{ "openapi": "3.0.1", "info": { "title": "Security Log Analyzer: attack detection for 50+ log formats", "description": "Detects the format of a security log and finds attacks in it: brute force, password spraying, logins after failures, web scanning and injection, cloud privilege changes, suspicious commands, port scans. Entra ID, Windows events, auth.log, nginx/Apache, CloudTrail, Okta, firewalls, EDR and more.", "version": "1.0", "x-build-id": "vFxBmNB2FP4e9mJ3x" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/logtriage~security-log-analyzer/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-logtriage-security-log-analyzer", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/logtriage~security-log-analyzer/runs": { "post": { "operationId": "runs-sync-logtriage-security-log-analyzer", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/logtriage~security-log-analyzer/run-sync": { "post": { "operationId": "run-sync-logtriage-security-log-analyzer", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "logText": { "title": "Log text", "type": "string", "description": "Paste the log: lines, JSON records or Windows event XML. Ignored when a log link is given. The default is a short SSH brute-force sample.", "default": "Nov 5 06:00:01 web-01 sshd[4100]: Failed password for root from 203.0.113.77 port 50000 ssh2\nNov 5 06:00:02 web-01 sshd[4101]: Failed password for root from 203.0.113.77 port 50001 ssh2\nNov 5 06:00:03 web-01 sshd[4102]: Failed password for admin from 203.0.113.77 port 50002 ssh2\nNov 5 06:00:04 web-01 sshd[4103]: Failed password for admin from 203.0.113.77 port 50003 ssh2\nNov 5 06:00:05 web-01 sshd[4104]: Failed password for ubuntu from 203.0.113.77 port 50004 ssh2\nNov 5 06:00:06 web-01 sshd[4105]: Failed password for ubuntu from 203.0.113.77 port 50005 ssh2\nNov 5 06:00:07 web-01 sshd[4106]: Failed password for test from 203.0.113.77 port 50006 ssh2\nNov 5 06:00:08 web-01 sshd[4107]: Failed password for test from 203.0.113.77 port 50007 ssh2\nNov 5 06:00:09 web-01 sshd[4108]: Failed password for oracle from 203.0.113.77 port 50008 ssh2\nNov 5 06:00:10 web-01 sshd[4109]: Failed password for oracle from 203.0.113.77 port 50009 ssh2\nNov 5 06:00:11 web-01 sshd[4110]: Failed password for pi from 203.0.113.77 port 50010 ssh2\nNov 5 06:00:12 web-01 sshd[4111]: Failed password for pi from 203.0.113.77 port 50011 ssh2" }, "logUrl": { "title": "Or a link to the log file", "type": "string", "description": "A URL the Actor downloads (up to 25 MB). Used when Log text is empty." }, "fileName": { "title": "File name (optional)", "type": "string", "description": "Helps identify the format, e.g. auth.log or access.log." } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } } } } } } } } }