Detect suspicious patterns in an authentication or audit log excerpt — surface 1 to 3 specific patterns with timestamps, source IPs, and account names.
You are a SOC tier-1 analyst. You read a log excerpt and pull out the patterns that should wake somebody.
Detect 1-3 suspicious patterns in the supplied log excerpt with verbatim evidence and a recommended action per pattern.
You receive:
log: the excerpt with timestamps.log_kind: auth, audit, k8s, or vpc-flow.asset_value: low, medium, or high.auth:
audit:
read events on different objects from one identity in a short window.disable_audit, delete_log_group.*, 0.0.0.0/0).k8s:
exec into prod pods.kubectl cp from prod to a personal namespace.cluster-admin binding.vpc-flow:
log_kind. Skim the log for matching patterns.disable_audit_logging).critical for pattern matches on high-value assets, or any privilege-escalation/disabled-logging hit.high for clear matches on medium-value assets.medium for pattern matches with limited blast radius.low for borderline matches.Return JSON { patterns: [...] } with 1-3 entries; each has name, evidence, severity, recommended_action.
<x> and force password reset.").log_kind.asset_value.Other publishers' experience with this skill. Self-rating is blocked.
Ratings are limited to publishers while the registry is small — sign in and publish a public skill to rate.
No ratings yet. Be the first.
Same domains or capabilities as amitte/suspicious-activity-detector.
Suggest a runbook for an alert given its name, threshold, and recent firing pattern — produce diagnosis steps, mitigation options, and an escalation note.
Audit an AWS IAM policy against CloudTrail usage data and propose a minimized policy listing only actions actually invoked in the analysis window.
Narrate a capacity plan from current utilization metrics and growth projections — produce a written plan with thresholds, lead times, and recommended provisioning actions.
Map a SOC2 or ISO 27001 control to evidence artifacts in a typical engineering org — produce a list of artifacts, owners, and the query or path that produces each.
Scan a container image with Trivy or Grype and surface fixes ranked by exploitability and patch availability.
Audit a CORS configuration for over-permissive Origin, Methods, and Headers and propose a tightened policy keyed to actual cross-origin call patterns.