Citrix NetScaler Analysis.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Please read: "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Somewhat automated notebook for Citrix NetScaler Analysis. Intended only as a starting point to help automate some of the analysis.\n",
    "\n",
    "- Fill in the 'Configuration' section below then run the notebook\n",
    "- Run the notebook \"Kernel -> Restart & Run All\"  \n",
    "- You should see a 'Results.xlsx' generated in the directory you specified as your 'ANALYSISPATH'. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Import Libraries "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "from pathlib import Path\n",
    "import pandas as pd\n",
    "import logging\n",
    "import gzip\n",
    "import shutil\n",
    "import re\n",
    "import base64\n",
    "from datetime import datetime\n",
    "from pyparsing import Word, alphas, Suppress, Combine, nums, string, Regex, Optional"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "pd.set_option('display.max_rows', 500)\n",
    "pd.set_option('display.max_columns', 500)\n",
    "pd.set_option('display.width', -1)\n",
    "pd.set_option('display.expand_frame_repr', False)\n",
    "pd.set_option('max_colwidth', -1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "logging.basicConfig(\n",
    "    level = logging.DEBUG,\n",
    "    format = '%(asctime)s - %(levelname)s - %(message)s',\n",
    "    handlers = [logging.StreamHandler()])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Configuration "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Fill this in carefully and then you should be able to run Kernel -> Restart and Run all and get an excel output with an overview of the relevant artifacts. Feel free to dig into the notebook itself and do some of your own searches. This notebook is meant only as a starting point."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Use forward slashes for the paths\n",
    "\n",
    "# Path where you've saved the netscaler logs (e.g. Workspace/Hostname/log)\n",
    "# Usually found in /var/log\n",
    "LOGPATH = Path('')\n",
    "\n",
    "# LEAVE BLANK IF YOU HAVE NO TEMPLATES\n",
    "# Path to where you've saved the recovered netscaler template XMLs (e.g. Workspace/Hostname/templates). \n",
    "# Usually found in:\n",
    "# /netscaler/portal/templates\n",
    "# /var/tmp/netscaler/portal/templates\n",
    "TEMPLATEPATH = Path('')\n",
    "# Secondary template location\n",
    "# Usually found in:\n",
    "# /var/vpn/bookmark\n",
    "BOOKMARKPATH = Path('')\n",
    "\n",
    "# Path to analysis workspace \n",
    "# Logs will be extracted here - recommend nesting under dir for hostname and running notebook once per host)\n",
    "# e.g. ( 'Workspace/Hostname' )\n",
    "ANALYSISPATH = Path('')\n",
    "\n",
    "# IOCs/common suspicious terms to search all logs (excluding sh.log) for - \n",
    "# some such as 'uname' throw a lot of false positives so be careful. \n",
    "# Main thing to look for is entries by 'nobody' user\n",
    "searchFor = ['nobody'] #'find /netscaler/portal/scripts', 'exec', 'print', 'echo', 'crontab', '/portal']\n",
    "\n",
    "# IOCs/ common suspicious terms to search for in HTTP error logs\n",
    "http_error_terms = ['chmod:', 'curl:', 'bash:', 'rm:', 'mkdir:', '.init', '--:--:--', '.pl', 'vpn']\n",
    "\n",
    "# IOCs/common suspicious terms to search sh.logs for\n",
    "shSearchFor = ['nobody', 'find', 'crontab', 'mv', 'LDR'] \n",
    "\n",
    "# HTTPAccess column names\n",
    "CNAMES = [\n",
    "    'client_ip_address',\n",
    "    'client_identity',\n",
    "    'user_id',\n",
    "    'time_received',\n",
    "    'timezone',\n",
    "    'request',\n",
    "    'status_code',\n",
    "    'size',\n",
    "    'referer (sic)',\n",
    "    'user_agent'\n",
    "]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Unzip logs "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Ensure analysis path exists\n",
    "ANALYZEDLOGPATH = ANALYSISPATH / 'analyzed-logs'\n",
    "Path.mkdir(ANALYZEDLOGPATH, parents=True, exist_ok=True)\n",
    "\n",
    "log_type_dict = {\n",
    "    'httpaccess.log.*.gz': 'httpaccess.log',\n",
    "    'httperror.log.*.gz': 'httperror.log',\n",
    "    'maillog.*.gz': 'maillog',\n",
    "    'messages.*.gz': 'messages',\n",
    "    'nitro.log.*.gz': 'nitro.log',\n",
