[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFWPRS5RY3ZXV88KSJKZ2A":3,"skill-same:01M6AFWPRS5RY3ZXV88KSJKZ2A":111},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":65,"ownerHtmlUrl":66,"ownerBlogUrl":67,"ownerDescription":68,"updatedAt":69,"install":70,"resources":83},"01M6AFWPRS5RY3ZXV88KSJKZ2A","performing-log-analysis-for-forensic-investigation",null,"Collect, parse, and correlate system, application, and security logs to reconstruct events and establish timelines during forensic investigations.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-log-analysis-for-forensic-investigation\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"performing log analysis for forensic investigation","investigation","analysis","digital-forensics","collection","t1074","timeline","event-correlation","correlation","security","evidence-collection","timeline-analysis","log-analysis","forensics","logs","collect","siem","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-log-analysis-for-forensic-investigation\ndescription: Collect, parse, and correlate system, application, and security logs\n  to reconstruct events and establish timelines during forensic investigations.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- log-analysis\n- siem\n- event-correlation\n- timeline-analysis\n- evidence-collection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1005\n- T1074\n- T1119\n- T1070\n- T1685.002\n---\n\n# Performing Log Analysis for Forensic Investigation\n\n## When to Use\n- When reconstructing the timeline of a security incident from available log sources\n- During post-breach investigation to identify initial access, lateral movement, and exfiltration\n- When correlating events across multiple systems and log sources\n- For establishing evidence of unauthorized access or policy violations\n- When preparing forensic reports requiring detailed event chronology\n\n## Prerequisites\n- Access to collected log files (Windows Event Logs, syslog, application logs)\n- Log parsing tools (LogParser, jq, awk, or ELK stack)\n- Understanding of log formats (EVTX, syslog, JSON, CSV)\n- NTP-synchronized timestamps across all log sources for correlation\n- Sufficient storage for log aggregation and indexing\n- Timeline analysis tools (log2timeline, Plaso)\n\n## Workflow\n\n### Step 1: Collect and Preserve Log Sources\n\n```bash\n# Create case log directory structure\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Flogs\u002F{windows,linux,network,application,web}\n\n# Extract Windows Event Logs from forensic image\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\u002F*.evtx \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fwindows\u002F\n\n# Key Windows Event Logs to collect\n# Security.evtx - Authentication, access control, policy changes\n# System.evtx - Service starts\u002Fstops, driver loads, system errors\n# Application.evtx - Application errors and events\n# Microsoft-Windows-PowerShell%4Operational.evtx - PowerShell execution\n# Microsoft-Windows-Sysmon%4Operational.evtx - Sysmon detailed events\n# Microsoft-Windows-TaskScheduler%4Operational.evtx - Scheduled tasks\n# Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx - RDP\n\n# Collect Linux logs\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fauth.log* \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fsyslog* \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fkern.log* \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fsecure* \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Faudit\u002Faudit.log* \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002F\n\n# Collect web server logs\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fapache2\u002Faccess.log* \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fweb\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fnginx\u002Faccess.log* \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fweb\u002F\n\n# Hash all collected logs for integrity\nfind \u002Fcases\u002Fcase-2024-001\u002Flogs\u002F -type f -exec sha256sum {} \\; > \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flog_hashes.txt\n```\n\n### Step 2: Parse Windows Event Logs\n\n```bash\n# Install python-evtx for EVTX parsing\npip install python-evtx\n\n# Convert EVTX to XML\u002FJSON for analysis\npython3 -c \"\nimport Evtx.Evtx as evtx\nimport json, xml.etree.ElementTree as ET\n\nwith evtx.Evtx('\u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fwindows\u002FSecurity.evtx') as log:\n    for record in log.records():\n        print(record.xml())\n\" > \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fwindows\u002FSecurity_parsed.xml\n\n# Using