Metadata-Version: 2.4
Name: netsentinel
Version: 1.2.2
Summary: Asinxron Port Skaner, Geo-IP, SSL Analizi, CVE Axtarış və SIEM Dəstəkli Təhlükəsizlik Aləti
Home-page: https://github.com/guseinismyname/netsentinel
Author: Huseyn Qasimzade
Author-email: guseinismyname77@gmail.com
Classifier: Programming Language :: Python :: 3
Classifier: Operating System :: OS Independent
Requires-Python: >=3.8
Description-Content-Type: text/markdown
Requires-Dist: aiohttp
Requires-Dist: colorama
Dynamic: author
Dynamic: author-email
Dynamic: classifier
Dynamic: description
Dynamic: description-content-type
Dynamic: home-page
Dynamic: requires-dist
Dynamic: requires-python
Dynamic: summary

# 🛡️ NetSentinel

**NetSentinel** — asinxron port skanı, servis/banner aşkarlanması, Geo-IP məlumatlarının toplanması, SSL/TLS sertifikat analizi, CVE axtarışı, veb təhlükəsizlik başlıqlarının yoxlanılması, risk qiymətləndirilməsi və SIEM üçün JSON loglaşdırmanı birləşdirən Python əsaslı təhlükəsizlik alətidir.

**Current Version:** `1.2.2`

> ⚠️ **Legal Notice:** NetSentinel yalnız sahib olduğunuz və ya skan etməyə açıq icazəniz olan sistemlərdə istifadə edilməlidir. İcazəsiz sistemlərin skan edilməsi qanuni məsuliyyət yarada bilər.

---

## ✨ Features

* ⚡ Asinxron və paralel TCP port skanı
* 🎯 Domen və IP ünvanlarının skanı
* 🔎 Servis və banner aşkarlanması
* 🌍 Geo-IP, ölkə, şəhər və ISP məlumatları
* 🔐 SSL/TLS sertifikat analizi
* 🛡️ CVE axtarışı
* 🌐 Veb təhlükəsizlik başlıqlarının analizi
* 📊 Avtomatik risk səviyyəsinin hesablanması
* 📁 SIEM üçün JSON event logları
* 🎨 Rəngli terminal interfeysi
* 🧵 Tənzimlənə bilən paralel bağlantı sayı
* ⏱️ Tənzimlənə bilən timeout
* 🔇 Quiet mode
* 🔬 Verbose mode
* 🚫 No-color mode

---

## 🧰 Requirements

* Python `3.8+`
* `aiohttp`
* `colorama`

---

## 🚀 Installation

### From source

Clone the repository:

```bash
git clone https://github.com/guseinismyname/netsentinel.git
cd netsentinel
```

Install NetSentinel:

```bash
python3 -m pip install .
```

### Recommended: Virtual Environment

```bash
python3 -m venv .venv
source .venv/bin/activate
python -m pip install .
```

Verify the installation:

```bash
netsentinel -v
```

Expected output:

```text
NetSentinel v1.2.2
```

---

## 🖥️ Basic Usage

Run a basic scan:

```bash
netsentinel -t example.com
```

Scan a specific set of ports:

```bash
netsentinel -t example.com -p 80,443,22
```

Scan a port range:

```bash
netsentinel -t 1.2.268.1.10 -p 1-1000
```

Run CVE lookup for detected services:

```bash
netsentinel -t example.com --cve
```

Save SIEM events to a custom file:

```bash
netsentinel -t example.com -o security_events.json
```

---

## ⚙️ Advanced Usage

### Control concurrent connections

Default:

```bash
netsentinel -t example.com --threads 50
```

Use fewer concurrent connections:

```bash
netsentinel -t example.com --threads 10
```

Use more concurrent connections:

```bash
netsentinel -t example.com --threads 100
```

### Change network timeout

```bash
netsentinel -t example.com --timeout 5
```

The default timeout is:

```text
3 seconds
```

### Combine options

```bash
netsentinel -t example.com --cve --threads 25 --timeout 5
```

---

## 🎛️ CLI Options

| Option          | Description                                  |
| --------------- | -------------------------------------------- |
| `-t, --target`  | Target domain or IP address                  |
| `-p, --ports`   | Ports or port range to scan                  |
| `-o, --output`  | SIEM JSON output file                        |
| `--cve`         | Search for CVEs related to detected services |
| `-q, --quiet`   | Minimal terminal output                      |
| `--verbose`     | Detailed terminal output                     |
| `--no-color`    | Disable terminal colors                      |
| `--threads`     | Number of concurrent connections             |
| `--timeout`     | Network connection timeout                   |
| `-v, --version` | Display NetSentinel version                  |
| `-h, --help`    | Display help information                     |

