skills.rest
woohyun212
woohyun212COMMUNITY
Explore all skills by this author →
WebsiteGitHub

log-analysis

Analyze security logs to detect anomalies and summarize suspicious activity.

21|1|Updated Apr 12, 2026
Search Tags:#anomaly-detection#log-analysis#incident-response#security-monitoring#syslog#access-logs#auth-logs
One-click install
npx skills add https://github.com/woohyun212/security-skill --skill log-analysis-woohyun212
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: log-analysis
Source: https://github.com/woohyun212/security-skill/tree/main/log-analysis
Command: npx skills add https://github.com/woohyun212/security-skill --skill log-analysis-woohyun212

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detects and summarizes anomalous activity in server logs to accelerate incident triage and routine monitoring. It reduces the time needed to identify brute-force attempts, scanning behavior, failed authentications, and systemic error patterns across access, auth, and syslog files.

Core Features & Use Cases

  • Top-N summarization: Extracts top IPs, request paths, HTTP status distributions, and User-Agents from web access logs.
  • Anomaly detection: Identifies suspected brute-force activity (multiple 401s), scanning/path enumeration (high 404 counts), and recurring auth failures, and suggests example blocking commands.
  • Syslog and auth analysis: Aggregates error/warning patterns, top processes emitting errors, failed and successful login summaries, and builds an hourly timeline for reconstruction.
  • Use Case: During an incident response, run this skill on recent access and auth logs to quickly produce a timeline, list suspicious IPs, and prioritize follow-up actions.

Quick Start

Ask the skill to analyze /var/log/nginx/access.log for anomalies and produce a timeline and summary report.

Frequently Asked Questions about log-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect brute-force attempts and path scanning in web access logs?▼

Analyze web access logs to detect anomalies by computing top IPs, request paths, and HTTP status distributions. It identifies suspected brute-force activity through multiple 401 responses and path enumeration scanning via high 404 counts.

How do I summarize failed authentications and error patterns in system syslog files?▼

Aggregate system syslog files to extract error and warning patterns, identify top processes emitting errors, and summarize failed and successful logins. It also builds an hourly timeline to assist in reconstructing incident events.

Does this log analysis approach require specific dependencies or environments to run?▼

No external dependencies are required. Log analysis relies on standard command-line utilities including grep, awk, sort, uniq, and python3 to parse common combined log formats and perform advanced anomaly detection.

What is the best way to generate an incident response timeline from server logs?▼

Run anomaly detection on recent access and auth logs to quickly produce an hourly timeline, list suspicious IPs, and summarize suspicious activity. This accelerates incident triage and helps prioritize follow-up actions.

Can I get suggested IP block commands directly from auth log analysis results?▼

Yes, analyzing auth logs for recurring authentication failures and suspected brute-force activity yields summarized suspicious IPs and suggests example blocking commands to help mitigate immediate threats during incident response.

Why does my security log analysis only extract top IPs and HTTP status code distributions?▼

Top-N summarization focuses on extracting top IPs, request paths, HTTP status distributions, and User-Agents to reduce noise and quickly highlight anomalous behavior, which is critical for accelerating routine monitoring and incident triage.

Related Skills

Explore More Data & Analytics Skills→
GhostPWNGhostPWN
4

Log Analysis & SIEM Integration

Parse security logs and generate SIEM detection queries for Splunk, Elastic, QRadar, Sentinel, and Sigma.

Official
Advanced
leonardoteodorooleonardoteodoroo

postmortem-writing

Generate blameless postmortems with root cause analysis, timelines, and action items.

Community
Advanced
alangebalangeb

shell_scripting

Process system logs and test outputs with Unix command-line utilities.

Community
Intermediate
claude-office-skillsclaude-office-skills
368

Security Monitoring

Automate security monitoring, threat detection, and incident response workflows.

Official
Advanced