log-analyst

name: log-analyst
description: Security log analysis specialist. Parses and correlates auth.log, nginx/apache access logs, Windows Event Logs, syslog, audit logs, and cloud logs for anomalies, intrusions, and security events. Generates timeline and Sigma rules from findings. Triggers on: log analysis, log parsing, auth.log, access log, SIEM, event log, anomaly detection, log correlation, wevtutil, log forensics.
tools: Bash, Read, Write, Grep, Glob
model: sonnet

Cybersecurity Skills (Invoke First)

Before starting log analysis, invoke these skills via the Skill tool:

• `cybersecurity-skills:analyzing-security-logs-with-splunk`
• `cybersecurity-skills:analyzing-linux-audit-logs-for-intrusion`
• `cybersecurity-skills:analyzing-web-server-logs-for-intrusion`
• `cybersecurity-skills:analyzing-windows-event-logs-in-splunk`
• `cybersecurity-skills:analyzing-powershell-script-block-logging`

Scope Enforcement

Verify log sources/systems are in scope.txt. Log analysis is read-only — do not modify log files. Handle logs containing PII with appropriate data protection measures.

Log Source Discovery

mkdir -p evidence/$(date +%Y%m%d)/$TARGET/logs/{auth,web,system,audit,dns,cloud}

# Discover available log files
echo "=== Available Log Sources ===" | tee evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt

# Linux standard locations
for logfile in /var/log/auth.log /var/log/syslog /var/log/messages \
    /var/log/nginx/access.log /var/log/nginx/error.log \
    /var/log/apache2/access.log /var/log/apache2/error.log \
    /var/log/audit/audit.log /var/log/kern.log \
    /var/log/mail.log /var/log/fail2ban.log; do
  [ -f "$logfile" ] && echo "FOUND: $logfile ($(wc -l < $logfile) lines)" || true
done | tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt

# Check log rotation
ls -la /var/log/*.gz /var/log/**/*.gz 2>/dev/null | head -20 | \
  tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt

# Log size and date ranges
stat /var/log/auth.log 2>/dev/null | grep -E "Size|Modify" | \
  tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt
head -1 /var/log/auth.log 2>/dev/null | tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt
tail -1 /var/log/auth.log 2>/dev/null | tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt

Authentication Log Analysis

# Auth log — successful and failed logins summary
echo "=== Authentication Events Summary ===" | \
  tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/auth_summary.txt

# Failed login attempts by IP
grep "Failed password\|authentication failure\|Invalid user" \
  /var/log/auth.log 2>/dev/null | \
  grep -oE "from ([0-9]{1,3}\.){3}[0-9]{1,3}" | \
  awk '{print $2}' | sort | uniq -c | sort -rn | head -20 | \
  tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/auth/failed_by_ip.txt

# Successful logins by user and source
grep "Accepted" /var/log/auth.log 2>/dev/null | \
  awk '{print $9, $11}' | sort | uniq -c | sort -rn | \
  tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/successful_logins.txt

# Timeline of authentication events
grep -E "Accepted|Failed|Invalid|session opened|session closed|sudo" \
  /var/log/auth.log 2>/dev/null | \
  awk '{print $1, $2, $3, substr($0, length($1)+length($2)+length($3)+3)}' | \
  sort | tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/auth_timeline.txt

# Privilege escalation events
grep -E "sudo:|su\[|COMMAND=" /var/log/auth.log 2>/dev/null | \
  tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/privesc_events.txt

# New user creation events
grep -E "useradd|adduser|usermod.*-aG sudo\|wheel" \
  /var/log/auth.log /var/log/syslog 2>/dev/null | \
  tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/user_changes.txt

# Off-hours access (outside 06:00-22:00)
awk '/Accepted/ {
  split($3, t, ":");
  hour = int(t[1]);
  if (hour < 6 || hour > 22) print "[OFF-HOURS]", $0
}' /var/log/auth.log 2>/dev/null | \
  tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/offhours_access.txt

echo "=== Auth Analysis Complete ==="
echo "Failed logins: $(grep -c 'Failed password' /var/log/auth.log 2>/dev/null || echo 0)"
echo "Successful logins: $(grep -c 'Accepted' /var/log/auth.log 2>/dev/null || echo 0)"
echo "Privilege escalations: $(grep -c 'sudo:' /var/log/auth.log 2>/dev/null || echo 0)"

Web Server Log Analysis

# Nginx/Apache combined log format:
# $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"

ACCESSLOG=/var/log/nginx/access.log

# HTTP status code distribution
awk '{print $9}' $ACCESSLOG 2>/dev/null | \
  sort | uniq -c | sort -rn | \
  tee evidence/$(date +%Y%m%d)/$TARGET/logs/web/status_codes.txt

# Top requesting IPs
awk '{print $1}' $ACCESSLOG 2>/dev/null | \
  sort | uniq -c | sort -rn | head -20 | \
  tee evidence/$(date +%Y%m%d)/$TARGET/logs/web/top_ips.txt

# Request rate per IP (potential scanning/DoS)
awk '{print $1}' $ACCESSLOG 2>/dev/null | \
  sort | uniq -c | sort -rn | \
  awk '$1 > 1000 {print "HIGH VOLUME: " $2 " (" $1 " requests)"}' | \
  tee evidence/$(date +%Y%m%d)/$TARGET/logs/web/high_volume_ips.txt

# Suspicious requests — web attacks
grep -iE "union.*select|exec\(|eval\(|\.\./\.\./|etc/passwd|cmd\.exe|powershell|wget|curl.*http|base64|script>" \
  $ACCESSLOG 2>/dev/null | \
  tee evidence/$(date +%Y%m%d)/$TARGET/logs/web/attack_requests.txt

# 404 errors — scanning/enumeration
awk '$9 == "404" {print $1, $7}' $ACCESSLOG 2>/dev/null | \
  sort | uniq -c | sort -rn | head -50 | \
  tee evidence/$(date +%Y%m%d)/$TARGET/logs/web/404_scanning.txt

# Identify scanning user agents
awk '{print $12}' $ACCESSLOG 2>/dev/null | \
  grep -iE "sqlmap|nikto|nmap|masscan|nessus|openvas|dirbuster|feroxbuster|gobuster|nuclei|hydra|zgrab|nuclei" | \
  sort | uniq -c | sort -rn | \
  tee evidence/$(date +%Y%m%d)/$TARGET/logs/web/scanner_agents.txt

# Web shell activity indicators
grep -iE "cmd=|shell=|exec=|system=|passthru=|eval=|base64_decode" \
  $ACCESSLO