Weekly security log review
Scans auth logs for brute force, new admin users and odd logins.
RunsEvery Monday at 8 AM
Cron
0 8 * * 1Works withAny agent, any stack
Read the auth/access logs at <PATH> for the last 7 days. Report: failed login bursts by IP, successful logins from new countries or IPs, new users or privilege changes, sudo usage, and unusual hours. Rank findings by severity and suggest concrete hardening steps. Do not modify the system.Replace anything in <ANGLE BRACKETS> with your own details. Review outputs before letting an agent send, buy or delete anything.
How to run this
Works with any agent
⏱TriggerEvery Monday at 8 AM
✦Any agentRuns the prompt
✓OutputResult for you to review
Steps
- Copy the prompt and fill in the parts in angle brackets.
- Paste it into whatever agent you already use: a chat assistant, a coding agent, an automation tool, or a script that calls any model API.
- Schedule it (every monday at 8 am). Use the agent's own scheduler if it has one, otherwise run it from cron with the expression below.
- Give it only the access it needs (inbox, calendar, repo, sheet) and keep sends, purchases and deletes behind your approval.
- Review the first two runs, tweak the prompt, then let it run.