log-analysis

What this skill does

Analyzes security log files to detect anomalies. Extracts top IPs, paths, status codes, and User-Agents from web access logs, and detects brute-force patterns (multiple 401s) and scanning behavior (sequential path enumeration). Extracts failed login patterns from auth logs and error/warning patterns from syslog, then outputs a summary report with a timeline.

When to use

• Analyzing access logs when a web server compromise is suspected
• Checking whether an SSH brute-force attack has occurred
• Reconstructing an attack timeline during incident response
• Automating routine security monitoring and anomaly detection

Prerequisites

• grep, awk, sort, uniq (available by default on most Linux systems)
• python3 (advanced analysis and report generation)
• Read access to the target log files

Inputs