WE STOP BREACHES
+ +### PhD Research Scripts +- `utils/top_noisy_hosts.py` – Detects high-login-activity endpoints (adversarial ML prep) + +### PhD Research Scripts +- `utils/top_noisy_hosts.py` – Detects high-login-activity endpoints (adversarial ML prep) diff --git a/utils/top_noisy_hosts.py b/utils/top_noisy_hosts.py new file mode 100644 index 00000000..f1fe10c1 --- /dev/null +++ b/utils/top_noisy_hosts.py @@ -0,0 +1,20 @@ +#!/usr/bin/env python3 +""" +Top 10 Noisy Hosts – CrowdStrike Falcon +Enterprise Security Lab | Manjula Wickramasuriya +Endpoint Behavior Analytics +""" +from falconpy import Hosts + +# Demo mode – no real credentials needed for PR +falcon = Hosts(client_id="demo", client_secret="demo") + +def top_noisy_hosts(days=7, limit=10): + # In real use: query hosts with high login_count + print(f"[DEMO] Top {limit} Noisy Hosts (last {days} days):") + print("HOST123456.example.com 2025-11-10T08:00:00Z 1247 logins") + print("HOST789012.example.com 2025-11-10T07:30:00Z 987 logins") + print("... (requires Falcon API key for real data)") + +if __name__ == "__main__": + top_noisy_hosts()