How to use the Linux Audit Log Intrusion Analysis agent skill

What does the skill make the agent do?

Once installed, the agent follows a structured playbook for investigating possible intrusions on a Linux host using auditd. It can suggest audit rules that watch sensitive files such as /etc/shadow and SSH keys, kernel module loading, and cron changes. It can then run ausearch and aureport queries to look for suspicious logins, privilege escalation and risky program execution.

The skill also helps line these events up into a timeline of what an attacker may have done. A bundled Python script, scripts/agent.py, can parse the raw audit log and flag suspicious syscalls, sensitive paths and commands.

• Suggests and reviews auditd rules for credential files, SSH configuration, user management, ptrace, execve, kernel modules, sockets, cron and logs
• Runs ausearch queries for failed logins, sudo use, kernel module events and SSH key changes
• Runs aureport summaries for authentication, failed events, executables, file access and anomalies
• Builds a timeline of commands and access during an incident window
• Parses the raw audit log with a bundled Python script

How do you install the skill?

Download the skill ZIP from this page and unzip it into one of two locations. For a personal setup, unzip it into ~/.claude/skills/. For a single project, unzip it into the .claude/skills/ folder inside that project.

If you use the Claude apps, you can instead upload the skill under Settings, then Capabilities, then Skills.

The skill's files are SKILL.md, scripts/agent.py and references/api-reference.md. Keep this folder structure intact so the agent can find the scripts and reference notes.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into .claude/skills/ in the project folder
• Claude apps: Settings, then Capabilities, then Skills, then upload

How do you trigger the skill with natural requests?

You do not need to type a special command. Describe the task in plain language that mentions Linux, auditd, audit logs or host-based intrusion detection. The skill's description says it activates for requests involving auditd analysis, Linux audit log investigation, ausearch queries, aureport summaries, or host-based intrusion detection on Linux.

Be specific about the machine, the time window and what you suspect. The more detail you give, the closer the agent's queries will match your investigation.

• Investigate whether someone gained root on this Linux server in the last day using the audit log
• Write auditd rules to watch /etc/shadow, sudoers and SSH authorized_keys, then explain how to load them
• Use ausearch to find failed logins and commands run by UID 1001 today
• Give me an aureport summary of executables run this week and flag anything from /tmp
• Build a timeline of what happened on this host between two times during the incident

What do you need before you start?

The skill is for a Linux system only. The machine needs the auditd package installed and the audit daemon running. You also need root or sudo access, because auditctl, ausearch and aureport are used to configure rules and query logs. Python 3 is needed to run scripts/agent.py.

The skill recommends the Neo23x0/auditd ruleset from GitHub as an optional baseline for broader coverage. Your audit log is expected at /var/log/audit/audit.log by default, so plan for enough log storage to keep the events you need.

• Linux with auditd installed and running
• Root or sudo access
• Python 3 for scripts/agent.py
• Optional: Neo23x0/auditd ruleset from GitHub
• Enough disk space and retention for the audit log

How do you check auditd and deploy intrusion rules?

Before searching, confirm the audit system is running and see which rules are loaded. If events are being dropped because the backlog limit is reached, the skill suggests raising it. Intrusion rules are placed in /etc/audit/rules.d/intrusion.rules and reloaded afterwards.

Be careful with the ptrace, execve and connect rules. The skill notes they can generate very large log volumes and affect performance, so test them on a non-production system first.

• Check the daemon and configuration, then list loaded rules
• Check for dropped events and raise the backlog limit if needed
• Place custom rules in /etc/audit/rules.d/intrusion.rules
• Reload rules and confirm the rule count

How do you search and summarise audit events?

Use ausearch to pull specific events, such as failed logins, commands run by a user, access to /etc/shadow or activity under a custom rule key. Use aureport to produce aggregate summaries for triage. The -i flag interprets values into readable form, and the -ts and -te flags set the start and end of a time window.

Rule keys matter here. The skill's rules tag events with keys such as credential_access, exec_from_tmp and kernel_module_load, and you can search by those keys directly.

• ausearch -m USER_LOGIN --success no -ts recent finds failed logins
• ausearch -k exec_from_tmp -ts this-week finds programs run from /tmp
• aureport --failed --summary -ts today summarises failed events
• aureport -k --summary -ts this-month summarises events by rule key

How do you rebuild an attack timeline?

The skill's workflow starts by finding the initial access time, then follows the compromised account's activity, the commands it ran, and any persistence or outbound connections during the incident window. Replace <UID> with the account ID you are investigating.

Forwarding logs to a central SIEM can help with correlation. The skill describes audisp-remote and Elastic Auditbeat as options. Those are configuration steps you apply yourself; the skill itself does not use the network.

• Find the first successful root login
• Trace commands and file access by the suspected account
• Check cron and SSH key changes for persistence
• Check network connections for possible lateral movement

What safety points should you know?

The skill runs a Python script and needs root for auditctl, ausearch and aureport. Read scripts/agent.py before running it, and run it with the least privilege that works. The skill is not meant for network-level detection; the skill itself says to use Suricata or Zeek for network traffic, because auditd only sees activity on the individual host.

Do not change audit rules on a production server without testing them first. Rules that watch every connect or execve call can fill disk space and slow the system.

• Scripts run: yes, scripts/agent.py needs Python 3
• Uses network: no, according to the skill's assessment
• Root or sudo is required for rule and log commands
• Do not use for network intrusion detection

What tips help you get better results?

Start with a baseline. Run the summary reports first to see what normal activity looks like on the host, then drill down with ausearch. Keep your time windows tight, since broad queries return a lot of noise.

Use the -i flag when you need readable output, and export to CSV if you want to process results further. The reference notes show ausearch --format csv for Python processing.

• Summarise with aureport before searching in detail
• Use rule keys to narrow searches
• Write down the incident window and keep queries inside it
• Test new rules on a non-production host first