665,000+ skills indexed

AxxxxxxaaannCOMMUNITY

Explore all skills by this author →

Verified:GitHub

analyzing-web-server-logs-for-intrusion

Detect SQLi, LFI, XSS, brute-force attempts in Apache/Nginx logs with GeoIP enrichment and JSON output for threat-hunting workflows.

Updated Aug 27, 2026

Search Tags:#regex #analyze #brute-force #log-analysis #intrusion-detection #web-logs #geoip

One-click install

npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-web-server-logs-for-intrusion

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: analyzing-web-server-logs-for-intrusion
Source: https://github.com/Axxxxxxaaann/KAIRI-Skills/tree/main/skills/analyzing-web-server-logs-for-intrusion
Command: npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-web-server-logs-for-intrusion

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires geoip2, and includes scripts (resource) and references (resource) components.

What problem does it solve?

The skill analyzes Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-force patterns, with GeoIP attribution and anomaly-based insights.

Core Features & Use Cases

Detect SQLi, LFI, XSS, and scanner signatures in web server logs using regex-based rules mapped to OWASP patterns.
Enrich detections with GeoIP data to attribute sources and profile attacker geography.
Brute-force detection across common login endpoints and generation of attacker summaries for threat-hunting workflows.
Use Case: SOC analysts can run the agent on a log backlog to generate a structured intrusion report suitable for SIEM ingestion.

Quick Start

Run the analysis on your web server access logs to produce a findings report.

Frequently Asked Questions about analyzing-web-server-logs-for-intrusion

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect SQL injection and XSS attempts in Apache and Nginx access logs?▼

To detect SQL injection and XSS in Apache and Nginx logs, apply regex-based signatures mapped to OWASP patterns. This identifies and classifies web intrusion indicators within your access logs to pinpoint malicious requests.

What is the best way to detect brute-force login attempts from web server logs?▼

Detecting brute-force login attempts is done by correlating suspicious requests by IP across common login endpoints. This generates attacker profiles and summaries suitable for threat-hunting workflows.

Can I enrich suspicious IP addresses with GeoIP data during log analysis?▼

Yes, you can enrich suspicious IP addresses with GeoIP data during log analysis. This requires the geoip2 dependency and attributes sources to profile attacker geography for threat hunting.

How do I generate SIEM-ready reports from raw web server access logs?▼

Generate SIEM-ready reports from access logs using a Python-based parser that applies deterministic pattern matching. This produces structured JSON reporting of intrusion detections for SIEM ingestion.

Does this log analysis approach detect local file inclusion and directory traversal attacks?▼

Yes, this log analysis approach detects local file inclusion and directory traversal attacks. It applies regex-based rules to web server access logs to identify these specific web scanner fingerprints.

Related Skills

Explore More Data & Analytics Skills→

detect-anomalies

Identify anomalies in Axiom datasets using statistical analysis on logs, metrics, and traces.

escalation-alert

Escalate critical incidents to designated team channels with structured alert messages.

enrich-ioc

Enrich IOC indicators with GTI and Chronicle SIEM context to output threat findings and summaries.

SECUpdates

Aggregate security news into a ranked digest with categories and source attribution.