    "    'ns.log.*.gz': 'ns.log',\n",
    "    'nsvpn.log.*.gz': 'nsvpn.log',\n",
    "    'auth.log.*.gz': 'auth.log',\n",
    "    'cron.*.gz': 'cron',\n",
    "    'bash.*.gz': 'bash.log',\n",
    "    'notice.*.gz': 'notice.log',\n",
    "    'sh.*.gz': 'sh.log'\n",
    "}\n",
    "\n",
    "for zipped_wildcard, unzipped_name in log_type_dict.items():\n",
    "    for fp in LOGPATH.glob(zipped_wildcard):\n",
    "        logging.info(f'Unzipping {fp}')\n",
    "        with gzip.open(fp, 'rb') as f_in:\n",
    "            with open(ANALYZEDLOGPATH / f'{fp.name[:-3]}', 'wb') as f_out:\n",
    "                logging.info(f'Writing to {ANALYZEDLOGPATH / fp.name[:-3]}')\n",
    "                shutil.copyfileobj(f_in, f_out)\n",
    "\n",
    "    with open(LOGPATH / f'{unzipped_name}', 'rb') as f_in:\n",
    "        with open(ANALYZEDLOGPATH / f'{unzipped_name}', 'wb') as f_out:\n",
    "            logging.info(f'Writing to {ANALYZEDLOGPATH / unzipped_name}')\n",
    "            shutil.copyfileobj(f_in, f_out)\n",
    "logging.info(\"Done!\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# HTTPAccess Analysis "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "for fp in ANALYZEDLOGPATH.glob('httpaccess.*'):\n",
    "    logging.info(f'Pre-processing {fp}')\n",
    "    with open(fp, 'r', encoding='latin1') as f:\n",
    "        lines = f.readlines()\n",
    "    with open(ANALYZEDLOGPATH / f'processed-{fp.name}', 'w', encoding='latin1') as f:\n",
    "        for line in lines:\n",
    "            if 'logfile turned over due to size' not in line:\n",
    "                f.write(line)\n",
    "logging.info('Done!')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "scrolled": true
   },
   "outputs": [],
   "source": [
    "df = pd.DataFrame()\n",
    "for fp in ANALYZEDLOGPATH.glob('processed-httpaccess.*'):\n",
    "    logging.info(f'Opening {fp}')\n",
    "    partial_df = pd.read_csv(fp,\n",
    "                             names=CNAMES,\n",
    "                             delim_whitespace=True, \n",
    "                             na_values='-',\n",
    "                            )\n",
    "    df = df.append(partial_df)\n",
    "    df = df.fillna('-')\n",
    "    df.time_received = df.time_received.str.strip('[')\n",
    "    df.timezone = df.timezone.str.strip(']')\n",
    "    df['timestamp'] = pd.to_datetime(df.time_received, format='%d/%b/%Y:%X')\n",
    "logging.info('Done!')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "vpnRequests = df[(df['request'].str.contains('/vpn/\\.\\./vpns'))]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "xmls = vpnRequests[vpnRequests.request.str.contains('.xml')]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# HTTPError Analysis"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "http_error_df = pd.DataFrame(columns=['message'])\n",
    "for fp in ANALYZEDLOGPATH.glob('httperror.*'):\n",
    "    logging.info(f'Opening {fp}')\n",
    "    with open(fp, 'r') as f:\n",
    "        for line in f:\n",
    "            if any([term in line for term in http_error_terms]):\n",
    "                http_error_df = http_error_df.append({\n",
    "                    'message': line\n",
    "                }, ignore_index=True)\n",
    "logging.info('Done!')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Parse Payload XMLs "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "scrolled": true
   },
   "outputs": [],
   "source": [
    "import xml.etree.ElementTree as ET\n",
    "import hashlib\n",
    "payloadDict = {}\n",
    "for pa in [TEMPLATEPATH, BOOKMARKPATH]:\n",
    "    if pa != Path(''):\n",
    "        for fp in pa.glob('*.xml'):\n",
    "            logging.info(f'Parsing {fp}')\n",
    "            with open(fp, 'r') as fin:\n",
    "                data = fin.read()\n",
    "                hex = hashlib.md5(data.encode()).hexdigest()\n",
    "            try:\n",
    "                root = ET.parse(fp).getroot()\n",
    "                username = None\n",
    "                desc = None\n",
    "                title = None\n",
    "                url = None\n",
    "                UI_inuse = None\n",
    "                username = root.get('username')\n",
    "                for type_tag in root.findall('bookmarks/bookmark'):\n",
    "                    desc = type_tag.get('descr')\n",
