Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Analyzing Web Server Logs for Intrusion · mukul975 | DecimalAI

Analyzing Web Server Logs For Intrusion

SkillScore35Maintained

analyzing-web-server-logs-for-intrusion

Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-force patterns. Uses regex-based pattern matching against OWASP attack signatures, GeoIP enrichment for source attribution, and statistical anomaly detection for request frequency and response size outliers.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/analyzing-web-server-logs-for-intrusion/SKILL.md

decimalai skills pull analyzing-web-server-logs-for-intrusion --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/analyzing-web-server-logs-for-intrusion/SKILL.md https://app.decimal.ai/s/analyzing-web-server-logs-for-intrusion/SKILL.md

Raw file: /s/analyzing-web-server-logs-for-intrusion/SKILL.md ↗ · machine-readable summary at /s/analyzing-web-server-logs-for-intrusion.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +22% lift-6% tokens0% turns35% of whole cases pass with skill (8/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-09	✗→✓	▲ Improved	—	—
case-13	✗→✓	▲ Improved	—	—
case-01	✗→✓	▲ Improved	—	—
case-02	✗→✓	▲ Improved	—	—
case-03	✗→✓	▲ Improved	—	—

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/analyzing-web-server-logs-for-intrusion/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/1/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Analyzing Web Server Logs for Intrusion

When to Use

When investigating security incidents that require analyzing web server logs for intrusion
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Install dependencies: pip install geoip2 user-agents
Collect web server access logs in Combined Log Format (Apache) or Nginx default format.
Parse each log entry extracting: IP, timestamp, method, URI, status code, response size, user-agent, referer.
Apply detection rules:

SQL injection: UNION SELECT, OR 1=1, ' OR ', hex encoding patterns
LFI/Path traversal: ../, /etc/passwd, /proc/self, php://filter
XSS: <script>, javascript:, onerror=, onload=
Scanner signatures: nikto, sqlmap, dirbuster, gobuster, wfuzz user-agents
Brute force: >50 POST requests to login endpoints from same IP in 5 minutes

Enrich with GeoIP data and generate a prioritized findings report.

bash
python scripts/agent.py --log-file /var/log/nginx/access.log --geoip-db GeoLite2-City.mmdb --output web_intrusion_report.json

Examples

Detect SQLi in URI

192.168.1.100 - - [15/Jan/2024:10:30:45 +0000] "GET /products?id=1' UNION SELECT username,password FROM users-- HTTP/1.1" 200 4532

Scanner User-Agent Detection

Nikto/2.1.6, sqlmap/1.7, DirBuster-1.0-RC1, gobuster/3.1.0

Illustrative Want to see what analyzing-web-server-logs-for-intrusion would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 00:06 UTC · 23 cases

Lift

+22%

35% vs 13%

Agent turns

1.0 vs 1.0

Tokens

-6%

2,382.52 vs 2,541.35

fail → pass · 5pass → pass · 3fail → fail · 15

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-08 When building our web server access log parser for security inspection, what explicit fields must be extracted from each raw log entry?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 Our web server is configured to log access events in Apache Common Log Format. Can we use this log format directly to evaluate scanner user-agent rules and HTTP referrer analysis?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-23 If a custom web server log format strips out the User-Agent header, which detection capability in our web intrusion pipeline will be compromised?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 Our analyst is tuning local file inclusion rules for URI filtering in access logs. Which specific path traversal strings must be monitored?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 We want to update our log analyzer's signature list to capture SQL injection attempts in HTTP request URIs. What key string patterns should be flagged?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-13 What threshold, request method, endpoint focus, and timeframe parameters define a web authentication brute force condition?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-11 Which payload signatures and HTML event parameters should our log parser monitor to identify Cross-Site Scripting (XSS) attack vectors in incoming URIs?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We are reviewing our Linux system auth log `/var/log/auth.log` after detecting elevated failed SSH logins. How should we analyze SSH authentication logs to identify brute-force origin IPs and unauthorized sudo escalations?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 Which local MaxMind database file name is expected by the intrusion analysis script for IP geolocation resolution?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 Our network team captured a packet capture file (`capture.pcap`) during a network port scan. What Wireshark display filters and tshark commands should we run to analyze raw TCP SYN packets?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 We need to write custom ModSecurity WAF rules for Apache to block active web application attack traffic at the edge in real time. How should we format SecRule directives for blocking SQL injection and path traversal?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 We are building an automated scanner detection module for web server access logs. Which specific security tool user-agent identifiers should trigger a scanner alert?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 I have an Nginx access log file located at `/var/log/nginx/access.log` from a recent web server security alert. Can you parse these logs, check for common web attacks or automated scanning activity, enrich the IP addresses with geolocation data using a GeoLite2 database, and output the prioritized security findings into a JSON summary file?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-02 Our SOC team received an alert regarding potential web app exploitation attempts on our web server. Please review our Apache access log at `/var/log/apache2/access.log`, identify any suspicious request patterns such as injection payloads or high-frequency login attempts, and generate a structured incident response report highlighting top threat findings.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-15 Which specific web server log formats are supported for ingestion by the analysis agent?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 We are setting up an environment to parse web access logs for security threats. What Python libraries should we install via pip to handle IP geolocation lookup and parser classification?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 We need to audit `/var/log/nginx/access.log` for web-based intrusions and scanner traffic. Parse the access entries, run threat detection against the request URIs and user agents, enrich the client IPs with location details, and give me a detailed findings JSON report detailing the flagged incident events.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-16 A threat hunting alert caught `GET /index.php?page=php://filter/convert.base64-encode/resource=db.php` in the access log. Which attack category does this signature belong to?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 An incoming request shows `User-Agent: sqlmap/1.7#stable`. Should this trigger a URI payload alert or a scanner signature alert?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 Why do our web access log intrusion rules explicitly search for hex encoding patterns in request URIs?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 An IP address issued 80 GET requests to `/login` within 2 minutes. Does this activity satisfy our brute force detection rule criteria?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-21 Which path traversal detection pattern specifically flags attempts to read Linux process information through web requests?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 What file format and structure does the log analysis script produce when generating its final prioritized findings output?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +22 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 13%
Pass rate with the skill: 34.8%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 00:06 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run35

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-14% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 54 days ago

Other measured skills in the registry, with their headline benchmark lift.