skills.rest
chenchunrun
chenchunrunCOMMUNITY
Explore all skills by this author →
GitHub

auth-log-analysis

Analyze CSV authentication logs for credential stuffing, brute-force, impossible travel, and high-risk detections.

1|1|Updated Apr 25, 2026
Search Tags:#reporting#analyze#brute-force#threat-detection#credential-stuffing#authentication-logs
One-click install
npx skills add https://github.com/chenchunrun/onyx-soc --skill auth-log-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth-log-analysis
Source: https://github.com/chenchunrun/onyx-soc/tree/main/skills/auth-log-analysis
Command: npx skills add https://github.com/chenchunrun/onyx-soc --skill auth-log-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pandas, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify abnormal authentication activity in logs (email, VPN, SSO) to surface threats such as credential stuffing, brute-force, and anomalous travel patterns, enabling rapid response.

Core Features & Use Cases

  • Analyze authentication logs to detect anomalies and security threats.
  • Identify credential stuffing, brute-force attempts, impossible travel, and high-risk login events, then generate a concise risk report.
  • IOC extraction and cross-skill triggering for incident response and containment.

Quick Start

提交认证日志 CSV 文件以获得威胁分析报告。

Frequently Asked Questions about auth-log-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect brute-force attacks and credential stuffing in authentication logs?▼

Detect brute-force attacks and credential stuffing in authentication logs by analyzing CSV inputs containing time, user, IP address, location, and event counts to identify anomalies and generate a concise risk report.

Can I identify impossible travel patterns from CSV login logs?▼

Identify impossible travel patterns from CSV login logs by processing authentication events with configurable column mappings to calculate anomalous geographical movements and extract related indicators of compromise.

Does this authentication log analysis require Python and pandas?▼

Authentication log analysis requires Python 3.8+ and the pandas library for data processing to execute anomaly detection on CSV log inputs and output a structured analysis result with a risk summary.

How do I extract indicators of compromise from high-risk login events?▼

Extract indicators of compromise from high-risk login events by analyzing authentication logs to detect anomalous activities, which then triggers cross-skill actions for incident response and containment.

How do I map custom column names in authentication CSV logs for threat detection?▼

Map custom column names in authentication CSV logs for threat detection using configurable column mappings, allowing the analysis to correctly interpret time, user, IP address, location, and event count fields.

Related Skills

Explore More Data & Analytics Skills→
YukiIto1999YukiIto1999

analyzing-api-gateway-access-logs

Analyze API gateway access logs to surface security threats.

Community
Advanced
Happy-Technologies-LLCHappy-Technologies-LLC
34

incident-summarization

Generate executive and technical security incident reports with MITRE ATT&CK mappings.

Official
Intermediate
wyre-technologywyre-technology
39

Proofpoint TAP Threat Intelligence

Query Proofpoint TAP threat intelligence and SIEM event data for security analysis.

Official
Intermediate
Renzo-TognellaRenzo-Tognella

detecting-anomalous-authentication-patterns

Detect anomalous authentication patterns in logs using UEBA and machine learning.

Community
Advanced