Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity. Covers audit rule configuration, log querying, timeline reconstruction, and integration with SIEM platforms.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-audit-logs-for-intrusionnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-audit-logs-for-intrusion -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-audit-logs-for-intrusion -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/analyzing-linux-audit-logs-for-intrusiongh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-linux-audit-logs-for-intrusiongit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/analyzing-linux-audit-logs-for-intrusion ~/.claude/skills/analyzing-linux-audit-logs-for-intrusion # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/analyzing-linux-audit-logs-for-intrusion ~/.agents/skills/analyzing-linux-audit-logs-for-intrusion # Codex, Cursor, Gemini CLI, Copilot, OpenCode