log-analysis

Purpose

When to Use

Key Capabilities

• Detect anomalies using machine learning-based pattern recognition on log data.
• Identify threats like SQL injection attempts or malware indicators via signature matching.
• Parse multiple log formats (e.g., syslog, Apache access logs) and extract metadata for correlation.
• Generate reports with severity levels and recommendations for mitigation.
• Support for filtering logs by time, IP, or user ID to narrow down investigations.

Usage Patterns

$LOG_ANALYSIS_API_KEY

Common Commands/API

log-analysis scan

POST /api/v1/logs/analyze

• CLI Example: Scan a local file for threats:

  log-analysis scan --file /var/log/syslog --anomaly true --output report.json

  This flags anomalies and saves results to a file.
• API Example: Send logs for analysis:

  curl -X POST https://api.openclaw.com/api/v1/logs/analyze \
  -H "Authorization: Bearer $LOG_ANALYSIS_API_KEY" \
  -d '{"logs": [{"line": "ERROR: Unauthorized access"}], "filters": {"ip": "192.168.1.1"}}'

  This analyzes specified logs and returns JSON with detected threats.
• Common Flags:

  --file <path>

  for input,

  --anomaly

  for ML-based detection,

  --threshold 0.8

  for sensitivity level.
• Config Format: Use JSON for custom rules, e.g.:

  {
    "rules": [
      {"pattern": "Failed login", "severity": "high"}
    ]
  }

  Load via

  --config config.json

  .

Integration Notes

$LOG_ANALYSIS_API_KEY

import log_analysis_sdk
client = log_analysis_sdk.Client(api_key=os.environ['LOG_ANALYSIS_API_KEY'])
response = client.analyze(logs_data)

Error Handling

try:
    result = log_analysis.scan('--file invalid.log')
except FileNotFoundError:
    print("Error: Log file not found. Verify path and permissions.")

$LOG_ANALYSIS_API_KEY

os.path.exists()

Concrete Usage Examples

1. Detect anomalies in server logs: Run

   log-analysis scan --file /var/log/auth.log --anomaly true

   to identify potential brute-force attacks. Review the output JSON for entries like {"event": "Failed login", "count": 5, "threat": "high"}, then correlate with firewall logs for further investigation.
2. Integrate with a monitoring script: In a Bash script, fetch logs from a remote server and analyze:

   logs=$(curl http://server/logs.txt)
   echo "$logs" | log-analysis scan --stream --threshold 0.7

   This detects threats in real-time streams, outputting alerts for anomalies like unusual user activity, and pipes results to a SIEM for automated response.

Graph Relationships

• Related to: forensics (via shared tags for log parsing), security (for threat detection overlap), blue-team cluster (as a core component for operations).
• Links: Connects to skills like "incident-response" for follow-up actions and "network-monitoring" for correlated data analysis.