log-analysis--siem-integration

# Log Analysis & SIEM Integration ## Purpose Enable Claude to assist with security log analysis across all major platforms. Claude directly parses and analyzes log samples provided by the user, builds SIEM queries for any platform, creates Sigma rules for portable detection, develops correlation rules, and identifies anomalous patterns in log data. --- ## Activation Triggers This skill activates when the user asks about: - Parsing Windows Event Logs, Linux syslog, or application logs - Building Splunk SPL, Elastic KQL/EQL, QRadar AQL, or Sentinel KQL queries - Creating Sigma rules for platform-agnostic detection - Detecting anomalies or attack patterns in log data - Building SIEM correlation rules for complex attack scenarios - Converting queries between SIEM platforms - Log source health monitoring and gap analysis - Detecting lateral movement, privilege escalation, or persistence in logs - EVTX analysis or Windows audit log review --- ## Prerequisites ```bash pip install pandas pyyaml python-dateutil ``` **Platform tools:** - `Splunk` — Splunk Web, SPL, and SOAR - `Elastic Stack` — Kibana, KQL, EQL - `Microsoft Sentinel` — KQL, Workbooks - `IBM QRadar` — AQL, Rules - `Sigma` — Platform-agnostic rule format - `python-evtx` — Parse Windows .evtx files without Windows --- ## Core Capabilities ### 1. Log Parsing & Analysis **When the user pastes logs or provides log files:** Claude directly reads and analyzes logs to extract security-relevant events. **Windows Ev...