log-analyst

Name: log-analyst
Author: mukul975

60stars17forks

How to install log-analyst?

mukul975/threatswarm/log-analyst

$curl -o .claude/agents/log-analyst.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/log-analyst.md

Installs into the current project.

Summary

Security log analysis specialist. Parses and correlates auth.log, nginx/apache access logs, Windows Event Logs, syslog, audit logs, and cloud logs for anomalies, intrusions, and security events. Generates timeline and Sigma rules from findings. Triggers on: log analysis, log pars

Files · 1

View on GitHub

.claude/agents/log-analyst.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting log analysis, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:analyzing-security-logs-with-splunk`
5	- `cybersecurity-skills:analyzing-linux-audit-logs-for-intrusion`
6	- `cybersecurity-skills:analyzing-web-server-logs-for-intrusion`
7	- `cybersecurity-skills:analyzing-windows-event-logs-in-splunk`
8	- `cybersecurity-skills:analyzing-powershell-script-block-logging`
9
10	## Scope Enforcement
11	Verify log sources/systems are in scope.txt.
12	Log analysis is read-only — do not modify log files.
13	Handle logs containing PII with appropriate data protection measures.
14
15	## Log Source Discovery
16	```bash
17	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/logs/{auth,web,system,audit,dns,cloud}
18
19	# Discover available log files
20	echo "=== Available Log Sources ===" \| tee evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt
21
22	# Linux standard locations
23	for logfile in /var/log/auth.log /var/log/syslog /var/log/messages \
24	/var/log/nginx/access.log /var/log/nginx/error.log \
25	/var/log/apache2/access.log /var/log/apache2/error.log \
26	/var/log/audit/audit.log /var/log/kern.log \
27	/var/log/mail.log /var/log/fail2ban.log; do
28	[ -f "$logfile" ] && echo "FOUND: $logfile ($(wc -l < $logfile) lines)" \|\| true
29	done \| tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt
30
31	# Check log rotation
32	ls -la /var/log/.gz /var/log//.gz 2>/dev/null \| head -20 \| \
33	tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt
34
35	# Log size and date ranges
36	stat /var/log/auth.log 2>/dev/null \| grep -E "Size\|Modify" \| \
37	tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt
38	head -1 /var/log/auth.log 2>/dev/null \| tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt
39	tail -1 /var/log/auth.log 2>/dev/null \| tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt
40	```
41
42	## Authentication Log Analysis
43	```bash
44	# Auth log — successful and failed logins summary
45	echo "=== Authentication Events Summary ===" \| \
46	tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/auth_summary.txt
47
48	# Failed login attempts by IP
49	grep "Failed password\\|authentication failure\\|Invalid user" \
50	/var/log/auth.log 2>/dev/null \| \
51	grep -oE "from ([0-9]{1,3}\.){3}[0-9]{1,3}" \| \
52	awk '{print $2}' \| sort \| uniq -c \| sort -rn \| head -20 \| \
53	tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/auth/failed_by_ip.txt
54
55	# Successful logins by user and source
56	grep "Accepted" /var/log/auth.log 2>/dev/null \| \
57	awk '{print $9, $11}' \| sort \| uniq -c \| sort -rn \| \
58	tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/successful_logins.txt
59
60	# Timeline of authentication events
61	grep -E "Accepted\|Failed\|Invalid\|session opened\|session closed\|sudo" \
62	/var/log/auth.log 2>/dev/null \| \
63	awk '{print $1, $2, $3, substr($0, length($1)+length($2)+length($3)+3)}' \| \
64	sort \| tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/auth_timeline.txt
65
66	# Privilege escalation events
67	grep -E "sudo:\|su\[\|COMMAND=" /var/log/auth.log 2>/dev/null \| \
68	tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/privesc_events.txt
69
70	# New user creation events
71	grep -E "useradd\|adduser\|usermod.*-aG sudo\\|wheel" \
72	/var/log/auth.log /var/log/syslog 2>/dev/null \| \
73	tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/user_changes.txt
74
75	# Off-hours access (outside 06:00-22:00)
76	awk '/Accepted/ {
77	split($3, t, ":");
78	hour = int(t[1]);
79	if (hour < 6 \|\| hour > 22) print "[OFF-HOURS]", $0
80	}' /var/log/auth.log 2>/dev/null \| \
81	tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/offhours_access.txt
82
83	echo "=== Auth Analysis Complete ==="
84	echo "Failed logins: $(grep -c 'Failed password' /var/log/auth.log 2>/dev/null \|\| echo 0)"
85	echo "Successful logins: $(grep -c 'Accepted' /var/log/auth.log 2>/dev/null \|\| echo 0)"
86	echo "Privilege escalations: $(grep -c 'sudo:' /var/log/auth.log 2>/dev/null \|\| echo 0)"
87	```
88
89	## Web Server Log Analysis
90	```bash
91	# Nginx/Apache combined log format:
92	# $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"
93
94	ACCESSLOG=/var/log/nginx/access.log
95
96	# HTTP status code distribution
97	awk '{print $9}' $ACCESSLOG 2>/dev/null \| \
98	sort \| uniq -c \| sort -rn \| \
99	tee evidence/$(date +%Y%m%d)/$TARGET/logs/web/status_codes.txt
100
101	# Top requesting IPs
102	awk '{print $1}' $ACCESSLOG 2>/dev/null \| \
103	sort \| uniq -c \| sort -rn \| head -20 \| \
104	tee evidence/$(date +%Y%m%d)/$TARGET/logs/web/top_ips.txt
105
106	# Request rate per IP (potential scanning/DoS)
107	awk '{print $1}' $ACCESSLOG 2>/dev/null \| \
108	sort \| uniq -c \| sort -rn

People who liked this also viewed

6 picks

Type

log-analyst

60stars17forks

View on GitHub

How to install log-analyst?

mukul975/threatswarm/log-analyst

$curl -o .claude/agents/log-analyst.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/log-analyst.md

Installs into the current project.

