Suricata IDS Monitor

Read and triage Suricata IDS/IPS alerts from eve.json into a structured threat report — severity-ranked findings, attacker IPs, top triggered signatures, and...

This skill appears to do what it claims (parse /var/log/suricata/eve.json and make a report), but there are several red flags you should review before installing or running it: 1) The SKILL.md contradicts itself — it says "No data leaves your machine" yet includes example code that posts reports to Telegram (which would require TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID). Treat those env vars as sensitive. 2) The doc suggests using 'sudo chmod 644 /var/log/suricata/eve.json' — that relaxes file permissions and can expose sensitive logs to other local users; prefer safer alternatives (add the agent user to the appropriate group or use setfacl) instead of world-readable chmod. 3) The cron scheduling example would make the skill run periodically; only add such a schedule if you trust the skill and have reviewed where reports will be sent and stored. 4) The skill references other skills (telegram-notifier, eva-security-audit) without declaring dependencies; verify those integrations before use. 5) Because the skill source and homepage are unknown, consider running it manually in a controlled environment first, avoid providing Telegram tokens until you confirm expected behavior, and inspect any files written to 'memory/' or other paths. If you need higher assurance, request the skill author/source, or have someone review the SKILL.md and test commands in a sandboxed/non-production host.

Type: OpenClaw Skill Name: suricata-monitor Version: 1.0.0 The suricata-monitor skill is a security utility designed to parse local Suricata IDS logs (/var/log/suricata/eve.json) and generate actionable threat reports. It provides Python logic for log aggregation, severity ranking, and optional delivery to Telegram using environment variables. While the documentation contains a minor contradiction by claiming no data leaves the machine while providing a Telegram integration snippet, the code is transparent, lacks obfuscation, and performs actions consistent with its stated purpose of security monitoring and incident response.