Security Log Analyzer: attack detection for 50+ log formats
Pricing
$20.00 / 1,000 log analyzeds
Detects the format of a security log and finds attacks in it: brute force, password spraying, logins after failures, web scanning and injection, cloud privilege changes, suspicious commands, port scans. Entra ID, Windows events, auth.log, nginx/Apache, CloudTrail, Okta, firewalls, EDR and more.
You can access the Security Log Analyzer: attack detection for 50+ log formats programmatically from your own applications by using the Apify API. You can also choose the language preference from below. To use the Apify API, you’ll need an Apify account and your API token, found in API & Integrations in Apify Console.
# Set API token$API_TOKEN=<YOUR_API_TOKEN>
# Prepare Actor input$cat > input.json << 'EOF'<{< "logText": "Nov 5 06:00:01 web-01 sshd[4100]: Failed password for root from 203.0.113.77 port 50000 ssh2\nNov 5 06:00:02 web-01 sshd[4101]: Failed password for root from 203.0.113.77 port 50001 ssh2\nNov 5 06:00:03 web-01 sshd[4102]: Failed password for admin from 203.0.113.77 port 50002 ssh2\nNov 5 06:00:04 web-01 sshd[4103]: Failed password for admin from 203.0.113.77 port 50003 ssh2\nNov 5 06:00:05 web-01 sshd[4104]: Failed password for ubuntu from 203.0.113.77 port 50004 ssh2\nNov 5 06:00:06 web-01 sshd[4105]: Failed password for ubuntu from 203.0.113.77 port 50005 ssh2\nNov 5 06:00:07 web-01 sshd[4106]: Failed password for test from 203.0.113.77 port 50006 ssh2\nNov 5 06:00:08 web-01 sshd[4107]: Failed password for test from 203.0.113.77 port 50007 ssh2\nNov 5 06:00:09 web-01 sshd[4108]: Failed password for oracle from 203.0.113.77 port 50008 ssh2\nNov 5 06:00:10 web-01 sshd[4109]: Failed password for oracle from 203.0.113.77 port 50009 ssh2\nNov 5 06:00:11 web-01 sshd[4110]: Failed password for pi from 203.0.113.77 port 50010 ssh2\nNov 5 06:00:12 web-01 sshd[4111]: Failed password for pi from 203.0.113.77 port 50011 ssh2"<}<EOF
# Run the Actor using an HTTP API# See the full API reference at https://docs.apify.com/api/v2$curl "https://api.apify.com/v2/actors/logtriage~security-log-analyzer/runs?token=$API_TOKEN" \< -X POST \< -d @input.json \< -H 'Content-Type: application/json'Below, you can find a list of relevant HTTP API endpoints for calling the Security Log Analyzer: attack detection for 50+ log formats Actor. For this, you’ll need an Apify account. Replace <YOUR_API_TOKEN> in the URLs with your Apify API token, which you can find under API & Integrations in Apify Console. For details, see the API reference.
https://api.apify.com/v2/actors/logtriage~security-log-analyzer/runs?token=<YOUR_API_TOKEN>Note: By adding the method=POST query parameter, this API endpoint can be called using a GET request and thus used in third-party webhooks. Please refer to our Run Actor API documentation.
https://api.apify.com/v2/actors/logtriage~security-log-analyzer/run-sync-get-dataset-items?token=<YOUR_API_TOKEN>Note: This endpoint supports both POST and GET request methods. However, only the POST method allows you to pass input data. For more information, please refer to our Run Actor synchronously and get dataset items API documentation.
https://api.apify.com/v2/actors/logtriage~security-log-analyzer?token=<YOUR_API_TOKEN>For more information, please refer to our Get Actor API documentation.
Actors can be used to scrape web pages, extract data, or automate browser tasks. Use the Security Log Analyzer: attack detection for 50+ log formats API programmatically via the Apify API.
You can choose from:
Security Log Analyzer: attack detection for 50+ log formats API in Python
Security Log Analyzer: attack detection for 50+ log formats API in JavaScript
Security Log Analyzer: attack detection for 50+ log formats API through CLI
Security Log Analyzer: attack detection for 50+ log formats OpenAPI definition
You can start Security Log Analyzer: attack detection for 50+ log formats with the Apify API by sending an HTTP POST request to the Run Actorendpoint. An Actor’s input and its content type can be passed as a payload of the POST request, and additional options can be specified using URL query parameters. The Security Log Analyzer: attack detection for 50+ log formats is identified within the API by its ID, which is the creator’s username and the name of the Actor.
When the Security Log Analyzer: attack detection for 50+ log formats run finishes you can list the data from its default dataset(storage) via the API or you can preview the data directly on Apify Console.