12-log-analysis

Name: 12-log-analysis
Author: Masriyan

190stars37forks

How to install 12-log-analysis?

masriyan/claude-code-cybersecurity-skill/12-log-analysis

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 12-log-analysis

Installs into the current project.

Summary

Security log parsing, anomaly detection, SIEM query building, Sigma rule creation, and correlation rule development across Splunk, Elastic, QRadar, and Microsoft Sentinel

Files · 1

View on GitHub

SKILL.md

1	# Log Analysis & SIEM Integration
2
3	## Purpose
4
5	Enable Claude to assist with security log analysis across all major platforms. Claude directly parses and analyzes log samples provided by the user, builds SIEM queries for any platform, creates Sigma rules for portable detection, develops correlation rules, and identifies anomalous patterns in log data.
6
7	---
8
9	## Activation Triggers
10
11	This skill activates when the user asks about:
12	- Parsing Windows Event Logs, Linux syslog, or application logs
13	- Building Splunk SPL, Elastic KQL/EQL, QRadar AQL, or Sentinel KQL queries
14	- Creating Sigma rules for platform-agnostic detection
15	- Detecting anomalies or attack patterns in log data
16	- Building SIEM correlation rules for complex attack scenarios
17	- Converting queries between SIEM platforms
18	- Log source health monitoring and gap analysis
19	- Detecting lateral movement, privilege escalation, or persistence in logs
20	- EVTX analysis or Windows audit log review
21
22	---
23
24	## Prerequisites
25
26	```bash
27	pip install pandas pyyaml python-dateutil
28	```
29
30	Platform tools:
31	- `Splunk` — Splunk Web, SPL, and SOAR
32	- `Elastic Stack` — Kibana, KQL, EQL
33	- `Microsoft Sentinel` — KQL, Workbooks
34	- `IBM QRadar` — AQL, Rules
35	- `Sigma` — Platform-agnostic rule format
36	- `python-evtx` — Parse Windows .evtx files without Windows
37
38	---
39
40	## Core Capabilities
41
42	### 1. Log Parsing & Analysis
43
44	When the user pastes logs or provides log files:
45
46	Claude directly reads and analyzes logs to extract security-relevant events.
47
48	Windows Event Log — Critical Event IDs:
49
50	\| Event ID \| Log \| Description \|
51	\|----------\|-----\|-------------\|
52	\| 4624 \| Security \| Successful logon — Logon Type 3 (network) is interesting \|
53	\| 4625 \| Security \| Failed logon — track source IP for brute force \|
54	\| 4648 \| Security \| Logon with explicit credentials (RunAs) \|
55	\| 4688 \| Security \| New process created — needs CommandLine auditing enabled \|
56	\| 4698 \| Security \| Scheduled task created \|
57	\| 4702 \| Security \| Scheduled task updated \|
58	\| 4720 \| Security \| User account created \|
59	\| 4728/4732 \| Security \| Member added to security/local group \|
60	\| 4768/4769 \| Security \| Kerberos TGT/TGS requested \|
61	\| 4776 \| Security \| NTLM authentication \|
62	\| 4946 \| Security \| Windows Firewall rule added \|
63	\| 5140 \| Security \| Network share accessed \|
64	\| 5145 \| Security \| Network share file access \|
65	\| 7045 \| System \| New service installed \|
66	\| 1102 \| Security \| Audit log cleared \|
67	\| 4103/4104 \| PowerShell \| PowerShell module/script block logging \|
68
69	Linux Log Analysis — Key Patterns:
70	```bash
71	# Failed SSH logins
72	grep "Failed password" /var/log/auth.log \| awk '{print $1,$2,$3,$11}' \| sort \| uniq -c \| sort -rn
73
74	# Successful logins after failures (brute force success)
75	grep "Accepted password\\|Accepted publickey" /var/log/auth.log
76
77	# Sudo usage
78	grep "sudo:" /var/log/auth.log \| grep -v "session"
79
80	# Cron job execution
81	grep CRON /var/log/syslog
82
83	# New user creation
84	grep "useradd\\|usermod" /var/log/auth.log
85
86	# Privilege escalation
87	grep "su\b" /var/log/auth.log
88	```
89
90	Log parsing script:
91	```bash
92	python scripts/log_parser.py --input /var/log/auth.log --format json --output parsed.json
93	python scripts/log_parser.py --input events.evtx --normalize ecs --output normalized.json
94	```
95
96	### 2. SIEM Query Library
97
98	When the user asks to build detection queries:
99
100	#### Splunk SPL — Attack Pattern Queries
101
102	```spl
103	// Brute force attack detection
104	index=windows EventCode=4625
105	\| bin _time span=5m
106	\| stats count as FailedLogins, values(Account_Name) as Accounts by src_ip, _time
107	\| where FailedLogins > 20
108	\| sort -FailedLogins
109
110	// Pass-the-Hash detection (Logon Type 3 with NTLM)
111	index=windows EventCode=4624 Logon_Type=3 Authentication_Package=NTLM
112	\| where NOT (Account_Name="ANONYMOUS LOGON" OR Account_Name="*$")
113	\| stats count by Account_Name, Workstation_Name, src_ip
114	\| where count > 1
115
116	// Lateral movement via PsExec / admin shares
117	index=windows EventCode=5145
118	\| where (ShareName="\\\\\\ADMIN$" OR ShareName="\\\\\\C$")
119	AND RelativeTargetName="PSEXESVC"
120	\| table _time, SubjectUserName, IpAddress, ShareName
121
122	// PowerShell encoded command execution
123	index=windows (source="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4104)
124	OR (EventCode=4688 CommandLine="powershell")
125	\| search CommandLine IN ("-EncodedCommand", "-enc ", "-e ", "-nop",
126	"DownloadString", "IEX", "Invoke-Expression")
127	\| table _time, ComputerName, User, CommandLine
128
129	// Scheduled task creation for persistence
130	index=windows EventCode=4698
131	\| rex field=TaskContent "<Command>(?P<command>[^<]+)</Command>"
132	\| where NOT match(command, "(?i)\\\\windows\\\\\|\\\\microsoft

