Parse and analyze security logs to detect anomalous activity.
npx skills add https://github.com/Fuzzdkk/dfir-skills --skill log-analysis-fuzzdkk
Please help me install this Agent Skill. Skill: log-analysis Source: https://github.com/Fuzzdkk/dfir-skills/tree/main/log-analysis Command: npx skills add https://github.com/Fuzzdkk/dfir-skills --skill log-analysis-fuzzdkk
Analyze system and security logs (auth.log, syslog, Windows EVTX, Apache/Nginx, JSON logs). Detect brute force, lateral movement, privilege escalation, and anomalous activity.
Run a log analysis on the target log file or directory to identify anomalies and brute-force patterns.
High-intent search queries and answers about installing and using this skill.
To detect brute-force attacks in Linux auth logs and syslog, you can parse the files to identify anomalous activity and correlate events across sources. This process reveals attack chains and generates a structured security report.
Yes, you can analyze Windows EVTX files to identify privilege escalation and lateral movement. The analysis applies predefined parsing rules to the logs, correlating events across sources to detect these specific anomalous activities.
The best way to parse web server logs for security anomalies is to apply predefined parsing rules that support multiple log formats. This correlates events across log sources to automatically detect anomalous activity and brute-force patterns.
Yes, log analysis works with multiple log formats simultaneously, including Linux auth logs, Windows EVTX, syslog, and web server logs. It correlates events across these diverse sources to reveal comprehensive attack chains.
To get a structured report after analyzing system logs, run an analysis on your target log file or directory. The process parses the logs, detects anomalies like brute-force attempts, and automatically generates the structured report.
YukiIto1999Collect, parse, and correlate Windows EVTX, Linux syslog, and web access logs into a unified forensic timeline.
groeimetaiAutomate ServiceNow SecOps incident, vulnerability, and threat intelligence workflows.
jmaglyCorrelate authentication, system, application, and web server logs to detect attacker activity patterns.
zebbernEnumerate Windows privileges and misconfigurations to identify privilege escalation vectors.
