Anthropic-Cybersecurity-Skills/skills/analyzing-linux-audit-logs-for-intrusion/SKILL.md

name, description, domain, subdomain, tags, version, author, license

name	description	domain	subdomain	tags	version	author	license
analyzing-linux-audit-logs-for-intrusion	Parse and analyze Linux auditd logs to detect intrusion indicators including unauthorized file access, privilege escalation, syscall anomalies, and suspicious process execution using ausearch and Python.	cybersecurity	log-analysis	auditd linux-forensics syscall-monitoring intrusion-detection	1.0	mahipal	Apache-2.0

Analyzing Linux Audit Logs for Intrusion

Parse auditd logs to detect file access violations, privilege escalation, suspicious syscalls, and unauthorized process execution.

When to Use

• When investigating security incidents that require analyzing linux audit logs for intrusion
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Prerequisites

• Familiarity with log analysis concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities