server log threat hunter

Find out if your server was attacked, or broken into, from the logs you already have.

server log threat hunter gives your AI agent an incident-response toolkit for Linux web servers. Point it at your web access logs and your SSH/auth logs (rotated .gz files are fine). It parses every line, matches tested attack signatures, scores each source IP from 0 to 100, and tells you in plain language what happened and when. The most important question gets a direct answer: did anyone actually get in? A successful SSH login after a run of failures, followed by sudo downloads and a new admin account, is flagged CRITICAL. A noisy scanner that never got in tops out at HIGH. Everything runs locally and nothing is changed on the server.

What it does

• Reads real-world logs: nginx and Apache combined/common format (with or without vhost prefix), JSON access logs, /var/log/auth.log and /var/log/secure (classic syslog and ISO-8601 rsyslog), and journalctl -o short-iso output. Gzip, mixed files, year-less syslog dates and timezones are handled.
• Web attack signatures: Log4Shell (CVE-2021-44228), Shellshock (CVE-2014-6271), PHPUnit RCE (CVE-2017-9841), Apache 2.4.49 traversal (CVE-2021-41773), SQL injection, XSS, template injection, command injection, path traversal, webshell access, .env/.git/backup-file probes, admin-panel probing, scanner user agents, 404 bursts, login floods and request-rate spikes. Exploit hits that returned HTTP 200 score higher.
• SSH and host signals: password guessing, password spraying across many usernames, invalid users, distributed guessing of one username from many IPs, accepted logins after failures, logins from IPs that also attacked the website, suspicious sudo commands (downloads, chmod +x in /tmp, reverse shells, user creation), new local accounts and additions to sudo/wheel/admin groups.
• MITRE ATT&CK mapping on every finding (T1190, T1110.001, T1110.003, T1078, T1548.003, T1136.001, T1098 and more).
• Severity you can trust: per-area caps, and CRITICAL only with evidence of access or post-login activity.
• Outputs: terminal summary, hunt.md report, iocs.csv, timeline.csv, hunt.json, and blocklist.txt with ufw, nftables and nginx deny lines. Your own --allow IPs and CIDRs never land in the blocklist. URLs and IPs inside commands are defanged.
• Daily diffs: hunt_diff.py compares two runs and lists new findings, new IPs, escalations and attackers that went quiet.
• Response playbook: a step-by-step guide for when the result is CRITICAL (preserve evidence, keep access, contain, hunt persistence, rotate credentials, rebuild or clean).

Problems it solves

• "My server is slow / my host sent an abuse notice. Was I hacked?"
• Thousands of SSH failures a day and no idea whether one of them succeeded
• Grepping access logs by hand for jndi, ../ and union select
• Writing firewall rules from a log without blocking yourself
• Explaining an incident to a client or boss with a timeline instead of a guess

Who it's for

Developers and indie hackers running a VPS, sysadmins and DevOps engineers, MSPs and IT generalists, small-business web hosts, and SOC analysts who want a fast offline first pass on Linux logs.

What's included

• SKILL.md: hard safety rules for the agent, where each log lives on Debian/Ubuntu and RHEL-family systems, run commands, how to read severities, and a decision tree for what to tell the user
• scripts/hunt.py (main CLI), logparse.py (parsers), detections.py (signatures and ATT&CK map), hunt_diff.py (run-to-run diff), make_samples.py (a synthetic incident using RFC 5737 documentation IPs)
• references/: detection rules table generated from the code, supported log formats with examples, an incident response playbook, and every source used (nginx, Apache, OpenSSH, shadow-utils, sudo, RFC 3164/5424/3339, NVD, MITRE ATT&CK)
• examples/: expected terminal output and blocklist for the bundled sample

Standard-library Python only. No API keys, no network calls, no installs.