# Security Log Analyzer: attack detection for 50+ log formats (`logtriage/security-log-analyzer`) Actor

Detects the format of a security log and finds attacks in it: brute force, password spraying, logins after failures, web scanning and injection, cloud privilege changes, suspicious commands, port scans. Entra ID, Windows events, auth.log, nginx/Apache, CloudTrail, Okta, firewalls, EDR and more.

- **URL**: https://apify.com/logtriage/security-log-analyzer.md
- **Developed by:** [logtriage](https://apify.com/logtriage) (community)
- **Categories:** Developer tools, AI
- **Features:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$20.00 / 1,000 log analyzeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Security Log Analyzer

Paste a security log, or give a link to one, and get the attacks in it: what happened, which
addresses and accounts were involved, how many events, and the MITRE ATT\&CK techniques.

The format is detected for you. More than 50 are supported, including Entra ID (Azure AD) sign-in
logs, Windows Security events and Sysmon, Linux auth.log and auditd, nginx, Apache and IIS access
and error logs, AWS CloudTrail, VPC Flow Logs and WAF, Okta, Google Workspace, Microsoft 365,
Kubernetes audit logs, CrowdStrike, SentinelOne and Defender exports, and firewalls (PAN-OS,
FortiGate, Cisco ASA, CEF and LEEF).

### What it finds

- Brute force, password spraying and logins that succeed after failures (SSH, Windows, Entra ID, Okta and more)
- Web scanning, probes for secrets such as `.env` files, SQL injection and path traversal
- Privilege changes and logging being turned off in cloud audit logs
- Suspicious command lines, LSASS access and encoded PowerShell on endpoints
- Port scans, host sweeps and exposed management ports in network logs
- Many mailbox aliases behind one inbox, and other account-abuse patterns

Every finding is deterministic: the same log gives the same answer, with no AI and no external
lookups. The same checks run in LogTriage's free [in-browser log analyzer](https://logtriage.app/tools/log-analyzer/).

### Input

- **Log text**: the log itself.
- **Or a link to the log file**: a URL to download (up to 25 MB), which takes precedence over Log text. Gzip files and binary Windows event logs (.evtx) are read as well.
- **File name** (optional): helps identify the format.

### Output

One dataset item per finding: `severity`, `title`, `headline`, `facts` (addresses, accounts, time
window and counts), `mitreAttack`, `eventsInvolved` and `format`. The `OUTPUT` record summarizes
the formats read, the event counts and the findings by severity.

### Pricing

You pay per analyzed log; Apify's own platform usage is included.

### Want the full incident report?

[LogTriage](https://logtriage.app/?ref=apify) also enriches every address, user agent and hash with
threat intelligence and writes the incident report: timeline, impacted users, indicators and
remediation steps. The field-by-field [log format reference](https://logtriage.app/reference/log-formats/)
explains what each record means.

# Actor input Schema

## `logText` (type: `string`):

Paste the log: lines, JSON records or Windows event XML. Ignored when a log link is given. The default is a short SSH brute-force sample.

## `logUrl` (type: `string`):

A URL the Actor downloads (up to 25 MB). Used when Log text is empty.

## `fileName` (type: `string`):

Helps identify the format, e.g. auth.log or access.log.

## Actor input object example

```json
{
  "logText": "Nov  5 06:00:01 web-01 sshd[4100]: Failed password for root from 203.0.113.77 port 50000 ssh2\nNov  5 06:00:02 web-01 sshd[4101]: Failed password for root from 203.0.113.77 port 50001 ssh2\nNov  5 06:00:03 web-01 sshd[4102]: Failed password for admin from 203.0.113.77 port 50002 ssh2\nNov  5 06:00:04 web-01 sshd[4103]: Failed password for admin from 203.0.113.77 port 50003 ssh2\nNov  5 06:00:05 web-01 sshd[4104]: Failed password for ubuntu from 203.0.113.77 port 50004 ssh2\nNov  5 06:00:06 web-01 sshd[4105]: Failed password for ubuntu from 203.0.113.77 port 50005 ssh2\nNov  5 06:00:07 web-01 sshd[4106]: Failed password for test from 203.0.113.77 port 50006 ssh2\nNov  5 06:00:08 web-01 sshd[4107]: Failed password for test from 203.0.113.77 port 50007 ssh2\nNov  5 06:00:09 web-01 sshd[4108]: Failed password for oracle from 203.0.113.77 port 50008 ssh2\nNov  5 06:00:10 web-01 sshd[4109]: Failed password for oracle from 203.0.113.77 port 50009 ssh2\nNov  5 06:00:11 web-01 sshd[4110]: Failed password for pi from 203.0.113.77 port 50010 ssh2\nNov  5 06:00:12 web-01 sshd[4111]: Failed password for pi from 203.0.113.77 port 50011 ssh2"
}
```

# Actor output Schema

## `findings` (type: `string`):

One item per attack found: severity, title, what happened, facts, MITRE ATT\&CK techniques, events involved and log format.

