log-analyst

Cybersecurity Skills (Invoke First)

Before starting log analysis, invoke these skills via the Skill tool:

• cybersecurity-skills:analyzing-security-logs-with-splunk
• cybersecurity-skills:analyzing-linux-audit-logs-for-intrusion
• cybersecurity-skills:analyzing-web-server-logs-for-intrusion
• cybersecurity-skills:analyzing-windows-event-logs-in-splunk
• cybersecurity-skills:analyzing-powershell-script-block-logging

Scope Enforcement

Verify log sources/systems are in scope.txt. Log analysis is read-only — do not modify log files. Handle logs containing PII with appropriate data protection measures.

Log Source Discovery

mkdir -p evidence/$(date +%Y%m%d)/$TARGET/logs/{auth,web,system,audit,dns,cloud}

# Discover available log files
echo "=== Available Log Sources ===" | tee evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt

# Linux standard locations
for logfile in /var/log/auth.log /var/log/syslog /var/log/messages \
    /var/log/nginx/access.log /var/log/nginx/error.log \
    /var/log/apache2/access.log /var/log/apache2/error.log \
    /var/log/audit/audit.log /var/log/kern.log \
    /var/log/mail.log /var/log/fail2ban.log; do
  [ -f "$logfile" ] && echo "FOUND: $logfile ($(wc -l < $logfile) lines)" || true
done | tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt

# Check log rotation
ls -la /var/log/*.gz /var/log/**/*.gz 2>/dev/null | head -20 | \
  tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt

# Log size and date ranges
stat /var/log/auth.log 2>/dev/null | grep -E "Size|Modify" | \
  tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt
head -1 /var/log/auth.log 2>/dev/null | tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt
tail -1 /var/log/auth.log 2>/dev/null | tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/available_sources.txt

Authentication Log Analysis

# Auth log — successful and failed logins summary
echo "=== Authentication Events Summary ===" | \
  tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/auth_summary.txt

# Failed login attempts by IP
grep "Failed password\|authentication failure\|Invalid user" \
  /var/log/auth.log 2>/dev/null | \
  grep -oE "from ([0-9]{1,3}\.){3}[0-9]{1,3}" | \
  awk '{print $2}' | sort | uniq -c | sort -rn | head -20 | \
  tee -a evidence/$(date +%Y%m%d)/$TARGET/logs/auth/failed_by_ip.txt

# Successful logins by user and source
grep "Accepted" /var/log/auth.log 2>/dev/null | \
  awk '{print $9, $11}' | sort | uniq -c | sort -rn | \
  tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/successful_logins.txt

# Timeline of authentication events
grep -E "Accepted|Failed|Invalid|session opened|session closed|sudo" \
  /var/log/auth.log 2>/dev/null | \
  awk '{print $1, $2, $3, substr($0, length($1)+length($2)+length($3)+3)}' | \
  sort | tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/auth_timeline.txt

# Privilege escalation events
grep -E "sudo:|su\[|COMMAND=" /var/log/auth.log 2>/dev/null | \
  tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/privesc_events.txt

# New user creation events
grep -E "useradd|adduser|usermod.*-aG sudo\|wheel" \
  /var/log/auth.log /var/log/syslog 2>/dev/null | \
  tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/user_changes.txt

# Off-hours access (outside 06:00-22:00)
awk '/Accepted/ {
  split($3, t, ":");
  hour = int(t[1]);
  if (hour < 6 || hour > 22) print "[OFF-HOURS]", $0
}' /var/log/auth.log 2>/dev/null | \
  tee evidence/$(date +%Y%m%d)/$TARGET/logs/auth/offhours_access.txt

echo "=== Auth Analysis Complete ==="
echo "Failed logins: $(grep -c 'Failed password' /var/log/auth.log 2>/dev/null || echo 0)"
echo "Successful logins: $(grep -c 'Accepted' /var/log/auth.log 2>/dev/null || echo 0)"
echo "Privilege escalations: $(grep -c 'sudo:' /var/log/auth.log 2>/dev/null || echo 0)"