---

## 🔍 Scan Workflow

NetSentinel performs several analysis stages during a scan:

```text
                    ┌──────────────┐
                    │    Target    │
                    └──────┬───────┘
                           │
                           ▼
                  ┌─────────────────┐
                  │ DNS Resolution  │
                  └────────┬────────┘
                           │
             ┌─────────────┼─────────────┐
             ▼             ▼             ▼
        ┌─────────┐   ┌─────────┐   ┌──────────┐
        │ Geo-IP  │   │ SSL/TLS │   │  Ports   │
        │ Analysis│   │ Analysis│   │  Scan    │
        └─────────┘   └─────────┘   └────┬─────┘
                                         │
                                         ▼
                                ┌─────────────────┐
                                │ Service/Banner  │
                                │   Detection     │
                                └────────┬────────┘
                                         │
                                         ▼
                                  ┌──────────────┐
                                  │ CVE Lookup   │
                                  └──────┬───────┘
                                         │
                                         ▼
                               ┌──────────────────┐
                               │ Web Security     │
                               │ Header Analysis  │
                               └────────┬─────────┘
                                        │
                                        ▼
                               ┌──────────────────┐
                               │ Risk Assessment  │
                               └────────┬─────────┘
                                        │
                                        ▼
                               ┌──────────────────┐
                               │   SIEM JSON      │
                               │     Logging      │
                               └──────────────────┘
```

---

## 🔐 Security Analysis

### Port Scanning

NetSentinel asynchronously checks the selected TCP ports and identifies open services.

Default ports include:

```text
21    FTP
22    SSH
25    SMTP
53    DNS
80    HTTP
110   POP3
143   IMAP
443   HTTPS
3306  MySQL
8080  HTTP Alternate
```

Additional ports can be specified through the `--ports` option.

---

### SSL/TLS Analysis

For HTTPS-enabled targets, NetSentinel attempts to retrieve:

* Certificate issuer
* Certificate expiration information

Example:

```text
[i] SSL Certificate: Let's Encrypt | Expires: ...
```

---

### CVE Lookup

With the `--cve` option, NetSentinel attempts to identify CVEs associated with detected service/banner information.

Example:

```bash
netsentinel -t example.com --cve
```

Detected CVEs are included in the scan output and risk calculation.

---

### Web Security Headers

NetSentinel checks for important HTTP security headers, including:

```text
X-Frame-Options
X-Content-Type-Options
Strict-Transport-Security
Content-Security-Policy
```

Missing headers contribute to the overall risk assessment.

---

## 📊 Risk Assessment

NetSentinel calculates an overall security risk level based on scan results.

Current levels:

```text
LOW
MEDIUM
HIGH
```

The calculation considers:

* Open ports
* Critical ports
* Missing security headers
* Detected CVE results

Example:

```text
[*] Security Level: HIGH
```

> The risk score is intended as a lightweight assessment and should not be treated as a replacement for a professional vulnerability assessment.

---

## 📁 SIEM Integration

NetSentinel generates JSON Lines (`JSONL`) event logs that can be processed by SIEM and log-analysis systems.

Default output:

```text
siem_events.json
```

Custom output:

```bash
netsentinel -t example.com -o security_events.json
```

Example event:

```json
{
  "timestamp": "2026-08-26T12:00:00Z",
  "app": "NetSentinel",
  "version": "1.2.2",
  "event_data": {
    "target": "example.com",
    "target_ip": "93.184.216.34",
    "risk_level": "LOW"
  }
}
```

Each scan is stored as a separate JSON event, making the output suitable for further processing and SIEM ingestion.

---

## 🧪 Example Scan

```bash
netsentinel \
    -t example.com \
    -p 22,80,443,3306 \
    --cve \
    --threads 25 \
    --timeout 5 \
    -o security_events.json
```

Example workflow:

```text
[*] Target IP: 93.184.216.34
[i] Server Location: ...
[i] SSL Certificate: ...
[*] 4 ports scanning...

[+] Port 22    : OPEN
[+] Port 80    : OPEN
[+] Port 443   : OPEN
[+] Port 3306  : CLOSED

[*] Web Security Analysis...
[!] Missing Headers: ...

[*] Security Level: MEDIUM

[SUCCESS] Scan completed.
```

---

## 🛠️ Technology Stack

NetSentinel is built with:

* **Python**
* **asyncio** — asynchronous execution
* **aiohttp** — HTTP requests and API communication
* **socket** — network connections and DNS resolution
* **ssl** — SSL/TLS certificate analysis
* **argparse** — CLI interface
* **JSON** — SIEM event format
* **colorama** — terminal colors

---

## 📦 Project Structure

```text
netsec_project/
│
├── netsec_scanner/
│   ├── __init__.py
│   └── cli.py
│
├── README.md
├── setup.py
│
├── dist/
└── netsentinel.egg-info/
```

The main scanner logic and CLI interface are currently implemented in:

```text
netsec_scanner/cli.py
```

---

## 🗺️ Roadmap

### v1.2.x

* [x] Configurable concurrent connections
* [x] Configurable timeout
* [x] Quiet mode
* [x] Verbose mode
* [x] No-color mode
* [x] Improved CLI interface

### Future Versions

* [ ] Improved service detection
* [ ] Better CVE-to-service correlation
* [ ] CVSS score analysis
* [ ] HTML security reports
* [ ] Advanced vulnerability scanning
* [ ] Modular scanner architecture
* [ ] Extended SIEM integrations
* [ ] Configuration file support
* [ ] Scan profiles
* [ ] Improved reporting

---

## 👤 Author

**Huseyn Qasimzade**

GitHub: `guseinismyname`

---

## ⚖️ Legal Disclaimer

NetSentinel is intended for authorized security testing, network administration, education, and defensive security research.

Do not use NetSentinel against systems, networks, domains, or services without appropriate authorization.

The author is not responsible for misuse of this software or for damage resulting from unauthorized use.

---

## 📄 License

License information will be added in a future release.

