattern = re.compile(r"Failed password for .* from (\d+\.\d+\.\d+\.\d+)")5hits = Counter()6 7with open("/var/log/auth.log") as f:8    for line in f:9        m = pattern.search(line)10        if m:11            hits[m.group(1)] += 112 13for ip, n in hits.most_common(5):14    print(f"{ip:15}  {n} failed logins")

1/3The regex captures the IP after "from" in each failed login line.

A real first security script: count failed SSH logins per IP on your own Linux VM. It only reads a log, so it is safe to run anytime.

Save yourself the pain

Common mistakes

Oops

Writing one giant script with no functions and copy pasted blocks.

Do this instead

Split work into small functions. They are easier to test, reuse and fix at 2 am.

Oops

Putting an API key directly in the script and pushing it to GitHub.

Do this instead

Read keys from an environment variable and add .env to .gitignore before your first commit.

Your mission

Parse your own SSH log

~30 min

Quick check

Why loop over a log file line by line instead of calling f.read() once?

Go deeper

1Write a Python script automating a repetitive security task (e.g. parsing a log file for IOCs).
2Learn to use Python libraries commonly used in security work (requests, regex).
3Practice reading and modifying an existing open-source security script rather than starting from scratch.