    "                    title = type_tag.get('title')\n",
    "                    url = type_tag.get('url')\n",
    "                    UI_inuse = type_tag.get('UI_inuse')\n",
    "                if fp.name not in payloadDict:\n",
    "                    payloadDict[fp.name] = (hex, \n",
    "                                            pd.to_datetime(fp.stat().st_ctime, unit='s'), \n",
    "                                            pd.to_datetime(fp.stat().st_atime, unit='s'), \n",
    "                                            pd.to_datetime(fp.stat().st_mtime, unit='s'), \n",
    "                                            desc, \n",
    "                                            title, \n",
    "                                            url, \n",
    "                                            UI_inuse, \n",
    "                                            username)\n",
    "            except:\n",
    "                if fp.name not in payloadDict:\n",
    "                    payloadDict[fp.name] = (hex, \n",
    "                                        pd.to_datetime(fp.stat().st_ctime, unit='s'), \n",
    "                                        pd.to_datetime(fp.stat().st_atime, unit='s'), \n",
    "                                        pd.to_datetime(fp.stat().st_mtime, unit='s'), \n",
    "                                        data, \n",
    "                                        None, \n",
    "                                        None, \n",
    "                                        None,\n",
    "                                        None)\n",
    "if payloadDict:\n",
    "    payloadDf = pd.DataFrame(payloadDict).T.reset_index()\n",
    "    payloadDf.columns = ['File', 'MD5', 'Created_Time', 'AccessedTime', 'ModifiedTime', 'Desc', 'Title', 'Url', 'UI_inuse', 'username']\n",
    "    #payloadDf.Url = payloadDf.Url.str.replace('http', 'hxxp')\n",
    "logging.info('Done!')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Decode Encoded Payloads"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "b64pattern = re.compile(\"(?<=echo )[a-zA-Z0-9+\\/]+={0,2}\")\n",
    "chrpattern = re.compile(\"(?<=readpipe\\()(.*)(?=\\)\\'\\})\")\n",
    "def decodePayload(x):\n",
    "            matchedB64String = None\n",
    "            matchedChrString = None\n",
    "            if x['Desc']:\n",
    "                matchedB64String = b64pattern.search(x['Desc'])\n",
    "            if x['Title']:\n",
    "                matchedChrString = chrpattern.search(x['Title'])\n",
    "\n",
    "            if matchedB64String:\n",
    "                return base64.b64decode(matchedB64String.group(0)).decode()\n",
    "            elif matchedChrString:\n",
    "                replacedString = matchedChrString.group(0)\n",
    "                replacedString = replacedString.replace(\"chr(\", \"\")\n",
    "                replacedString = replacedString.replace(\") . \", \" \")\n",
    "                replacedString = replacedString.replace(\")\", \"\")\n",
    "                numArr = replacedString.split(\" \")\n",
    "                paddedNums = []\n",
    "                for num in numArr:\n",
    "                    if len(num) == 2:\n",
    "                        paddedNums.append(f\"0{num}\")\n",
    "                    else:\n",
    "                        paddedNums.append(num)\n",
    "                cleanStr = \"\"\n",
    "                for num in paddedNums:\n",
    "                    cleanStr += chr(int(num))\n",
    "                return cleanStr\n",
    "            elif x['Desc']:\n",
    "                if 'BLOCK' in x['Desc'] or 'save config' in x['Desc'] or 'root' in x['Desc']:\n",
    "                    return x['Desc']\n",
    "            elif x['Title']:\n",
    "                if 'BLOCK' in x['Title']:\n",
    "                    return x['Title']\n",
    "            return x['Title']\n",
    "\n",
    "\n",
    "if payloadDict:\n",
    "    payloadDf['DecodedPayloads'] = payloadDf.apply(decodePayload, axis=1)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Setup Log Parser "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "scrolled": true
   },
   "outputs": [],
   "source": [
    "current_month = datetime.today().month"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "class Parser(object):\n",
