Threat Detection

Threat Detection

Category: Engineering Domain: Security Operations

Overview

The Threat Detection skill provides automated analysis of log files for suspicious patterns including brute force attacks, injection attempts, unusual access patterns, and privilege escalation indicators. It helps security teams triage log data and identify threats before they escalate.

Clarify First

Before analyzing logs, confirm these inputs. If any is unknown or vague, ASK — do not assume:

• Log file & source type — auth / access / application logs to analyze (--file; the subject of detection)
• Threat category — brute force / injection / access anomaly / privilege escalation (--category; focuses the scan)
• Minimum severity — the reporting/alert threshold (--min-severity; changes which signals surface and any SIEM/CI gate)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

Quick Start

# Analyze a log file for threat signals
python scripts/threat_signal_analyzer.py --file /var/log/auth.log

# Analyze with specific threat category
python scripts/threat_signal_analyzer.py --file access.log --category injection

# JSON output for SIEM integration
python scripts/threat_signal_analyzer.py --file auth.log --format json

# Set minimum severity
python scripts/threat_signal_analyzer.py --file access.log --min-severity high

Tools Overview

threat_signal_analyzer.py

Analyzes log files for suspicious activity patterns across multiple threat categories.

Workflows

Log Analysis Workflow

1. Collect - Gather logs from auth, access, application sources
2. Analyze - Run threat_signal_analyzer.py across log files
3. Triage - Review critical and high severity findings first
4. Correlate - Cross-reference findings across log sources
5. Respond - Block IPs, reset credentials, escalate as needed

Incident Investigation Workflow

1. Scope - Identify time window and affected systems
2. Scan - Run analyzer on all relevant log files
3. Timeline - Build timeline from threat signals
4. Impact - Assess what was accessed or modified
5. Contain - Block threat actors and patch vulnerabilities

Continuous Monitoring

# Cron job: analyze auth logs every hour
python scripts/threat_signal_analyzer.py --file /var/log/auth.log --format json --min-severity high > /tmp/threat_report.json

# CI/CD: scan application logs on deployment
python scripts/threat_signal_analyzer.py --file app.log --category injection --format json

Reference Documentation

• Threat Indicators - Common attack patterns, indicators of compromise, response playbooks

Common Patterns Quick Reference

Threat Categories

Severity Levels

• CRITICAL - Active exploitation attempt (injection, RCE)
• HIGH - Likely attack in progress (brute force, privilege escalation)
• MEDIUM - Suspicious activity requiring investigation
• LOW - Informational, possible false positive

Response Actions