Log triage: how to do it with AI
Last checked 2026-10-15
IntermediatePartly (human-led) 🛡️ Cybersecurity
Analyze auth or firewall logs for suspicious patterns.
1. Bot automation level
Partly (human-led) Security conclusions need analyst verification before action.
2. Before you hand it to the bot
- Gather inputs: files, data samples, links and any templates.
- Access: make sure you can use the chosen bot/plan (see limits below).
- Context: tell the bot audience, purpose, constraints and examples of good output.
- Privacy check: remove personal, confidential or regulated data unless your plan/workspace is approved for it.
- Success criteria: write down what 'done' looks like (length, format, tests passing, fields filled).
3. Copy-paste prompts
Main prompt
From these auth logs, list suspicious IPs and why.
Beginner-friendly
From these auth logs, list suspicious IPs and why. I'm new to this: explain each step in plain words and ask me for anything you need before starting.
Check-your-work
From these auth logs, list suspicious IPs and why. When you finish, list any assumptions you made, anything you're unsure about, and what I should double-check before using the result.
Free tiers that can handle this (verified): Claude (incl. Claude Code), ChatGPT (incl. Work & Codex), Google Gemini. Others: check plan.
4. Step-by-step
- Export a bounded log sample (e.g. 24h of auth events) and redact usernames if policy requires.
- Tell the bot your normal patterns (office IP ranges, VPN, service accounts).
- Ask it to list suspicious events with the exact lines and why, ranked by concern.
- Verify each finding in your SIEM before acting.
- Record confirmed findings and tune detection rules.
5. Which bots and plans can do it
| Tool | What's different here | Plan limits | Source |
|---|---|---|---|
| Claude (incl. Claude Code) | Long-context analysis of pasted or uploaded logs. | Claude Code and Research need Pro or higher; computer use is Pro/Max only (research preview). | code.claude.com/docs/en/desktop |
| ChatGPT (incl. Work & Codex) | Can run code over uploaded files to count and group events. | Free tier has limited deep research, Codex and Work; scheduled tasks need Go or higher (per chatgpt.com/pricing). | help.openai.com/en/articles/20001275-chatgpt-work-and-codex |
| Google Gemini | Handles large file uploads. | Free tier includes Deep Research, Canvas, Gems; video generation needs AI Plus or higher. | gemini.google/overview/deep-research/ |
Free or paid?
- Claude (incl. Claude Code): Free plan: yes. chat, web search, files & code execution, Artifacts, connectors. Claude Code and Research need Pro. Paid: the lowest price we could verify on the official pricing page is $20/month (other plans may exist). Its free tier can handle this task.
- ChatGPT (incl. Work & Codex): Free plan: yes. unlimited text chats; limited uploads, images, voice, deep research and Codex. Paid: price not verified, so check the official site. Its free tier can handle this task.
- Google Gemini: Free plan: yes. Flash-Lite model, image generation, Deep Research, Live, Canvas, Gems. Video needs AI Plus or higher. Paid: the lowest price we could verify on the official pricing page is $99.99/month (other plans may exist). Its free tier can handle this task.
6. Risks and what to double-check
- False positives and false negatives are both likely; this is triage help, not detection.
- Don't upload logs to tools not approved for security data.
- Verify against official advisories; don't paste secrets or live credentials.
- AI can hallucinate facts — verify anything that matters.
- Don't share secrets or other people's personal data.
Professions that use this
IT admin / sysadmin · Cybersecurity analyst