evtxexport (libevtx-utils)\nsudo apt-get install libevtx-utils\nevtxexport \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fwindows\u002FSecurity.evtx \\\n   > \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fwindows\u002FSecurity_exported.txt\n\n# Key Security Event IDs to investigate\n# 4624 - Successful logon\n# 4625 - Failed logon\n# 4648 - Logon using explicit credentials (runas, lateral movement)\n# 4672 - Special privileges assigned (admin logon)\n# 4688 - Process creation (with command line if auditing enabled)\n# 4697 - Service installed\n# 4698\u002F4702 - Scheduled task created\u002Fupdated\n# 4720 - User account created\n# 4732 - Member added to security-enabled local group\n# 1102 - Audit log cleared\n\n# Extract specific events with python-evtx\npython3 \u003C\u003C 'PYEOF'\nimport Evtx.Evtx as evtx\nimport xml.etree.ElementTree as ET\n\ntarget_events = ['4624', '4625', '4648', '4672', '4688', '4697', '1102']\n\nwith evtx.Evtx('\u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fwindows\u002FSecurity.evtx') as log:\n    for record in log.records():\n        root = ET.fromstring(record.xml())\n        ns = {'ns': 'http:\u002F\u002Fschemas.microsoft.com\u002Fwin\u002F2004\u002F08\u002Fevents\u002Fevent'}\n        event_id = root.find('.\u002F\u002Fns:EventID', ns).text\n        if event_id in target_events:\n            time = root.find('.\u002F\u002Fns:TimeCreated', ns).get('SystemTime')\n            print(f\"[{time}] EventID: {event_id}\")\n            for data in root.findall('.\u002F\u002Fns:Data', ns):\n                print(f\"  {data.get('Name')}: {data.text}\")\n            print()\nPYEOF\n```\n\n### Step 3: Parse and Analyze Linux\u002FSyslog Entries\n\n```bash\n# Parse auth.log for SSH and sudo events\ngrep -E '(sshd|sudo|su\\[|passwd|useradd|usermod)' \\\n   \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002Fauth.log* | \\\n   sort > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fauth_events.txt\n\n# Extract failed SSH login attempts\ngrep 'Failed password' \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002Fauth.log* | \\\n   awk '{print $1,$2,$3,$9,$11}' | sort | uniq -c | sort -rn \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Ffailed_ssh.txt\n\n# Extract successful SSH logins\ngrep 'Accepted' \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002Fauth.log* | \\\n   awk '{print $1,$2,$3,$9,$11}' > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsuccessful_ssh.txt\n\n# Parse audit logs for file access and command execution\nausearch -if \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002Faudit.log \\\n   --start 2024-01-15 --end 2024-01-20 \\\n   -m EXECVE > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Faudit_commands.txt\n\nausearch -if \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002Faudit.log \\\n   -m USER_AUTH,USER_LOGIN,USER_CMD \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Faudit_auth.txt\n\n# Parse web access logs for suspicious requests\ncat \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fweb\u002Faccess.log* | \\\n   grep -iE '(union.*select|\u003Cscript|\\.\\.\\\u002F|cmd\\.exe|\u002Fetc\u002Fpasswd)' \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fweb_attacks.txt\n\n# Extract unique IP addresses from web logs\nawk '{print $1}' \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fweb\u002Faccess.log* | \\\n   sort | uniq -c | sort -rn > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fweb_ips.txt\n```\n\n### Step 4: Correlate Events Across Sources\n\n```bash\n# Normalize timestamps and merge log sources\npython3 \u003C\u003C 'PYEOF'\nimport csv\nimport datetime\nfrom collections import defaultdict\n\nevents = []\n\n# Parse Windows Security events (pre-exported to CSV)\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fwindows_events.csv') as f:\n    reader = csv.DictReader(f)\n    for row in reader:\n        events.append({\n            'timestamp': row['TimeCreated'],\n            'source': 'Windows-Security',\n            'event_id': row['EventID'],\n            'description': row['Description'],\n            'details': row.get('Details', '')\n        })\n\n# Parse Linux auth events\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fauth_events.txt') as f:\n    for line in f:\n        parts = line.strip().split()\n        if len(parts) >= 6:\n            events.append({\n                'timestamp': ' '.join(parts[:3]),\n                'source': 'Linux-Auth',\n                'event_id': parts[4].rstrip(':'),\n                'description': ' '.join(parts[5:]),\n                'details': ''\n            })\n\n# Sort by timestamp\nevents.sort(key=lambda x: x['timestamp'])\n\n# Write correlated timeline\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcorrelated_timeline.csv', 'w', newline='') as f:\n    writer = csv.DictWriter(f, fieldnames=['timestamp', 'source', 'event_id', 'description', 'details'])\n    writer.writeheader()\n    writer.writerows(events)\n\nprint(f\"Total correlated events: {len(events)}\")\nPYEOF\n\n# Quick correlation: find events within time windows\n# Look for lateral movement patterns\ngrep \"4648\\|4624.