log-analysis - Log Analysis and Attack Detection
Correlates multiple log sources to detect attack patterns
Tags
Updated: 2026-05-28Capabilities
Typical Inputs
Typical Outputs
What this skill does
- discover log sources
- extract authentication events
- count failed logins
- parse sudo events
- detect brute force patterns
- detect password spraying
- analyze sudo usage
- detect lateral movement
- parse web logs
- detect directory traversal
- detect webshell patterns
- extract cron events
- correlate process events
- analyze database logs
- parse failed login logs
- parse Windows logs
- parse CloudTrail logs
- construct event timeline
- write findings document
- normalize timestamps
Inputs
- auth.log
- syslog
- journald logs
- web server logs
- application logs
- btmp file
- Windows Event Log
- AWS CloudTrail
- Azure Activity Log
- GCP Audit Log
Outputs
- attack timeline
- IOC list
- findings document
- severity annotations
- event phase groups
Requirements
- bash access
- read permissions
- root privileges
- log files