蓝队警报服务器：构建安全监控系统的实战模拟

from fastapi import FastAPI, BackgroundTasks 
import logging 
import random 

app = FastAPI()
logging.basicConfig(filename='alerts.log', level=logging.INFO)

@app.get("/detect-activity")
async def detect_activity():
    activities = [
        "检测到异常登录尝试",
        "检测到多次密码尝试失败",
        "检测到可疑文件下载",
        "检测到异常出站流量"
    ]
    activity = random.choice(activities)
    logging.info(f"警报: {activity}")
    return {"alert": activity}

@app.get("/alerts")
async def get_alerts():
    with open('alerts.log', 'r') as file:
        logs = file.readlines()
    return {"alerts": logs}

if __name__ == "__main__":
    import uvicorn
    uvicorn.run(app, host="0.0.0.0", port=8002)

uvicorn blue_team_server:app --reload