People who liked this also viewed

6 picks

Type

12-log-analysis

190stars37forks

View on GitHub

How to install 12-log-analysis?

masriyan/claude-code-cybersecurity-skill/12-log-analysis

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 12-log-analysis

Installs into the current project.

Summary

Security log parsing, anomaly detection, SIEM query building, Sigma rule creation, and correlation rule development across Splunk, Elastic, QRadar, and Microsoft Sentinel

Files · 1

View on GitHub

SKILL.md

1	# Log Analysis & SIEM Integration
2
3	## Purpose
4
5	Enable Claude to assist with security log analysis across all major platforms. Claude directly parses and analyzes log samples provided by the user, builds SIEM queries for any platform, creates Sigma rules for portable detection, develops correlation rules, and identifies anomalous patterns in log data.
6
7	---
8
9	## Activation Triggers
10
11	This skill activates when the user asks about:
12	- Parsing Windows Event Logs, Linux syslog, or application logs
13	- Building Splunk SPL, Elastic KQL/EQL, QRadar AQL, or Sentinel KQL queries
14	- Creating Sigma rules for platform-agnostic detection
15	- Detecting anomalies or attack patterns in log data
16	- Building SIEM correlation rules for complex attack scenarios
17	- Converting queries between SIEM platforms
18	- Log source health monitoring and gap analysis
19	- Detecting lateral movement, privilege escalation, or persistence in logs
20	- EVTX analysis or Windows audit log review
21
22	---
23
24	## Prerequisites
25
26	```bash
27	pip install pandas pyyaml python-dateutil
28	```
29
30	Platform tools:
31	- `Splunk` — Splunk Web, SPL, and SOAR
32	- `Elastic Stack` — Kibana, KQL, EQL
33	- `Microsoft Sentinel` — KQL, Workbooks
34	- `IBM QRadar` — AQL, Rules
35	- `Sigma` — Platform-agnostic rule format
36	- `python-evtx` — Parse Windows .evtx files without Windows
37
38	---
39
40	## Core Capabilities
41
42	### 1. Log Parsing & Analysis
43
44	When the user pastes logs or provides log files:
45
46	Claude directly reads and analyzes logs to extract security-relevant events.
47
48	Windows Event Log — Critical Event IDs:
49
50	\| Event ID \| Log \| Description \|
51	\|----------\|-----\|-------------\|
52	\| 4624 \| Security \| Successful logon — Logon Type 3 (network) is interesting \|
53	\| 4625 \| Security \| Failed logon — track source IP for brute force \|
54	\| 4648 \| Security \| Logon with explicit credentials (RunAs) \|
55	\| 4688 \| Security \| New process created — needs CommandLine auditing enabled \|
56	\| 4698 \| Security \| Scheduled task created \|
57	\| 4702 \| Security \| Scheduled task updated \|
58	\| 4720 \| Security \| User account created \|
59	\| 4728/4732 \| Security \| Member added to security/local group \|