## `summary` (type: `string`):

The formats read, event counts and the number of findings by severity.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "logText": `Nov  5 06:00:01 web-01 sshd[4100]: Failed password for root from 203.0.113.77 port 50000 ssh2
Nov  5 06:00:02 web-01 sshd[4101]: Failed password for root from 203.0.113.77 port 50001 ssh2
Nov  5 06:00:03 web-01 sshd[4102]: Failed password for admin from 203.0.113.77 port 50002 ssh2
Nov  5 06:00:04 web-01 sshd[4103]: Failed password for admin from 203.0.113.77 port 50003 ssh2
Nov  5 06:00:05 web-01 sshd[4104]: Failed password for ubuntu from 203.0.113.77 port 50004 ssh2
Nov  5 06:00:06 web-01 sshd[4105]: Failed password for ubuntu from 203.0.113.77 port 50005 ssh2
Nov  5 06:00:07 web-01 sshd[4106]: Failed password for test from 203.0.113.77 port 50006 ssh2
Nov  5 06:00:08 web-01 sshd[4107]: Failed password for test from 203.0.113.77 port 50007 ssh2
Nov  5 06:00:09 web-01 sshd[4108]: Failed password for oracle from 203.0.113.77 port 50008 ssh2
Nov  5 06:00:10 web-01 sshd[4109]: Failed password for oracle from 203.0.113.77 port 50009 ssh2
Nov  5 06:00:11 web-01 sshd[4110]: Failed password for pi from 203.0.113.77 port 50010 ssh2
Nov  5 06:00:12 web-01 sshd[4111]: Failed password for pi from 203.0.113.77 port 50011 ssh2`
};

// Run the Actor and wait for it to finish
const run = await client.actor("logtriage/security-log-analyzer").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "logText": """Nov  5 06:00:01 web-01 sshd[4100]: Failed password for root from 203.0.113.77 port 50000 ssh2
Nov  5 06:00:02 web-01 sshd[4101]: Failed password for root from 203.0.113.77 port 50001 ssh2
Nov  5 06:00:03 web-01 sshd[4102]: Failed password for admin from 203.0.113.77 port 50002 ssh2
Nov  5 06:00:04 web-01 sshd[4103]: Failed password for admin from 203.0.113.77 port 50003 ssh2
Nov  5 06:00:05 web-01 sshd[4104]: Failed password for ubuntu from 203.0.113.77 port 50004 ssh2
Nov  5 06:00:06 web-01 sshd[4105]: Failed password for ubuntu from 203.0.113.77 port 50005 ssh2
Nov  5 06:00:07 web-01 sshd[4106]: Failed password for test from 203.0.113.77 port 50006 ssh2
Nov  5 06:00:08 web-01 sshd[4107]: Failed password for test from 203.0.113.77 port 50007 ssh2
Nov  5 06:00:09 web-01 sshd[4108]: Failed password for oracle from 203.0.113.77 port 50008 ssh2
Nov  5 06:00:10 web-01 sshd[4109]: Failed password for oracle from 203.0.113.77 port 50009 ssh2
Nov  5 06:00:11 web-01 sshd[4110]: Failed password for pi from 203.0.113.77 port 50010 ssh2
Nov  5 06:00:12 web-01 sshd[4111]: Failed password for pi from 203.0.113.77 port 50011 ssh2""" }

# Run the Actor and wait for it to finish
run = client.actor("logtriage/security-log-analyzer").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "logText": "Nov  5 06:00:01 web-01 sshd[4100]: Failed password for root from 203.0.113.77 port 50000 ssh2\\nNov  5 06:00:02 web-01 sshd[4101]: Failed password for root from 203.0.113.77 port 50001 ssh2\\nNov  5 06:00:03 web-01 sshd[4102]: Failed password for admin from 203.0.113.77 port 50002 ssh2\\nNov  5 06:00:04 web-01 sshd[4103]: Failed password for admin from 203.0.113.77 port 50003 ssh2\\nNov  5 06:00:05 web-01 sshd[4104]: Failed password for ubuntu from 203.0.113.77 port 50004 ssh2\\nNov  5 06:00:06 web-01 sshd[4105]: Failed password for ubuntu from 203.0.113.77 port 50005 ssh2\\nNov  5 06:00:07 web-01 sshd[4106]: Failed password for test from 203.0.113.77 port 50006 ssh2\\nNov  5 06:00:08 web-01 sshd[4107]: Failed password for test from 203.0.113.77 port 50007 ssh2\\nNov  5 06:00:09 web-01 sshd[4108]: Failed password for oracle from 203.0.113.77 port 50008 ssh2\\nNov  5 06:00:10 web-01 sshd[4109]: Failed password for oracle from 203.0.113.77 port 50009 ssh2\\nNov  5 06:00:11 web-01 sshd[4110]: Failed password for pi from 203.0.113.77 port 50010 ssh2\\nNov  5 06:00:12 web-01 sshd[4111]: Failed password for pi from 203.0.113.77 port 50011 ssh2"
}' |
apify call logtriage/security-log-analyzer --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,logtriage/security-log-analyzer"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/GnHBCHpyCGr8X7lxK/builds/vFxBmNB2FP4e9mJ3x/openapi.json