About

Imported from borghei/claude-skills (engineering/threat-detection/SKILL.md). Install upstream with npx skills add borghei/claude-skills --skill threat-detection. Copyright stays with the author (MIT + Commons Clause).

Threat Detection

Name: threat-detection
Author: borghei

Category: Engineering Domain: Security Operations

Overview

The Threat Detection skill provides automated analysis of log files for suspicious patterns including brute force attacks, injection attempts, unusual access patterns, and privilege escalation indicators. It helps security teams triage log data and identify threats before they escalate.

Clarify First

Before analyzing logs, confirm these inputs. If any is unknown or vague, ASK — do not assume:

Log file & source type — auth / access / application logs to analyze (--file; the subject of detection)
Threat category — brute force / injection / access anomaly / privilege escalation (--category; focuses the scan)
Minimum severity — the reporting/alert threshold (--min-severity; changes which signals surface and any SIEM/CI gate)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

Quick Start

# Analyze a log file for threat signals
python scripts/threat_signal_analyzer.py --file /var/log/auth.log

# Analyze with specific threat category
python scripts/threat_signal_analyzer.py --file access.log --category injection

# JSON output for SIEM integration
python scripts/threat_signal_analyzer.py --file auth.log --format json

# Set minimum severity
python scripts/threat_signal_analyzer.py --file access.log --min-severity high

Tools Overview

threat_signal_analyzer.py

Analyzes log files for suspicious activity patterns across multiple threat categories.

Feature	Description
Brute force detection	Identifies repeated failed login attempts from same source
Injection scanning	Detects SQL injection, XSS, command injection in requests
Access anomalies	Flags unusual access times, forbidden paths, admin probes
Privilege escalation	Detects sudo abuse, role changes, permission modifications
Rate analysis	Identifies request flooding and denial-of-service patterns
IP reputation	Flags known-bad patterns (scanners, bots, TOR indicators)

Workflows

Log Analysis Workflow

Collect - Gather logs from auth, access, application sources
Analyze - Run threat_signal_analyzer.py across log files
Triage - Review critical and high severity findings first
Correlate - Cross-reference findings across log sources
Respond - Block IPs, reset credentials, escalate as needed

Incident Investigation Workflow

Scope - Identify time window and affected systems
Scan - Run analyzer on all relevant log files
Timeline - Build timeline from threat signals
Impact - Assess what was accessed or modified
Contain - Block threat actors and patch vulnerabilities

Continuous Monitoring

# Cron job: analyze auth logs every hour
python scripts/threat_signal_analyzer.py --file /var/log/auth.log --format json --min-severity high > /tmp/threat_report.json

# CI/CD: scan application logs on deployment
python scripts/threat_signal_analyzer.py --file app.log --category injection --format json

Reference Documentation

Threat Indicators - Common attack patterns, indicators of compromise, response playbooks

Common Patterns Quick Reference

Threat Categories

Category	Signals	Severity
Brute force	5+ failed logins from same IP in 5 min	High
SQL injection	UNION SELECT, OR 1=1, DROP TABLE in requests	Critical
XSS	script tags, javascript: URIs, event handlers in input	High
Path traversal	../ sequences, /etc/passwd access attempts	High
Command injection	; cat /etc/passwd,	nc, backtick usage
Admin probing	/admin, /wp-admin, /phpmyadmin access attempts	Medium
Rate flooding	100+ requests/minute from single IP	High

Severity Levels

CRITICAL - Active exploitation attempt (injection, RCE)
HIGH - Likely attack in progress (brute force, privilege escalation)
MEDIUM - Suspicious activity requiring investigation
LOW - Informational, possible false positive

Response Actions

Severity	Immediate Action	Follow-Up
Critical	Block IP, alert SOC	Incident report, forensics
High	Rate limit, monitor	Review access, check damage
Medium	Log and monitor	Weekly review
Low	Log only	Monthly trend analysis

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/borghei-claude-skills-threat-detection/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

borghei-claude-skills-threat-detection.ocm.jsonjson

{
  "ocm": "1",
  "id": "borghei-claude-skills-threat-detection",
  "kind": "skill",
  "name": "threat-detection",
  "description": "This skill should be used when the user asks to \"analyze logs for threats\", \"detect suspicious activity\", \"scan for brute force attempts\", \"identify injection attacks\", or \"audit access patterns for anomalies\".",
  "publisher": "borghei",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "security",
      "threat-detection",
      "logs",
      "monitoring",
      "incident-response",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "This skill should be used when the user asks to \"analyze logs for threats\", \"detect suspicious activity\", \"scan for brute force attempts\", \"identify injection attacks\", or \"audit access patterns for anomalies\"."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/borghei/claude-skills",
      "path": "engineering/threat-detection/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/borghei/claude-skills/blob/HEAD/engineering/threat-detection/SKILL.md",
      "key": "borghei/claude-skills/engineering/threat-detection/SKILL.md"
    },
    "license": "MIT + Commons Clause"
  },
  "instructions": "# Threat Detection\n\n> **Category:** Engineering\n> **Domain:** Security Operations\n\n## Overview\n\nThe **Threat Detection** skill provides automated analysis of log files for suspicious patterns including brute force attacks, injection attempts, unusual access patterns, and privilege escalation indicators. It helps security teams triage log data and identify threats before they escalate.\n\n## Clarify First\n\nBefore analyzing logs, confirm these inputs. If any is unknown or vague, ASK — do not assume:\n\n- [ ] **Log file & source type** — auth / access / application logs to analyze (`--file`; the subj",
  "cost": {
    "context_tokens": 1144
  }
}

Fetch it by URL: GET /api/v1/registry/borghei-claude-skills-threat-detection/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.