    "    # log lines don't include the year, but if we don't provide one, datetime.strptime will assume 1900\n",
    "    ASSUMED_YEAR = '2020'\n",
    "\n",
    "    def __init__(self):\n",
    "        ints = Word(nums)\n",
    "        month = Word(string.ascii_uppercase, string.ascii_lowercase, exact=3)\n",
    "        day   = ints\n",
    "        hour  = Combine(ints + \":\" + ints + \":\" + ints)\n",
    "\n",
    "        timestamp = month + day + hour\n",
    "        timestamp.setParseAction(lambda t: datetime.strptime(Parser.ASSUMED_YEAR + ' ' + ' '.join(t), '%Y %b %d %H:%M:%S'))\n",
    "        \n",
    "        # notice\n",
    "        notice = Suppress(\"<\") + Word(alphas + nums + \"/-_.()\") + Suppress(\">\")\n",
    "        # hostname\n",
    "        hostname = Word(alphas + nums + \"_-.\")\n",
    "        # appname\n",
    "        appname = Word(alphas + \"/-_.()\")(\"appname\") + (Suppress(\"[\") + ints(\"pid\") + Suppress(\"]\")) | (Word(alphas + \"/-_.\")(\"appname\"))\n",
    "        appname.setName(\"appname\")\n",
    "        # message\n",
    "        message = Regex(\".*\")\n",
    "\n",
    "        self._pattern = timestamp(\"timestamp\") + notice(\"notice\") + hostname(\"hostname\") + Optional(appname) + Suppress(':') + message(\"message\")\n",
    "\n",
    "    def parse(self, line):\n",
    "        try:\n",
    "            parsed = self._pattern.parseString(line)\n",
    "\n",
    "            for key in 'appname pid'.split():\n",
    "                if key not in parsed:\n",
    "                    parsed[key] = ''\n",
    "                    \n",
    "            parsed_dict = parsed.asDict()\n",
    "            if parsed_dict['timestamp'].month > current_month:\n",
    "                parsed_dict['timestamp'] = parsed_dict['timestamp'].replace(year=2019)\n",
    "            return parsed_dict\n",
    "        except Exception as e:\n",
    "            logging.info(f\"Ignoring line: {line}{e}\\n\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Parse Cron Logs "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "cronDf = pd.DataFrame\n",
    "for fp in ANALYZEDLOGPATH.glob('cron*'):\n",
    "    with open(fp, 'r', encoding='latin1') as f:\n",
    "        logging.info(f'Parsing {fp}')\n",
    "        for line in f:\n",
    "            if cronDf.empty:\n",
    "                cronDf = pd.DataFrame(Parser().parse(line))\n",
    "            else:\n",
    "                cronDf = pd.concat([cronDf, pd.DataFrame(Parser().parse(line))])\n",
    "logging.info('Done!')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "nobodyCronActions = cronDf[cronDf.message.str.contains('|'.join(searchFor))]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Parse Bash Logs "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "scrolled": true
   },
   "outputs": [],
   "source": [
    "bashDf = pd.DataFrame\n",
    "for fp in ANALYZEDLOGPATH.glob('bash*'):\n",
    "    with open(fp, 'r', encoding='latin1') as f:\n",
    "        logging.info(f'Parsing {fp}')\n",
    "        for line in f:\n",
    "            if bashDf.empty:\n",
    "                bashDf = pd.DataFrame(Parser().parse(line))\n",
    "            else:\n",
    "                bashDf = pd.concat([bashDf, pd.DataFrame(Parser().parse(line))])\n",
    "logging.info('Done!')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "nobodyBashActions = bashDf[bashDf.message.str.contains('|'.join(searchFor))]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Parse Notice Logs "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "noticeDf = pd.DataFrame\n",
    "for fp in ANALYZEDLOGPATH.glob('notice*'):\n",
    "    with open(fp, 'r', encoding='latin1') as f:\n",
    "        logging.info(f'Parsing {fp}')\n",
    "        for line in f:\n",
    "            if noticeDf.empty:\n",
    "                noticeDf = pd.DataFrame(Parser().parse(line))\n",
    "            else:\n",
    "                noticeDf = pd.concat([noticeDf, pd.DataFrame(Parser().parse(line))])\n",
    "logging.info('Done!')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "nobodyNoticeActions = noticeDf[noticeDf.message.str.contains('|'.join(shSearchFor))]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Parse sh Logs "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "scrolled": true
   },
   "outputs": [],
   "source": [
    "shDf = pd.DataFrame\n",