*Type.*3\\|4624.*Type.*10\" \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fwindows_events.csv | \\\n   sort > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flateral_movement.txt\n```\n\n### Step 5: Generate Forensic Timeline Report\n\n```bash\n# Create structured investigation report\ncat \u003C\u003C 'REPORT' > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flog_analysis_report.txt\nLOG ANALYSIS FORENSIC REPORT\n=============================\nCase: 2024-001\nAnalyst: [Examiner Name]\nDate: $(date -u)\n\nLOG SOURCES ANALYZED:\n- Windows Security Event Log (Security.evtx) - 245,678 events\n- Windows System Event Log (System.evtx) - 45,234 events\n- Windows PowerShell Operational - 12,456 events\n- Linux auth.log - 34,567 entries\n- Apache access.log - 567,890 entries\n- Linux audit.log - 89,012 entries\n\nKEY FINDINGS:\n1. Initial Access: [timestamp] - Successful RDP login from external IP\n2. Privilege Escalation: [timestamp] - New admin account created\n3. Lateral Movement: [timestamp] - Pass-the-hash detected across 3 systems\n4. Data Exfiltration: [timestamp] - Large data transfer to external IP\n5. Log Tampering: [timestamp] - Security event log cleared (Event 1102)\n\nTIMELINE OF EVENTS:\n[See correlated_timeline.csv for complete chronology]\nREPORT\n\n# Package analysis artifacts\ntar -czf \u002Fcases\u002Fcase-2024-001\u002Flog_analysis_package.tar.gz \\\n   \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002F\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Event correlation | Linking related events across multiple log sources by time, IP, user, or session |\n| Log normalization | Converting diverse log formats into a common schema for unified analysis |\n| Timeline analysis | Chronological ordering of events to reconstruct incident sequence |\n| Log integrity | Verifying logs have not been tampered with using hashes and chain of custody |\n| Logon types | Windows categorization of authentication methods (2=interactive, 3=network, 10=RDP) |\n| Audit policy | System configuration determining which events are recorded in logs |\n| Log rotation | Automatic archiving of log files that affects evidence availability |\n| Anti-forensics | Attacker techniques for clearing or modifying logs to cover tracks |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| python-evtx | Python library for parsing Windows EVTX event log files |\n| evtxexport | Command-line EVTX export utility from libevtx |\n| LogParser | Microsoft SQL-like query engine for Windows logs |\n| ausearch | Linux audit log search utility |\n| jq | JSON query tool for parsing structured log formats |\n| ELK Stack | Elasticsearch, Logstash, Kibana for log aggregation and visualization |\n| Chainsaw | Sigma-based Windows Event Log analysis tool |\n| Hayabusa | Fast Windows Event Log forensic timeline generator |\n\n## Common Scenarios\n\n**Scenario 1: Brute Force Attack Detection**\nFilter Security.evtx for Event ID 4625 (failed logons), group by source IP and target account, identify patterns of rapid successive failures, find the successful logon (4624) that followed, trace subsequent activity from the compromised account.\n\n**Scenario 2: Insider Threat Investigation**\nCollect all log sources from the suspect's workstation and accessed servers, correlate file access events with authentication events, build timeline of data access during non-business hours, identify data transfers to external media or cloud storage.\n\n**Scenario 3: Web Application Compromise**\nParse web server access logs for SQLi, XSS, and path traversal patterns, identify the attack IP and timeline, correlate with application logs for successful exploitation, trace post-exploitation activity through system and auth logs.\n\n**Scenario 4: Ransomware Incident Timeline**\nIdentify the initial execution through process creation events (4688), trace privilege escalation through service installation (4697), map lateral movement via network logons (4624 Type 3), identify encryption start from file system activity, find the earliest IoC for remediation scoping.