{
  "ocm": "1",
  "id": "josepassinato-security-analyzing-web-server-logs-for-intrusion",
  "kind": "skill",
  "name": "analyzing-web-server-logs-for-intrusion",
  "description": "Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-force patterns. Uses regex-based pattern matching against OWASP attack signatures, GeoIP enrichment for source attribution, and statistical anomaly detection for request frequency and response size outliers.",
  "publisher": "Josepassinato",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding",
      "data_analysis"
    ],
    "tags": [
      "skill-md",
      "analyzing",
      "web",
      "server",
      "logs",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-force patterns. Uses regex-based pattern matching against OWASP attack signatures, GeoIP enrichment for source attribution, and statistical anomaly detection for request frequency and response size outliers."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/Josepassinato/Security",
      "path": "customizations/skills/anthropic-cybersec/skills/analyzing-web-server-logs-for-intrusion/SKILL.md",
      "ref": "065c0e0cfebb3f98d3c07cba0211e1b3d0e3b11b",
      "url": "https://github.com/Josepassinato/Security/blob/065c0e0cfebb3f98d3c07cba0211e1b3d0e3b11b/customizations/skills/anthropic-cybersec/skills/analyzing-web-server-logs-for-intrusion/SKILL.md",
      "key": "Josepassinato/Security/customizations/skills/anthropic-cybersec/skills/analyzing-web-server-logs-for-intrusion/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Analyzing Web Server Logs for Intrusion\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing web server logs for intrusion\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with security operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testi",
  "cost": {
    "context_tokens": 444
  }
}