60	\| 4768/4769 \| Security \| Kerberos TGT/TGS requested \|
61	\| 4776 \| Security \| NTLM authentication \|
62	\| 4946 \| Security \| Windows Firewall rule added \|
63	\| 5140 \| Security \| Network share accessed \|
64	\| 5145 \| Security \| Network share file access \|
65	\| 7045 \| System \| New service installed \|
66	\| 1102 \| Security \| Audit log cleared \|
67	\| 4103/4104 \| PowerShell \| PowerShell module/script block logging \|
68
69	Linux Log Analysis — Key Patterns:
70	```bash
71	# Failed SSH logins
72	grep "Failed password" /var/log/auth.log \| awk '{print $1,$2,$3,$11}' \| sort \| uniq -c \| sort -rn
73
74	# Successful logins after failures (brute force success)
75	grep "Accepted password\\|Accepted publickey" /var/log/auth.log
76
77	# Sudo usage
78	grep "sudo:" /var/log/auth.log \| grep -v "session"
79
80	# Cron job execution
81	grep CRON /var/log/syslog
82
83	# New user creation
84	grep "useradd\\|usermod" /var/log/auth.log
85
86	# Privilege escalation
87	grep "su\b" /var/log/auth.log
88	```
89
90	Log parsing script:
91	```bash
92	python scripts/log_parser.py --input /var/log/auth.log --format json --output parsed.json
93	python scripts/log_parser.py --input events.evtx --normalize ecs --output normalized.json
94	```
95
96	### 2. SIEM Query Library
97
98	When the user asks to build detection queries:
99
100	#### Splunk SPL — Attack Pattern Queries
101
102	```spl
103	// Brute force attack detection
104	index=windows EventCode=4625
105	\| bin _time span=5m
106	\| stats count as FailedLogins, values(Account_Name) as Accounts by src_ip, _time
107	\| where FailedLogins > 20
108	\| sort -FailedLogins
109
110	// Pass-the-Hash detection (Logon Type 3 with NTLM)
111	index=windows EventCode=4624 Logon_Type=3 Authentication_Package=NTLM
112	\| where NOT (Account_Name="ANONYMOUS LOGON" OR Account_Name="*$")
113	\| stats count by Account_Name, Workstation_Name, src_ip
114	\| where count > 1
115
116	// Lateral movement via PsExec / admin shares
117	index=windows EventCode=5145
118	\| where (ShareName="\\\\\\ADMIN$" OR ShareName="\\\\\\C$")
119	AND RelativeTargetName="PSEXESVC"
120	\| table _time, SubjectUserName, IpAddress, ShareName
121
122	// PowerShell encoded command execution
123	index=windows (source="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4104)
124	OR (EventCode=4688 CommandLine="powershell")
125	\| search CommandLine IN ("-EncodedCommand", "-enc ", "-e ", "-nop",
126	"DownloadString", "IEX", "Invoke-Expression")
127	\| table _time, ComputerName, User, CommandLine
128
129	// Scheduled task creation for persistence
130	index=windows EventCode=4698
131	\| rex field=TaskContent "<Command>(?P<command>[^<]+)</Command>"
132	\| where NOT match(command, "(?i)\\\\windows\\\\\|\\\\microsoft

People who liked this also viewed

6 picks

Type