\n\n## Output Format\n\n```\nLog Analysis Summary:\n  Investigation Period: 2024-01-15 00:00 to 2024-01-20 23:59 UTC\n  Total Events Analyzed: 894,567\n  Log Sources: 6 (3 Windows, 3 Linux)\n\n  Critical Events:\n    Failed Logons:       1,234 (from 5 unique IPs)\n    Successful Logons:   456 (3 anomalous)\n    Account Changes:     12 (1 unauthorized admin creation)\n    Process Creations:   8,234 (15 suspicious)\n    Log Clearings:       2 (Security log cleared at 2024-01-18 03:00 UTC)\n    Service Installs:    3 (1 unknown service)\n\n  Attack Timeline:\n    2024-01-15 14:32 - Initial access via RDP brute force\n    2024-01-15 14:45 - Admin account \"svcbackup\" created\n    2024-01-16 02:15 - Lateral movement to 3 servers\n    2024-01-17 03:00 - Data staging in C:\\ProgramData\\temp\\\n    2024-01-18 01:30 - 4.2 GB exfiltrated to 185.x.x.x\n    2024-01-18 03:00 - Security logs cleared\n\n  Report: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flog_analysis_report.txt\n```\n","# Performing Log Analysis for Forensic Investigation\n\n## When to Use\n- When reconstructing the timeline of a security incident from available log sources\n- During post-breach investigation to identify initial access, lateral movement, and exfiltration\n- When correlating events across multiple systems and log sources\n- For establishing evidence of unauthorized access or policy violations\n- When preparing forensic reports requiring detailed event chronology\n\n## Prerequisites\n- Access to collected log files (Windows Event Logs, syslog, application logs)\n- Log parsing tools (LogParser, jq, awk, or ELK stack)\n- Understanding of log formats (EVTX, syslog, JSON, CSV)\n- NTP-synchronized timestamps across all log sources for correlation\n- Sufficient storage for log aggregation and indexing\n- Timeline analysis tools (log2timeline, Plaso)\n\n## Workflow\n\n### Step 1: Collect and Preserve Log Sources\n\n```bash\n# Create case log directory structure\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Flogs\u002F{windows,linux,network,application,web}\n\n# Extract Windows Event Logs from forensic image\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\u002F*.evtx \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fwindows\u002F\n\n# Key Windows Event Logs to collect\n# Security.evtx - Authentication, access control, policy changes\n# System.evtx - Service starts\u002Fstops, driver loads, system errors\n# Application.evtx - Application errors and events\n# Microsoft-Windows-PowerShell%4Operational.evtx - PowerShell execution\n# Microsoft-Windows-Sysmon%4Operational.evtx - Sysmon detailed events\n# Microsoft-Windows-TaskScheduler%4Operational.evtx - Scheduled tasks\n# Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx - RDP\n\n# Collect Linux logs\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fauth.log* \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fsyslog* \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fkern.log* \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fsecure* \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Faudit\u002Faudit.log* \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002F\n\n# Collect web server logs\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fapache2\u002Faccess.log* \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fweb\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fnginx\u002Faccess.log* \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fweb\u002F\n\n# Hash all collected logs for integrity\nfind \u002Fcases\u002Fcase-2024-001\u002Flogs\u002F -type f -exec sha256sum {} \\; > \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flog_hashes.txt\n```\n\n### Step 2: Parse Windows Event Logs\n\n```bash\n# Install python-evtx for EVTX parsing\npip install python-evtx\n\n# Convert EVTX to XML\u002FJSON for analysis\npython3 -c \"\nimport Evtx.Evtx as evtx\nimport json, xml.etree.ElementTree as ET\n\nwith evtx.Evtx('\u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fwindows\u002FSecurity.evtx') as log:\n    for record in log.records():\n        print(record.xml())\n\" > \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fwindows\u002FSecurity_parsed.xml\n\n# Using evtxexport (libevtx-utils)\nsudo apt-get install libevtx-utils\nevtxexport \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fwindows\u002FSecurity.evtx \\\n   > \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fwindows\u002FSecurity_exported.txt\n\n# Key Security Event IDs to investigate\n# 4624 - Successful logon\n# 4625 - Failed logon\n# 4648 - Logon using explicit credentials (runas, lateral movement)\n# 4672 - Special privileges assigned (admin logon)\n# 4688 - Process