Skip to content
Get packs

Web Server Log Intrusion Analyzer

Scan Apache/Nginx access logs for SQL injection, path traversal and scanner activity

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

Once installed, the agent can read a web server's access log file and look for signs of common website attacks, such as SQL injection, attempts to read system files through path tricks like ../, and known hacking tools such as sqlmap or Nikto identified by their user-agent names. It also flags IP addresses making unusually many login requests and can add country or city information to each suspicious source. The result is a prioritized findings report that a security analyst can review.

Great for

  • SOC analysts or security engineers triaging suspicious web traffic
  • Developers or sysadmins checking whether their site is being probed
  • Threat hunters who want a quick first pass over Nginx or Apache logs in a lab or authorized environment

Skip it if

  • Production systems without authorization, since the skill is meant for analyzing logs you are permitted to inspect and reading logs can expose visitor IPs and personal data
  • Replacing a full SIEM or WAF: it relies on simple regex signatures that can miss obfuscated attacks and produce false positives
  • Users with no security background who need a verdict on whether they were breached, since findings still require expert interpretation

Try asking

  • “Analyze this Nginx access log for SQL injection and directory traversal attempts and summarize the top offending IPs”
  • “Check my Apache logs for scanner user-agents like sqlmap, nikto or gobuster”
  • “Find IPs making more than 50 POST requests to login pages in 5 minutes in this log file”
  • “Produce a prioritized JSON intrusion report from access.log with GeoIP enrichment”
Step-by-step guide: how to use Web Server Log Intrusion AnalyzerInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-web-server-logs-for-intrusion.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-web-server-logs-for-intrusion.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-web-server-logs-for-intrusion.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run the script on a copy of the logs in a lab or read-only location, and review the Python code before executing it
  • Treat each hit as a lead to verify manually, since regex signatures generate false positives such as legitimate searches containing 'select' or 'or'
  • Provide the exact log format and time range so the agent can tune parsing and the brute-force threshold

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.