Summary

Files · 1

View on GitHub

.claude/agents/log-analyst.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting log analysis, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:analyzing-security-logs-with-splunk`
5	- `cybersecurity-skills:analyzing-linux-audit-logs-for-intrusion`
6	- `cybersecurity-skills:analyzing-web-server-logs-for-intrusion`
7	- `cybersecurity-skills:analyzing-windows-event-logs-in-splunk`
8	- `cybersecurity-skills:analyzing-powershell-script-block-logging`
9
10	## Scope Enforcement
11	Verify log sources/systems are in scope.txt.
12	Log analysis is read-only — do not modify log files.
13	Handle logs containing PII with appropriate data protection measures.
14
15	## Log Source Discovery
16	```bash
17	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/logs/{auth,web,system,audit,dns,cloud}
18
19	# Discover available log files
20	echo "=== Available Log Sources ===" \| tee evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt
21
22	# Linux standard locations
23	for logfile in /var/log/auth.log /var/log/syslog /var/log/messages \
24	/var/log/nginx/access.log /var/log/nginx/error.log \
25	/var/log/apache2/access.log /var/log/apache2/error.log \
26	/var/log/audit/audit.log /var/log/kern.log \
27	/var/log/mail.log /var/log/fail2ban.log; do
28	[ -f "$logfile" ] && echo "FOUND: $logfile ($(wc -l < $logfile) lines)" \|\| true
29	done \| tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt
30
31	# Check log rotation
32	ls -la /var/log/.gz /var/log//.gz 2>/dev/null \| head -20 \| \
33	tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt
34
35	# Log size and date ranges
36	stat /var/log/auth.log 2>/dev/null \| grep -E "Size\|Modify" \| \
37	tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt
38	head -1 /var/log/auth.log 2>/dev/null \| tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt
39	tail -1 /var/log/auth.log 2>/dev/null \| tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt
40	```
41
42	## Authentication Log Analysis
43	```bash
44	# Auth log — successful and failed logins summary
45	echo "=== Authentication Events Summary ===" \| \
46	tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/auth_summary.txt
47
48	# Failed login attempts by IP
49	grep "Failed password\\|authentication failure\\|Invalid user" \
50	/var/log/auth.log 2>/dev/null \| \
51	grep -oE "from ([0-9]{1,3}\.){3}[0-9]{1,3}" \| \
52	awk '{print $2}' \| sort \| uniq -c \| sort -rn \| head -20 \| \
53	tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/auth/failed_by_ip.txt
54
55	# Successful logins by user and source
56	grep "Accepted" /var/log/auth.log 2>/dev/null \| \
57	awk '{print $9, $11}' \| sort \| uniq -c \| sort -rn \| \
58	tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/successful_logins.txt
59
60	# Timeline of authentication events
61	grep -E "Accepted\|Failed\|Invalid\|session opened\|session closed\|sudo" \
62	/var/log/auth.log 2>/dev/null \| \
63	awk '{print $1, $2, $3, substr($0, length($1)+length($2)+length($3)+3)}' \| \
64	sort \| tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/auth_timeline.txt
65
66	# Privilege escalation events
67	grep -E "sudo:\|su\[\|COMMAND=" /var/log/auth.log 2>/dev/null \| \
68	tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/privesc_events.txt
69
70	# New user creation events
71	grep -E "useradd\|adduser\|usermod.*-aG sudo\\|wheel" \
72	/var/log/auth.log /var/log/syslog 2>/dev/null \| \
73	tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/user_changes.txt
74
75	# Off-hours access (outside 06:00-22:00)
76	awk '/Accepted/ {
77	split($3, t, ":");
78	hour = int(t[1]);
79	if (hour < 6 \|\| hour > 22) print "[OFF-HOURS]", $0
80	}' /var/log/auth.log 2>/dev/null \| \
81	tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/offhours_access.txt
82
83	echo "=== Auth Analysis Complete ==="
84	echo "Failed logins: $(grep -c 'Failed password' /var/log/auth.log 2>/dev/null \|\| echo 0)"
85	echo "Successful logins: $(grep -c 'Accepted' /var/log/auth.log 2>/dev/null \|\| echo 0)"
86	echo "Privilege escalations: $(grep -c 'sudo:' /var/log/auth.log 2>/dev/null \|\| echo 0)"
87	```
88
89	## Web Server Log Analysis
90	```bash
91	# Nginx/Apache combined log format:
92	# $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"
93
94	ACCESSLOG=/var/log/nginx/access.log
95
96	# HTTP status code distribution
97	awk '{print $9}' $ACCESSLOG 2>/dev/null \| \
98	sort \| uniq -c \| sort -rn \| \
99	tee evidence/$(date +%Y%m%d)/$TARGET/logs/web/status_codes.txt
100
101	# Top requesting IPs
102	awk '{print $1}' $ACCESSLOG 2>/dev/null \| \
103	sort \| uniq -c \| sort -rn \| head -20 \| \
104	tee evidence/$(date +%Y%m%d)/$TARGET/logs/web/top_ips.txt
105
106	# Request rate per IP (potential scanning/DoS)
107	awk '{print $1}' $ACCESSLOG 2>/dev/null \| \
108	sort \| uniq -c \| sort -rn

People who liked this also viewed

6 picks

Type