loganom

loganom is a tool that checks mail log files in search of anomalies.

The first processor check postfix sasl authentication.

Usually, when an account is compromised, attackers use several machines from their botnets to send emails (spam/virus/phishing/etc) with that credential.

This can be observed when a user who usually connects from the same country suddenly sends emails from worldwide.

This is an experimental program.

Installation

Install using pip:

pip install loganom

Sources are available on https://github.com/dbaio/loganom.

Documentation available on https://loganom.readthedocs.io/en/latest/.