creation (with command line if auditing enabled)\n# 4697 - Service installed\n# 4698\u002F4702 - Scheduled task created\u002Fupdated\n# 4720 - User account created\n# 4732 - Member added to security-enabled local group\n# 1102 - Audit log cleared\n\n# Extract specific events with python-evtx\npython3 \u003C\u003C 'PYEOF'\nimport Evtx.Evtx as evtx\nimport xml.etree.ElementTree as ET\n\ntarget_events = ['4624', '4625', '4648', '4672', '4688', '4697', '1102']\n\nwith evtx.Evtx('\u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fwindows\u002FSecurity.evtx') as log:\n    for record in log.records():\n        root = ET.fromstring(record.xml())\n        ns = {'ns': 'http:\u002F\u002Fschemas.microsoft.com\u002Fwin\u002F2004\u002F08\u002Fevents\u002Fevent'}\n        event_id = root.find('.\u002F\u002Fns:EventID', ns).text\n        if event_id in target_events:\n            time = root.find('.\u002F\u002Fns:TimeCreated', ns).get('SystemTime')\n            print(f\"[{time}] EventID: {event_id}\")\n            for data in root.findall('.\u002F\u002Fns:Data', ns):\n                print(f\"  {data.get('Name')}: {data.text}\")\n            print()\nPYEOF\n```\n\n### Step 3: Parse and Analyze Linux\u002FSyslog Entries\n\n```bash\n# Parse auth.log for SSH and sudo events\ngrep -E '(sshd|sudo|su\\[|passwd|useradd|usermod)' \\\n   \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002Fauth.log* | \\\n   sort > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fauth_events.txt\n\n# Extract failed SSH login attempts\ngrep 'Failed password' \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002Fauth.log* | \\\n   awk '{print $1,$2,$3,$9,$11}' | sort | uniq -c | sort -rn \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Ffailed_ssh.txt\n\n# Extract successful SSH logins\ngrep 'Accepted' \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002Fauth.log* | \\\n   awk '{print $1,$2,$3,$9,$11}' > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsuccessful_ssh.txt\n\n# Parse audit logs for file access and command execution\nausearch -if \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002Faudit.log \\\n   --start 2024-01-15 --end 2024-01-20 \\\n   -m EXECVE > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Faudit_commands.txt\n\nausearch -if \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Flinux\u002Faudit.log \\\n   -m USER_AUTH,USER_LOGIN,USER_CMD \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Faudit_auth.txt\n\n# Parse web access logs for suspicious requests\ncat \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fweb\u002Faccess.log* | \\\n   grep -iE '(union.*select|\u003Cscript|\\.\\.\\\u002F|cmd\\.exe|\u002Fetc\u002Fpasswd)' \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fweb_attacks.txt\n\n# Extract unique IP addresses from web logs\nawk '{print $1}' \u002Fcases\u002Fcase-2024-001\u002Flogs\u002Fweb\u002Faccess.log* | \\\n   sort | uniq -c | sort -rn > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fweb_ips.txt\n```\n\n### Step 4: Correlate Events Across Sources\n\n```bash\n# Normalize timestamps and merge log sources\npython3 \u003C\u003C 'PYEOF'\nimport csv\nimport datetime\nfrom collections import defaultdict\n\nevents = []\n\n# Parse Windows Security events (pre-exported to CSV)\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fwindows_events.csv') as f:\n    reader = csv.DictReader(f)\n    for row in reader:\n        events.append({\n            'timestamp': row['TimeCreated'],\n            'source': 'Windows-Security',\n            'event_id': row['EventID'],\n            'description': row['Description'],\n            'details': row.get('Details', '')\n        })\n\n# Parse Linux auth events\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fauth_events.txt') as f:\n    for line in f:\n        parts = line.strip().split()\n        if len(parts) >= 6:\n            events.append({\n                'timestamp': ' '.join(parts[:3]),\n                'source': 'Linux-Auth',\n                'event_id': parts[4].rstrip(':'),\n                'description': ' '.join(parts[5:]),\n                'details': ''\n            })\n\n# Sort by timestamp\nevents.sort(key=lambda x: x['timestamp'])\n\n# Write correlated timeline\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcorrelated_timeline.csv', 'w', newline='') as f:\n    writer = csv.DictWriter(f, fieldnames=['timestamp', 'source', 'event_id', 'description', 'details'])\n    writer.writeheader()\n    writer.writerows(events)\n\nprint(f\"Total correlated events: {len(events)}\")\nPYEOF\n\n# Quick correlation: find events within time windows\n# Look for lateral movement patterns\ngrep \"4648\\|4624.