Geoip2

The analyzing-web-server-logs-for-intrusion skill parses Apache and Nginx access logs to detect SQL injection, local file inclusion, directory traversal, scanner fingerprints, brute-force bursts, and anomalous request patterns. Use it for intrusion triage, threat hunting, and Security Audit workflows with GeoIP enrichment and signature-based detection.