log-analysis

namespace	aiwg
name	log-analysis
description	Correlate auth.log, syslog, journald, application, and web logs to detect brute force, privilege escalation, and lateral movement.
tools	Bash, Read, Write, Glob, Grep
platforms	["all"]

log-analysis

Correlates log data from multiple sources to identify attacker activity patterns including brute force login attempts, credential stuffing, privilege escalation, lateral movement, and data exfiltration. Adapts to log availability on the target system and produces a structured timeline of suspicious events.

Triggers

Alternate expressions and non-obvious activations (primary phrases are matched automatically from the skill description):

• "auth.log" / "syslog" → specific log file analysis
• "lateral movement" → log-based lateral movement detection
• "brute force" → authentication attack detection in logs

Purpose

Individual log sources tell fragments of a story. Correlating authentication logs, process accounting, web access logs, and application logs reveals the full attack chain: initial access method, persistence establishment, privilege escalation path, and lateral movement targets. This skill assembles those fragments into a coherent timeline.

Behavior

When triggered, this skill:

1. Discover available log sources:

   • Check for journald: journalctl --disk-usage 2>/dev/null
   • Check for traditional syslog files: /var/log/syslog, /var/log/messages
   • Check for auth logs: /var/log/auth.log (Debian) or /var/log/secure (RHEL)
   • Check for web server logs: /var/log/nginx/, /var/log/apache2/, /var/log/httpd/
   • Check for application-specific logs: /var/log/ subdirectories
   • Record which sources are available and which are absent (absence is itself evidence)

2. Authentication log analysis:

   • Extract all SSH authentication events:

     grep -E 'sshd.*(Failed|Accepted|Invalid|Disconnected)' /var/log/auth.log
     

   • Count failed logins per source IP to detect brute force:

     grep 'Failed password' /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -20
     

   • Extract successful logins after prior failures (credential stuffing success indicator)
   • Parse sudo and su events: privilege escalation timing, escalating users, target users

3. Brute force pattern detection:

   • Identify source IPs with > threshold failed attempts within a rolling time window
   • Flag distributed brute force: multiple IPs, same username targets, compressed time window
   • Check for password spraying: many usernames, few attempts each, from one or few IPs
   • Flag successful login from an IP that previously generated failures (compromise indicator)

4. Privilege escalation analysis:

   • Sudo usage: grep sudo /var/log/auth.log | grep -v 'pam_unix\|session'
   • PAM events for su, sudo, and other elevation mechanisms
   • setuid binary execution via process accounting if available: lastcomm 2>/dev/null
   • Journal entries for systemd service unit changes by non-root users

• Merge events from all sources into a unified chronological timeline
• Normalize timestamps to UTC
• Annotate events with severity: INFO, SUSPICIOUS, MALICIOUS
• Group events into phases: Reconnaissance, Initial Access, Execution, Persistence, Privilege Escalation, Lateral Movement, Exfiltration

15. Write findings document:
    • Save to .aiwg/forensics/findings/<hostname>-log-analysis.md
    • Include: source inventory, attack timeline, IOCs extracted (IPs, usernames, paths), pattern summary

Usage Examples

Example 1 — Full log analysis on local system

analyze logs

Example 2 — Auth log focus

auth log analysis /var/log/auth.log

Example 3 — Specify time window

log forensics --from "2026-02-01 00:00:00" --to "2026-02-15 23:59:59"

Output Locations

• Findings: .aiwg/forensics/findings/<hostname>-log-analysis.md
• Unified timeline: .aiwg/forensics/timelines/<hostname>-log-timeline.md
• IOC list: .aiwg/forensics/iocs/<hostname>-log-iocs.txt

Configuration

log_analysis:
  brute_force_threshold: 10
  brute_force_window_minutes: 5
  spray_threshold_users: 5
  web_log_paths:
    - /var/log/nginx/access.log
    - /var/log/apache2/access.log
    - /var/log/httpd/access_log
  timeline_timezone: UTC
  severity_levels:
    - INFO
    - SUSPICIOUS
    - MALICIOUS

References

• @$AIWG_ROOT/agentic/code/addons/aiwg-utils/rules/research-before-decision.md — Discover available log sources before analysis; absence of logs is itself evidence to document
• @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/rules/evidence-integrity.md — Analyze log copies only; do not modify original log files
• @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/rules/red-flag-escalation.md — Escalate immediately when log analysis reveals active attacker presence or data exfiltration
• @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/skills/evidence-preservation/SKILL.md — Logs must be preserved and hashed before analysis begins
• @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/skills/sigma-hunting/SKILL.md — Sigma hunting applies detection rules on top of the log sources analyzed here