What problem does it solve? Manually hunting through web server, auth, and system logs for attack patterns or suspicious outbound connections is slow and error-prone. This Skill automates that inspection, detecting inbound attack patterns on servers and unexpected outbound connections on workstations, and records findings in a deduplicated journal. ## Core Features & Use Cases - CrowdSec-first detection: Queries CrowdSec alerts and decisions via cscli in alert-only mode, falling back to direct log scanning when CrowdSec is absent. - Profile-aware direction: On servers it hunts inbound attack patterns (auth-failure bursts, 4xx floods); on workstations it compares outbound connections against a network baseline. - Request-rate spike detection: Identifies per-IP request floods exceeding a configurable threshold and journals offenders with a firewall remediation proposal. - Use Case: During a scheduled security audit loop on a Linux web server, the skill scans nginx access logs and sshd auth logs, finds a brute-force cluster from one IP, and journals a security finding with a firewall_deny remediation for operator review. ## Quick Start Ask the AI to run the inspect-logs audit to check this machine's web and auth logs for attack patterns and unexpected outbound connections.