    "for fp in ANALYZEDLOGPATH.glob('sh*'):\n",
    "    with open(fp, 'r', encoding='latin1') as f:\n",
    "        logging.info(f'Parsing {fp}')\n",
    "        for line in f:\n",
    "            if shDf.empty:\n",
    "                shDf = pd.DataFrame(Parser().parse(line))\n",
    "            else:\n",
    "                shDf = pd.concat([shDf, pd.DataFrame(Parser().parse(line))])\n",
    "logging.info('Done!')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "nobodyShActions = shDf[shDf.message.str.contains('|'.join(shSearchFor))]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Create DataFrame containing first/last date in logs "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "timeDf = pd.DataFrame(columns=['log_type', 'start_date', 'end_date', 'timezone'])\n",
    "log_type_dfs = {\n",
    "    'cron': cronDf,\n",
    "    'bash': bashDf,\n",
    "    'notice': noticeDf,\n",
    "    'sh': shDf\n",
    "}\n",
    "\n",
    "http_start_time_row = df.loc[df.timestamp == min(df.timestamp)].iloc[0]\n",
    "http_end_time_row = df.loc[df.timestamp == max(df.timestamp)].iloc[0]\n",
    "timeDf = timeDf.append({'log_type': 'httpaccess', \n",
    "               'start_date': http_start_time_row.timestamp, \n",
    "               'end_date': http_end_time_row.timestamp, \n",
    "               'timezone': http_start_time_row.timezone}, ignore_index=True)\n",
    "\n",
    "for k, v in log_type_dfs.items():\n",
    "    timeDf = timeDf.append({\n",
    "        'log_type': k,\n",
    "        'start_date': v.loc[v.timestamp == min(v.timestamp)].iloc[0].timestamp,\n",
    "        'end_date': v.loc[v.timestamp == max(v.timestamp)].iloc[0].timestamp,\n",
    "        'timezone': None\n",
    "    }, ignore_index=True)\n",
    "    \n",
    "timeDf = timeDf.fillna('-')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Write Findings to Excel "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "scrolled": true
   },
   "outputs": [],
   "source": [
    "writer = pd.ExcelWriter(ANALYSISPATH / 'Results.xlsx', engine='openpyxl')\n",
    "timeDf.to_excel(writer, sheet_name='LogTimeRanges', index=False)\n",
    "if not vpnRequests.empty:\n",
    "    vpnRequests.to_excel(writer, sheet_name='VulnRelatedHTTPRequests', index=False)       \n",
    "    if not xmls.empty:\n",
    "        xmls.to_excel(writer, sheet_name='ObservedHTTPPayloadRequests', index=False)\n",
    "    else:\n",
    "        logging.info('No XML requests observed - excluding dataframe from results')\n",
    "else:\n",
    "    logging.info('No vulnerability related HTTP requests observed')\n",
    "\n",
    "if not nobodyCronActions.empty: \n",
    "    nobodyCronActions.to_excel(writer, sheet_name='SuspiciousCron', index=False)\n",
    "else:\n",
    "    logging.info('No suspicious cron logs observed - excluding dataframe from results')\n",
    "    \n",
    "if not nobodyBashActions.empty:\n",
    "    nobodyBashActions.to_excel(writer, sheet_name='SuspiciousBash', index=False)\n",
    "else:\n",
    "    logging.info('No suspicious bash logs observed - excluding dataframe from results')\n",
    "    \n",
    "if not nobodyNoticeActions.empty:\n",
    "    nobodyNoticeActions.to_excel(writer, sheet_name='SuspiciousNotice', index=False)\n",
    "else:\n",
    "    logging.info('No suspicious notice logs observed - excluding dataframe from results')\n",
    "    \n",
    "if not nobodyShActions.empty:\n",
    "    nobodyShActions.to_excel(writer, sheet_name='SuspiciousSh', index=False)\n",
    "else:\n",
    "    logging.info('No suspicious sh logs observed - excluding dataframe from results')\n",
    "    \n",
    "if not http_error_df.empty:\n",
    "    http_error_df.to_excel(writer, sheet_name='SuspiciousHTTPError', index=False)\n",
    "else:\n",
    "    logging.info('No suspicious HTTP error logs observed - excluding dataframe from results')\n",
    "    \n",
    "if payloadDict:\n",
    "    payloadDf.to_excel(writer, sheet_name='ParsedXMLs', index=False)\n",
    "else:\n",
    "    logging.info('Template path not provided or no XMLs found so skipping XML analysis')\n",
    "writer.save()\n",
    "logging.info(f\"Printed results to {ANALYSISPATH / 'Results.xlsx'}\")\n",
    "logging.info('Done!')"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.6.5"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}