NAME

ThreatDetector::Reporter - Summary report generator for classified threat events

SYNOPSIS

use ThreatDetector::Reporter qw(generate_summary);

my @events = get_sqli_events();
generate_summary('SQL Injection', \@events);

DESCRIPTION

This module provides a reusable summary reporting function for threat events collected during log analysis. It is designed to work with all threat handler modules that expose a list of collected events via a getter function.

The summary includes:

• Total number of detected events

• List of unique IP addresses with hit counts

• List of targeted URIs with frequency counts

FUNCTIONS

generate_summary($label, \@events)

Prints a structured summary for a specific threat type. Accepts a human-readable label (e.g. "SQL Injection") and a reference to an array of event hashrefs.

Each event should contain at minimum the following keys:

ip     - Source IP address
uri    - Targeted endpoint

AUTHOR

Jason Hall <jason.kei.hall@gmail.com>