diff --git a/README.md b/README.md
index d206658..70f21d9 100644
--- a/README.md
+++ b/README.md
@@ -87,6 +87,17 @@ Use the `run-reports.sh` script to run all report intervals in one step. The scr
 
 Running this script will create or update the hourly, daily, weekly and monthly reports under `output/`. It also detects all unique domains found in the database and writes per-domain reports to `output/domains/<domain>/<interval>` alongside the aggregate data. After generation, open `output/index.html` in your browser to browse the reports.
 
+
+## Log Analysis
+
+The `run-analysis.sh` script runs helper routines that inspect the database. It
+creates or reuses the virtual environment and then executes a set of analysis
+commands to spot missing domains, suggest cache rules and detect potential
+threats.
+
+```bash
+./run-analysis.sh
+```
 ## Serving Reports with Nginx
 
 To expose the generated HTML dashboards and JSON files over HTTP you can use a
diff --git a/run-analysis.sh b/run-analysis.sh
new file mode 100755
index 0000000..1f5c213
--- /dev/null
+++ b/run-analysis.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -e
+
+# Ensure virtual environment exists
+if [ ! -d ".venv" ]; then
+    echo "[INFO] Creating virtual environment..."
+    python3 -m venv .venv
+    source .venv/bin/activate
+    echo "[INFO] Installing dependencies..."
+    pip install --upgrade pip
+    if [ -f requirements.txt ]; then
+        pip install -r requirements.txt
+    else
+        echo "[WARN] requirements.txt not found, skipping."
+    fi
+else
+    echo "[INFO] Activating virtual environment..."
+    source .venv/bin/activate
+fi
+
+# Run analysis helpers
+echo "[INFO] Checking for missing domains..."
+python scripts/analyze.py check-missing-domains
+
+echo "[INFO] Suggesting cache improvements..."
+python scripts/analyze.py suggest-cache
+
+echo "[INFO] Detecting threats..."
+python scripts/analyze.py detect-threats
+
+# Deactivate to keep cron environment clean
+if type deactivate >/dev/null 2>&1; then
+    deactivate
+fi
diff --git a/tests/test_run_analysis.py b/tests/test_run_analysis.py
new file mode 100644
index 0000000..60d2810
--- /dev/null
+++ b/tests/test_run_analysis.py
@@ -0,0 +1,32 @@
+import os
+import subprocess
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+SCRIPT = REPO_ROOT / "run-analysis.sh"
+
+
+def test_script_invokes_commands(tmp_path):
+    # create stub virtualenv so the script skips creation
+    venv = tmp_path / ".venv" / "bin"
+    venv.mkdir(parents=True)
+    (venv / "activate").write_text(":")
+
+    calls = tmp_path / "calls.txt"
+    python_stub = tmp_path / "python"
+    python_stub.write_text(f"#!/usr/bin/env bash\necho \"$*\" >> \"{calls}\"\n")
+    python_stub.chmod(0o755)
+    (tmp_path / "python3").write_text(f"#!/usr/bin/env bash\nexit 0\n")
+    (tmp_path / "python3").chmod(0o755)
+
+    env = os.environ.copy()
+    env["PATH"] = f"{tmp_path}:" + env.get("PATH", "")
+
+    subprocess.run([str(SCRIPT)], cwd=tmp_path, env=env, check=True)
+
+    lines = calls.read_text().strip().splitlines()
+    assert lines == [
+        "scripts/analyze.py check-missing-domains",
+        "scripts/analyze.py suggest-cache",
+        "scripts/analyze.py detect-threats",
+    ]