Linux Audit Log Intrusion Analysis
Guides an agent through auditd rules, ausearch/aureport queries, and attack timeline reconstruction on Linux hosts.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
When installed, the agent follows a structured playbook for investigating possible intrusions on a Linux machine using the built-in Linux Audit system (auditd). It can suggest rules that watch sensitive files like /etc/shadow and SSH keys, kernel module loading, and cron changes, then run ausearch and aureport queries to find suspicious logins, privilege escalation, and risky program execution. It also helps line those events up into a timeline of what an attacker may have done. A bundled Python script can parse the raw audit log and flag suspicious syscalls, sensitive paths, and commands.
Great for
- Security analysts or incident responders investigating a suspected compromise of a Linux server
- System administrators who want to set up host-based audit monitoring and compliance logging (CIS, STIG, PCI-DSS)
- Students learning Linux host forensics and auditd
Skip it if
- Network-level intrusion detection: the skill itself says to use Suricata or Zeek for network traffic, since auditd only sees activity on the individual host
- Production systems where audit rules are changed without testing: the ptrace, execve and connect rules can generate very large log volumes and affect performance; running the commands needs root access
Try asking
- “Check whether anyone modified /etc/shadow, /etc/sudoers or SSH authorized_keys in the last week on this server”
- “Build a timeline of what user account 1001 executed after a suspected compromise on March 15”
- “Summarise failed logins and anomaly events from the audit log for today”
- “Write auditd rules to detect processes launched from /tmp and kernel module loading”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-linux-audit-logs-for-intrusion.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-linux-audit-logs-for-intrusion.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-linux-audit-logs-for-intrusion.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Test new audit rules on a non-production host first, since broad rules on execve, connect and /var/log can produce heavy logging
- Review scripts/agent.py before running it, since it imports subprocess and may execute system commands on the audit log host
- Give the agent the specific time window and user IDs of interest so ausearch queries stay focused
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.