bot-insights

Merge CDN logs with Akamai SIEM enrichment to analyze bot activity.

Updated Apr 10, 2026
One-click install
npx skills add https://github.com/hydrolix/public-skills --skill bot-insights
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: bot-insights
Source: https://github.com/hydrolix/public-skills/tree/main/skills/bot-insights
Command: npx skills add https://github.com/hydrolix/public-skills --skill bot-insights

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Analysts need to correlate CDN logs with bot intelligence to identify and understand bot-driven anomalies and security events.

Core Features & Use Cases

  • Progressive disclosure flow to load only the most relevant reference files (data-model.md, schema.md, and SOC/edge guidance) for focused investigations.
  • Rich signal surface including bot_score, bot_class, bot_intent, verified_bot_owner, and attack_data linked to request metadata.
  • Use cases across SOC/security investigations, SEO governance, edge/ops performance, and executive posture reporting.

Quick Start

Query the bot_detection table for a focused window and read the smallest relevant references to begin an investigation.

Frequently Asked Questions about bot-insights

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze bot activity using CDN logs and Akamai SIEM data?

To analyze bot activity, merge CDN logs with Akamai SIEM enrichment to surface bot signals like bot_score, bot_class, and verified_bot_owner. Query the bot_detection table for a specific time window to correlate request metadata with attack data and security context.

What security context is available when investigating bot-driven anomalies in CDN traffic?

Security context for bot-driven anomalies includes bot_score, bot_class, bot_intent, verified_bot_owner, and linked attack_data. Merging CDN logs with Akamai SIEM enrichment provides detailed evidence-based queries for SOC investigations across multiple CDN sources.

How do I start a bot detection investigation without loading too much data?

Start a bot detection investigation by querying the bot_detection table for a focused time window. Use progressive disclosure to load only the most relevant reference files, such as data-model.md and schema.md, ensuring explicit data-source scoping and timestamp filtering.

Can I use CDN log analysis for SEO governance and executive posture reporting?

Yes, CDN log analysis merged with bot intelligence supports SEO governance, edge/ops performance monitoring, and executive posture reporting. It distinguishes legitimate verified bots from malicious automated traffic to maintain accurate SEO metrics and security posture.

What are the limitations or guardrails when querying bot detection schemas?

Querying the bot_detection schema requires strict guardrails like timestamp filtering and explicit data-source scoping. The 85-column primary table demands precise, evidence-based queries to avoid overwhelming the investigation with irrelevant CDN log data.

Does bot-insights work with multiple CDN sources for threat detection?

Yes, threat detection and bot analytics work across multiple CDN sources. The Skill merges CDN logs with Akamai SIEM enrichment, allowing analysts to investigate bot scoring, ownership, and attack data with consistent guardrails across different CDN inputs.