*Type.*3\\|4624.*Type.*10\" \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fwindows_events.csv | \\\n   sort > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flateral_movement.txt\n```\n\n### Step 5: Generate Forensic Timeline Report\n\n```bash\n# Create structured investigation report\ncat \u003C\u003C 'REPORT' > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flog_analysis_report.txt\nLOG ANALYSIS FORENSIC REPORT\n=============================\nCase: 2024-001\nAnalyst: [Examiner Name]\nDate: $(date -u)\n\nLOG SOURCES ANALYZED:\n- Windows Security Event Log (Security.evtx) - 245,678 events\n- Windows System Event Log (System.evtx) - 45,234 events\n- Windows PowerShell Operational - 12,456 events\n- Linux auth.log - 34,567 entries\n- Apache access.log - 567,890 entries\n- Linux audit.log - 89,012 entries\n\nKEY FINDINGS:\n1. Initial Access: [timestamp] - Successful RDP login from external IP\n2. Privilege Escalation: [timestamp] - New admin account created\n3. Lateral Movement: [timestamp] - Pass-the-hash detected across 3 systems\n4. Data Exfiltration: [timestamp] - Large data transfer to external IP\n5. Log Tampering: [timestamp] - Security event log cleared (Event 1102)\n\nTIMELINE OF EVENTS:\n[See correlated_timeline.csv for complete chronology]\nREPORT\n\n# Package analysis artifacts\ntar -czf \u002Fcases\u002Fcase-2024-001\u002Flog_analysis_package.tar.gz \\\n   \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002F\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Event correlation | Linking related events across multiple log sources by time, IP, user, or session |\n| Log normalization | Converting diverse log formats into a common schema for unified analysis |\n| Timeline analysis | Chronological ordering of events to reconstruct incident sequence |\n| Log integrity | Verifying logs have not been tampered with using hashes and chain of custody |\n| Logon types | Windows categorization of authentication methods (2=interactive, 3=network, 10=RDP) |\n| Audit policy | System configuration determining which events are recorded in logs |\n| Log rotation | Automatic archiving of log files that affects evidence availability |\n| Anti-forensics | Attacker techniques for clearing or modifying logs to cover tracks |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| python-evtx | Python library for parsing Windows EVTX event log files |\n| evtxexport | Command-line EVTX export utility from libevtx |\n| LogParser | Microsoft SQL-like query engine for Windows logs |\n| ausearch | Linux audit log search utility |\n| jq | JSON query tool for parsing structured log formats |\n| ELK Stack | Elasticsearch, Logstash, Kibana for log aggregation and visualization |\n| Chainsaw | Sigma-based Windows Event Log analysis tool |\n| Hayabusa | Fast Windows Event Log forensic timeline generator |\n\n## Common Scenarios\n\n**Scenario 1: Brute Force Attack Detection**\nFilter Security.evtx for Event ID 4625 (failed logons), group by source IP and target account, identify patterns of rapid successive failures, find the successful logon (4624) that followed, trace subsequent activity from the compromised account.\n\n**Scenario 2: Insider Threat Investigation**\nCollect all log sources from the suspect's workstation and accessed servers, correlate file access events with authentication events, build timeline of data access during non-business hours, identify data transfers to external media or cloud storage.\n\n**Scenario 3: Web Application Compromise**\nParse web server access logs for SQLi, XSS, and path traversal patterns, identify the attack IP and timeline, correlate with application logs for successful exploitation, trace post-exploitation activity through system and auth logs.\n\n**Scenario 4: Ransomware Incident Timeline**\nIdentify the initial execution through process creation events (4688), trace privilege escalation through service installation (4697), map lateral movement via network logons (4624 Type 3), identify encryption start from file system activity, find the earliest IoC for remediation scoping.