{
  "slug": "syslog-triage",
  "name": "gizza-ai/syslog-triage",
  "version": "0.1.0",
  "title": "Syslog Triage — parse auth.log for sudo, SSH & cron events — gizza.ai",
  "description": "Paste syslog or auth.log text to classify sudo, SSH auth, and cron events, filter failures, and rank failed logins by source IP.",
  "tags": [
    "syslog triage",
    "auth.log parser",
    "failed ssh logins",
    "sudo log",
    "cron log",
    "intrusion review",
    "brute force detection",
    "linux security log"
  ],
  "category": "developer",
  "urls": {
    "page": "https://gizza.ai/tools/syslog-triage/",
    "markdown": "https://gizza.ai/tools/syslog-triage/index.md",
    "descriptor": "https://gizza.ai/tools/syslog-triage/tool.json",
    "deep_link_example": "https://gizza.ai/tools/syslog-triage/?logs=May%20%203%2018%3A20%3A45%20web1%20sshd%5B2001%5D%3A%20Failed%20password%20for%20root%20from%20203.0.113.5%20port%2044001%20ssh2%0AMay%20%203%2018%3A21%3A10%20web1%20sshd%5B2010%5D%3A%20Accepted%20publickey%20for%20bob%20from%20192.168.1.10%20port%2051000%20ssh2%0AMay%20%203%2018%3A22%3A00%20web1%20sudo%3A%20%20%20%20alice%20%3A%20TTY%3Dpts%2F0%20%3B%20PWD%3D%2Fhome%2Falice%20%3B%20USER%3Droot%20%3B%20COMMAND%3D%2Fusr%2Fbin%2Fapt-get%20update%0AMay%20%203%2018%3A25%3A01%20web1%20CRON%5B3001%5D%3A%20%28root%29%20CMD%20%28%2Fusr%2Flocal%2Fbin%2Fbackup.sh%29&category=all&only=all&output=summary&limit=500"
  },
  "cli": "gizza tool syslog-triage \"May  3 18:20:45 web1 sshd[2001]: Failed password for root from 203.0.113.5 port 44001 ssh2\nMay  3 18:21:10 web1 sshd[2010]: Accepted publickey for bob from 192.168.1.10 port 51000 ssh2\nMay  3 18:22:00 web1 sudo:    alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/apt-get update\nMay  3 18:25:01 web1 CRON[3001]: (root) CMD (/usr/local/bin/backup.sh)\"",
  "tool": {
    "description": "Parse and triage Linux syslog / auth.log text for a quick intrusion review. Classifies each line into a security category — sudo, ssh, cron, session, account, or other — derives a success/failure status, and extracts the user, source IP, and command. category filters to one category (default all); only filters by status (all/failed/success — 'failed' surfaces brute-force attempts); output='summary' (default) is an intrusion-review report that ranks failed logins by source IP and lists sudo and cron activity, or 'table'/'json'. limit caps the event count (default 500).",
    "parameters": {
      "additionalProperties": false,
      "properties": {
        "category": {
          "default": "all",
          "description": "Keep only events in this category. 'all' (default) keeps every line; 'sudo' = privilege escalation, 'ssh' = sshd auth (accepted/failed/invalid user), 'cron' = cron jobs, 'session' = su/login/logind sessions, 'account' = user/group management, 'other' = unclassified. Category is derived from the service tag.",
          "enum": [
            "all",
            "sudo",
            "ssh",
            "cron",
            "session",
            "account",
            "other"
          ],
          "type": "string"
        },
        "limit": {
          "default": 500,
          "description": "Maximum number of events to keep (1-5000). Applied after the category and status filters. Default 500.",
          "maximum": 5000,
          "minimum": 1,
          "type": "integer"
        },
        "logs": {
          "description": "The raw syslog / auth.log text — one entry per line. Handles BSD syslog (RFC 3164, 'Mmm dd HH:MM:SS host tag[pid]: msg') and rsyslog ISO/RFC 3339 timestamps, with an optional <PRI> prefix.",
          "type": "string"
        },
        "only": {
          "default": "all",
          "description": "Status filter. 'all' (default) keeps every event; 'failed' keeps only failures (failed passwords, invalid users, sudo/auth denials); 'success' keeps only successful logins, sudo commands, and opened sessions.",
          "enum": [
            "all",
            "failed",
            "success"
          ],
          "type": "string"
        },
        "output": {
          "default": "summary",
          "description": "Output shape. 'summary' (default) is an intrusion-review report: an events/failed header, category counts, failed logins ranked by source IP, plus sudo and cron sections. 'table' is a Markdown table (one row per event); 'json' is an array of event objects.",
          "enum": [
            "summary",
            "table",
            "json"
          ],
          "type": "string"
        }
      },
      "required": [
        "logs"
      ],
      "type": "object"
    }
  }
}