Web Server Log Analysis
FreeDetect intrusions by analyzing web server access logs.
Free · Opens the source repo
What Web Server Log Analysis does
This skill provides a robust framework for analyzing Apache and Nginx web server access logs to identify potential security threats. By leveraging regex-based pattern matching against known OWASP attack signatures, it can effectively detect various types of attacks such as SQL injection, local file inclusion, directory traversal, and brute-force attempts. The skill also enriches log data with GeoIP information to provide context about the source of the requests, which can be crucial for incident response and threat hunting.
The process begins with the collection of web server logs in the appropriate format. The skill parses each log entry, extracting essential details such as the IP address, timestamp, request method, URI, status code, response size, user-agent, and referer. Once the data is prepared, it applies a series of predefined detection rules to identify suspicious patterns and behaviors. The output is a prioritized findings report that highlights potential security incidents, allowing analysts to focus their efforts on the most critical threats.
This skill is particularly useful for security operations center (SOC) analysts and security professionals who require structured procedures for log analysis. It can also assist in validating security monitoring coverage and developing detection rules tailored to specific environments. By automating the log analysis process, users can save time and improve the accuracy of their threat detection efforts, making it a valuable addition to any cybersecurity toolkit.
When to use it
Use this skill when investigating security incidents or when building detection rules for threat hunting in web server environments.
When not to use it
This skill is not suitable for environments that do not utilize Apache or Nginx servers or for those seeking real-time monitoring solutions.
What you can build with it
Incident Investigation
Use this skill to analyze logs during a security incident to identify the nature and scope of the attack.
Threat Hunting
Build detection rules and queries to proactively search for potential threats in your web server logs.
Security Monitoring Validation
Validate your existing security monitoring coverage by running this skill against historical log data.
How to install Web Server Log Analysis
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/analyzing-web-server-logs-for-intrusion --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Analyzing Web Server Logs for Intrusion
When to Use
- When investigating security incidents that require analyzing web server logs for intrusion
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Familiarity with security operations concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Instructions
- Install dependencies:
pip install geoip2 user-agents - Collect web server access logs in Combined Log Format (Apache) or Nginx default format.
- Parse each log entry extracting: IP, timestamp, method, URI, status code, response size, user-agent, referer.
- Apply detection rules:
- SQL injection:
UNION SELECT,OR 1=1,' OR ', hex encoding patterns - LFI/Path traversal:
../,/etc/passwd,/proc/self,php://filter - XSS:
<script>,javascript:,onerror=,onload= - Scanner signatures: nikto, sqlmap, dirbuster, gobuster, wfuzz user-agents
- Brute force: >50 POST requests to login endpoints from same IP in 5 minutes
- SQL injection:
- Enrich with GeoIP data and generate a prioritized findings report.
python scripts/agent.py --log-file /var/log/nginx/access.log --geoip-db GeoLite2-City.mmdb --output web_intrusion_report.json
Examples
Detect SQLi in URI
192.168.1.100 - - [15/Jan/2024:10:30:45 +0000] "GET /products?id=1' UNION SELECT username,password FROM users-- HTTP/1.1" 200 4532
Scanner User-Agent Detection
Nikto/2.1.6, sqlmap/1.7, DirBuster-1.0-RC1, gobuster/3.1.0
Frequently asked questions about Web Server Log Analysis
Similar skills
GitHub Actions Hardening
Enhance the security of your GitHub Actions workflows.
Sensitive Logging Audit
Audit and fix sensitive data exposure in Python logging.
Android App Static Analysis
Automate security assessments of Android apps with MobSF.
Integrating DAST with OWASP ZAP
Seamlessly integrate dynamic security testing into CI/CD pipelines.
Implementing Runtime Security with Tetragon
Enhance Kubernetes security with eBPF-based observability.
Implementing Mobile Application Management
Secure enterprise data on mobile devices with app-level controls.