auth-log-analysis

Name: auth-log-analysis
Availability: InStock
Author: chenchunrun

Analyze CSV authentication logs for credential stuffing, brute-force, impossible travel, and high-risk detections.

1|1|Updated Apr 25, 2026

Search Tags:#reporting #analyze #brute-force #threat-detection #credential-stuffing #authentication-logs

Ready to run

npx skills add https://github.com/chenchunrun/onyx-soc --skill auth-log-analysis

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: auth-log-analysis
Source: https://github.com/chenchunrun/onyx-soc/tree/main/skills/auth-log-analysis
Command: npx skills add https://github.com/chenchunrun/onyx-soc --skill auth-log-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pandas, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify abnormal authentication activity in logs (email, VPN, SSO) to surface threats such as credential stuffing, brute-force, and anomalous travel patterns, enabling rapid response.

Core Features & Use Cases

Analyze authentication logs to detect anomalies and security threats.
Identify credential stuffing, brute-force attempts, impossible travel, and high-risk login events, then generate a concise risk report.
IOC extraction and cross-skill triggering for incident response and containment.

Quick Start

提交认证日志 CSV 文件以获得威胁分析报告。

Frequently Asked Questions about auth-log-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect brute-force attacks and credential stuffing in authentication logs?▼

Detect brute-force attacks and credential stuffing in authentication logs by analyzing CSV inputs containing time, user, IP address, location, and event counts to identify anomalies and generate a concise risk report.

Can I identify impossible travel patterns from CSV login logs?▼

Identify impossible travel patterns from CSV login logs by processing authentication events with configurable column mappings to calculate anomalous geographical movements and extract related indicators of compromise.

Does this authentication log analysis require Python and pandas?▼

Authentication log analysis requires Python 3.8+ and the pandas library for data processing to execute anomaly detection on CSV log inputs and output a structured analysis result with a risk summary.

How do I extract indicators of compromise from high-risk login events?▼

Extract indicators of compromise from high-risk login events by analyzing authentication logs to detect anomalous activities, which then triggers cross-skill actions for incident response and containment.

How do I map custom column names in authentication CSV logs for threat detection?▼

Map custom column names in authentication CSV logs for threat detection using configurable column mappings, allowing the analysis to correctly interpret time, user, IP address, location, and event count fields.