Guide · Agent skill
How to use the Web Server Log Intrusion Analyzer agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Web Server Log Intrusion Analyzer is an agent skill that lets an AI agent read Apache or Nginx access logs and look for common web attacks. It is aimed at SOC analysts, security engineers, developers and sysadmins who need a first pass over suspicious web traffic in a lab or an environment they are authorized to inspect. After this guide you will know how to install the skill, ask the agent for an analysis, run the bundled script yourself, and read the findings it produces.
Web Server Log Intrusion Analyzermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it so the skill folder is available locally.
- 2Place the skill folder. Copy the folder to ~/.claude/skills/ for personal use or .claude/skills/ in your project, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Install Python dependencies. Make sure Python 3.8 or newer is installed, then run pip install geoip2 user-agents.
- 4Obtain the GeoIP database. Get a GeoLite2-City.mmdb file separately, since the skill does not include it, and keep it where you can reference it.
- 5Ask for an analysis. Describe the task in plain language, naming your Apache or Nginx access log and the attacks you want checked.
- 6Review the findings. Read the prioritized report and verify each finding against the raw log lines before drawing any conclusion.
What the skill makes the agent do
An agent skill is a folder of instructions and scripts that an AI agent loads when a task matches the skill's description. This one covers analyzing web server logs for intrusion. Its description says it parses Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints and brute-force patterns.
Concretely, the agent parses each log entry to extract the IP, timestamp, method, URI, status code, response size, user-agent and referer. It then applies pattern rules, adds GeoIP location data to suspicious sources, and produces a prioritized findings report that an analyst can review.
Install the skill
Download the skill ZIP from this page and unzip it. Then place the skill folder in one of these locations, depending on how you use your agent:
- Personal skills folder: ~/.claude/skills/
- Project skills folder: .claude/skills/ inside your project directory
- Claude apps: upload the skill under Settings → Capabilities → Skills
Install the Python dependencies and GeoIP database
The skill's scripts need Python 3.8 or newer and two Python packages, geoip2 and user-agents. Install them with pip.
The GeoIP enrichment step also needs a GeoLite2-City.mmdb database file. The skill does not include this file, so you must obtain it separately and point the script at it. Without it, the GeoIP step cannot run.
- Python 3.8+ is required
- Your web server logs must be in Combined Log Format (Apache) or the Nginx default format
pip install geoip2 user-agentsAsk the agent for a log analysis
Once the skill is installed, you can make requests in plain language. The skill is triggered by tasks that match its description, so mention web server logs, Apache or Nginx access logs, or the specific attacks you care about. Give the agent the path to a log file you are permitted to analyze.
Examples of requests that match the skill's scope:
- Analyze /var/log/nginx/access.log for SQL injection and directory traversal attempts.
- Check this Apache access log for scanner user-agents such as sqlmap, Nikto or gobuster.
- Find IP addresses making more than 50 POST requests to login pages in 5 minutes in this log.
- Summarize the suspicious sources in this log file and add country and city for each one.
Run the analysis script yourself
You can also run the bundled script directly from the skill folder. The example below reads an Nginx log, uses a GeoLite2-City database in the working directory, and writes results to a JSON file. Replace the paths with your own.
- --log-file: the access log to analyze
- --geoip-db: the GeoLite2-City.mmdb file
- --output: the JSON report to write
python scripts/agent.py --log-file /var/log/nginx/access.log --geoip-db GeoLite2-City.mmdb --output web_intrusion_report.jsonUnderstand what the detection rules look for
The skill uses regex-based pattern matching. It does not understand the full meaning of a request, so each finding is a signal to investigate rather than proof of an attack. The rules cover these groups:
- SQL injection: UNION SELECT, OR 1=1, quote-based OR patterns, hex encoding
- Path traversal and file inclusion: ../, /etc/passwd, /proc/self, php://filter
- XSS: script tags, javascript:, onerror=, onload=
- Scanner user-agents: nikto, sqlmap, dirbuster, gobuster, wfuzz
- Brute force: more than 50 POST requests to login endpoints from one IP within 5 minutes
- Statistical checks for request frequency and response size outliers
Safety and privacy notes
The skill runs scripts, so read the code in the skill folder before you run it on sensitive systems. According to its metadata, it does not use the network. Web logs contain visitor IP addresses and can contain other personal data, so only analyze logs you are authorized to inspect, and handle the output report with the same care.
The skill is intended for a test, lab or authorized environment. Do not point it at production logs without permission.
- Runs scripts: yes. Review scripts/agent.py before running it.
- Uses network: no, according to the skill metadata.
- Reports can contain visitor IPs and personal data. Store and share them carefully.
What people use it for
- Triaging a burst of suspicious requests in an Nginx access log to see whether SQL injection or traversal strings appear.
- Checking whether scanner tools such as sqlmap, Nikto or gobuster have been probing a site you run.
- Spotting IP addresses making unusually many login POST requests as a first step in a brute-force investigation.
- Producing a quick first-pass report on a lab web server as part of threat hunting practice.
Frequently asked questions
How do I install the Web Server Log Intrusion Analyzer skill?
Download the skill ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into .claude/skills/ in a project. In the Claude apps you can instead upload it under Settings → Capabilities → Skills. Then install the Python packages geoip2 and user-agents with pip.
What do I need to run this skill?
You need Python 3.8 or newer, the geoip2 and user-agents Python packages, a GeoLite2-City.mmdb GeoIP database file obtained separately, and web server access logs in Combined Log Format or the Nginx default format.
Is the skill free to use?
The skill is licensed under Apache-2.0, as listed on this page. Check the license file in the repository for the full terms. The GeoLite2 database is obtained separately and is not included with the skill.
Does this skill replace a SIEM or WAF?
No. The skill uses simple regex signatures that can miss obfuscated attacks and can produce false positives. It is a first-pass analysis tool, not a replacement for a full SIEM or a web application firewall.
Why does the GeoIP step fail?
The GeoIP enrichment needs the GeoLite2-City.mmdb file, which is not bundled with the skill. Make sure you have obtained it and that the --geoip-db path points to the correct file.
Can I use this to check if I was breached?
The skill can surface suspicious requests, but its findings still need expert interpretation. It cannot give a verdict on whether you were breached, so involve a security professional before drawing conclusions.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits SOC analysts, security engineers, developers and sysadmins who want a quick, structured first pass over Apache or Nginx access logs in a lab or an environment they are authorized to inspect. It is not a substitute for a SIEM or WAF, and people without security experience should not rely on it alone to decide whether a site was compromised.
Download the skill