\n\n## Output Format\n\n```\nLog Analysis Summary:\n  Investigation Period: 2024-01-15 00:00 to 2024-01-20 23:59 UTC\n  Total Events Analyzed: 894,567\n  Log Sources: 6 (3 Windows, 3 Linux)\n\n  Critical Events:\n    Failed Logons:       1,234 (from 5 unique IPs)\n    Successful Logons:   456 (3 anomalous)\n    Account Changes:     12 (1 unauthorized admin creation)\n    Process Creations:   8,234 (15 suspicious)\n    Log Clearings:       2 (Security log cleared at 2024-01-18 03:00 UTC)\n    Service Installs:    3 (1 unknown service)\n\n  Attack Timeline:\n    2024-01-15 14:32 - Initial access via RDP brute force\n    2024-01-15 14:45 - Admin account \"svcbackup\" created\n    2024-01-16 02:15 - Lateral movement to 3 servers\n    2024-01-17 03:00 - Data staging in C:\\ProgramData\\temp\\\n    2024-01-18 01:30 - 4.2 GB exfiltrated to 185.x.x.x\n    2024-01-18 03:00 - Security logs cleared\n\n  Report: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flog_analysis_report.txt\n```\n",{"name":5,"tags":47,"author":48,"domain":41,"license":15,"version":49,"nist_csf":50,"subdomain":27,"description":7,"mitre_attack":54},[37,36,40,31,35,34],"mahipal","1.0",[51,52,53],"RS.AN-03","DE.AE-02","RS.MA-01",[55,56,57,58,59],"T1005","T1074","T1119","T1070","T1685.002","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-log-analysis-for-forensic-investigation",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":71,"prompt":81,"zipAvailable":82},[72,75,78],{"tool":73,"command":74},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-log-analysis-for-forensic-investigation",{"tool":76,"command":77},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-log-analysis-for-forensic-investigation",{"tool":79,"command":80},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-log-analysis-for-forensic-investigation","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-log-analysis-for-forensic-investigation\u002FSKILL.md",true,[84,90,94,99,105],{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"assets\u002Ffonts\u002Ffraunces-latin-600-normal.woff2","ASSET","资产文件",18096,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fsynced\u002Ffcfa9261-0073-49cb-8312-19eea68f0c58_391f3767-a35d-4280-81a1-363cd861a8e6\u002Fmorning\u002Fassets\u002Ffonts\u002Ffraunces-latin-600-normal.woff2",{"path":91,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":92,"sourceHtmlUrl":93},"assets\u002Ffonts\u002FFraunces-OFL.txt",4483,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fsynced\u002Ffcfa9261-0073-49cb-8312-19eea68f0c58_391f3767-a35d-4280-81a1-363cd861a8e6\u002Fmorning\u002Fassets\u002Ffonts\u002FFraunces-OFL.txt",{"path":95,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-log-analysis-for-forensic-investigation\u002FLICENSE",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fapi-reference.md","REFERENCE","参考文档",1861,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-log-analysis-for-forensic-investigation\u002Freferences\u002Fapi-reference.md",{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"scripts\u002Fagent.py","SCRIPT","脚本",8548,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-log-analysis-for-forensic-investigation\u002Fscripts\u002Fagent.py",[112,138,162,190,213,240],{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":119,"publishedAt":42},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[118],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[120,121,122,123,33,41,124,125,126,127,128,129,130,131,132,133,134,135,136,137],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":145,"publishedAt":42},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[144],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[146,134,147,148,33,149,41,126,150,151,152,153,154,155,156,157,158,159,160,161],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":172,"publishedAt":42},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[168,171],{"categoryNo":169,"categoryName":170,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[156,173,174,175,176,41,177,178,150,179,180,181,182,183,184,185,186,187,188,189],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":197,"publishedAt":42},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[196],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[198,199,200,41,201,202,38,203,204,205,206,207,208,209,27,210,153,28,211,212],"windows","kape","triaging windows with kape","registry","browser","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","SET","pecmd","artifact-collection",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":220,"publishedAt":42},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[219],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[221,222,223,41,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":241,"name":242,"nameZh":6,"description":243,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":244,"categories":245,"keywords":247,"publishedAt":42},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[246],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[33,248,41,40,249,250,251,252,253,254,255,185,256,186,26,257,258,259,260,261],"triaging security incident","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]