analyzing-linux-audit-logs-for-intrusion

Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity. Covers audit rule configuration, log querying, timeline reconstruction, and integration with SIEM platforms. Activates for requests involving auditd analysis, Linux audit log investigation, ausearch queries, aureport summaries, or host-based intrusion detection on Linux.

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with a clear, validated workflow and concrete commands throughout. Its main weakness is progressive disclosure: the provided bundle files are orphaned (never referenced from the body) and reference-grade CLI material is inlined rather than delegated.

Suggestions

Link the bundle files from the body — add pointers to references/api-reference.md for the full ausearch/aureport flag catalog and scripts/agent.py for the automated parsing agent so they are discoverable.

Move the exhaustive ausearch/aureport flag examples into references/api-reference.md, keeping only one representative query per workflow step in SKILL.md to reduce duplication.

Trim the Key Concepts table to terms not already demonstrated in the workflow (e.g. the audit rule key and augenrules semantics), removing restatements of ausearch/aureport/auditctl function.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient with dense, commented code blocks, but the Key Concepts table restates tool functions already demonstrated in the workflow and the inline ausearch/aureport flag lists duplicate the bundled api-reference.md — minor over-explanation that could be trimmed.	4 / 5
Actionability	Provides copy-paste-ready auditctl rules, ausearch/aureport commands, augenrules reload steps, and SIEM config snippets that fully cover the common investigation cases.	5 / 5
Workflow Clarity	Six clearly sequenced steps from daemon verification through SIEM forwarding, with a fix-and-retry backlog loop in Step 1 and an explicit 8-item Verification checklist at the end.	5 / 5
Progressive Disclosure	Bundle files references/api-reference.md and scripts/agent.py exist but are never linked or signaled from the body, and the detailed ausearch/aureport CLI examples are inlined in SKILL.md duplicating the reference file — structure exists but references are not surfaced and reference-type content is inline.	3 / 5
	Total	17 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that clearly articulates capabilities, scope, and activation triggers with concrete tool names and use cases. It answers both 'what' and 'when' explicitly and is highly distinct from other skills.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions tied to named tools (auditd, ausearch, aureport): detect intrusion attempts, unauthorized access, privilege escalation, audit rule configuration, log querying, timeline reconstruction, and SIEM integration — comprehensive coverage matching the score-5 anchor.	5 / 5
Completeness	Explicitly states both what the skill does ('Uses the Linux Audit framework... to detect...') and when to use it ('Activates for requests involving...') with concrete trigger phrases, matching the score-5 anchor.	5 / 5
Trigger Term Quality	The 'Activates for requests involving auditd analysis, Linux audit log investigation, ausearch queries, aureport summaries, or host-based intrusion detection on Linux' clause provides comprehensive natural terms including the tool names a user would actually say.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (Linux host-based audit log intrusion detection) with distinct, tool-specific triggers and minimal overlap risk with unrelated skills.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-linux-audit-logs-for-intrusion/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.