Tools · Python and Bash for security automation · 20 / 26
A summary count is not the row list
A line that prints how many log rows matched is a tally for that run. The addresses or names are the lines under it. Write the tally as a count, and do not add a value the list does not show.
The number is a tally
A summarizer can print a single count, such as how many lines matched its pattern. That integer is the size of the match set it counted. It does not spell the addresses, the names, or the timestamps inside that set.
A shorter list under the count, such as a top-three table, is a subset. The tally can be larger than the number of rows in the table. Do not shrink the tally to the table, and do not grow the table up to the tally.
Names come from printed rows
If you need an address, it has to appear on a printed row. A count of 40 does not imply 40 distinct addresses, and it does not name the ones the table left out.
When the script does not print the full set, write “remaining rows not printed.” Do not fill them from memory of an earlier run.
What to write down
File the tally with the input path and the time of the run. File each address from the table as a table row. Keep the two labels. A finding that names an address cites the row, not the integer.
Lab: forty matches and a three-row table
The lab summarizer prints failed-login lines: 40, then a top table with 203.0.113.10, 203.0.113.11, and 198.51.100.20. A draft says only three addresses failed, and also names 203.0.113.50 because that address was noisy last week.
The note keeps 40 as the match tally and the three addresses as the printed table. 203.0.113.50 is not in this output. The other matches are unprinted, not absent, and not filled in from last week.
stdout tally: failed-login lines: 40 table: 203.0.113.10, 203.0.113.11, 198.51.100.20 203.0.113.50: not in this output write: tally 40, three printed addresses not: only three addresses, and not last week’s address
Diagram
From a tally to names you can cite
- Tally
How many lines the script counted.
40
- Table
The rows it actually printed.
three addresses
- Unprinted
The rest of the tally, if the table is shorter.
not listed
- A name
Cite it only when a row shows it.
not from the integer
Check yourself
1. The output says 40 matching lines and prints three addresses. What is 40?
2. An address from last week is not in this table. What may you add?
3. The tally is 40 and the table has three rows. What do you say about the other matches?