[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ESRGGEW237CPR8NNYARJNN":3,"skill-same:01M6ESRGGEW237CPR8NNYARJNN":125},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":86,"commitSha":87,"skillDirectory":88,"forksCount":14,"repositoryHtmlUrl":89,"repositoryHomepageUrl":90,"ownerHtmlUrl":91,"ownerBlogUrl":6,"ownerDescription":92,"updatedAt":93,"install":94,"resources":107},"01M6ESRGGEW237CPR8NNYARJNN","analyzing-security-logs-with-splunk",null,"Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. Covers Windows event logs, firewall logs, proxy logs, and authentication data analysis. Activates for requests involving Splunk investigation, SPL queries, SIEM log analysis, security event correlation, or log-based incident investigation.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-security-logs-with-splunk\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000013","分析与可视化","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"analyzing security logs with splunk","with","analyzing security","analyzing","splunk","logs","security","search","log-analysis","authentication","T1059.001","data analysis","firewall","analysis","aml","log analysis","cybersecurity","incident","map","processing","2026-11-10 10:12:30",false,"---\nname: analyzing-security-logs-with-splunk\ndescription: 'Leverages Splunk Enterprise Security and SPL (Search Processing Language)\n  to investigate security incidents through log correlation, timeline reconstruction,\n  and anomaly detection. Covers Windows event logs, firewall logs, proxy logs, and\n  authentication data analysis. Activates for requests involving Splunk investigation,\n  SPL queries, SIEM log analysis, security event correlation, or log-based incident\n  investigation.\n\n  '\ndomain: cybersecurity\nsubdomain: incident-response\ntags:\n- splunk\n- SPL\n- SIEM\n- log-analysis\n- security-monitoring\nmitre_attack:\n- T1110\n- T1550.002\n- T1021.001\n- T1059.001\n- T1003.001\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\n- MANAGE-3.1\n- MEASURE-3.1\nnist_csf:\n- RS.MA-01\n- RS.MA-02\n- RS.AN-03\n- RC.RP-01\n---\n\n# Analyzing Security Logs with Splunk\n\n## When to Use\n\n- Investigating a security incident that requires correlation across multiple log sources\n- Hunting for adversary activity using known TTPs and IOCs\n- Building detection rules for specific attack patterns\n- Reconstructing an incident timeline from disparate log sources\n- Analyzing authentication anomalies, lateral movement, or data exfiltration patterns\n\n**Do not use** for real-time packet-level analysis; use Wireshark or Zeek for full packet capture analysis.\n\n## Prerequisites\n\n- Splunk Enterprise or Splunk Cloud with Enterprise Security (ES) app installed\n- Log sources ingested: Windows Event Logs (via Splunk Universal Forwarder or WEF), firewall, proxy, DNS, EDR, email gateway\n- Splunk CIM (Common Information Model) data models configured for normalized field names\n- SPL proficiency at intermediate level or higher\n- Role-based access with `search` and `accelerate_search` capabilities in Splunk\n\n## Workflow\n\n### Step 1: Scope the Investigation in Splunk\n\nDefine search parameters based on incident triage data:\n\n```spl\n| Set initial investigation scope\nindex=windows OR index=firewall OR index=proxy\n  earliest=\"2025-11-14T00:00:00\" latest=\"2025-11-16T00:00:00\"\n  (host=\"WKSTN-042\" OR src_ip=\"10.1.5.42\" OR user=\"jsmith\")\n| stats count by index, sourcetype, host\n| sort -count\n```\n\nThis query establishes which log sources contain relevant data for the investigation timeframe and affected assets.\n\n### Step 2: Analyze Authentication Events\n\nInvestigate suspicious authentication patterns using Windows Security Event Logs:\n\n```spl\n| Detect brute force and credential stuffing\nindex=windows sourcetype=\"WinEventLog:Security\" EventCode=4625\n  earliest=-24h\n| stats count as failed_attempts, values(src_ip) as source_ips,\n  dc(src_ip) as unique_sources by TargetUserName\n| where failed_attempts > 10\n| sort -failed_attempts\n\n| Detect pass-the-hash (Logon Type 9 - NewCredentials)\nindex=windows sourcetype=\"WinEventLog:Security\" EventCode=4624\n  Logon_Type=9\n| table _time, host, TargetUserName, src_ip, LogonProcessName\n\n| Detect lateral movement via RDP\nindex=windows sourcetype=\"WinEventLog:Security\" EventCode=4624\n  Logon_Type=10\n| stats count, values(host) as targets by TargetUserName, src_ip\n| where count > 3\n| sort -count\n```\n\n### Step 3: Trace Process Execution\n\nUse Sysmon logs to reconstruct process execution chains:\n\n```spl\n| Process creation with parent chain (Sysmon Event ID 1)\nindex=sysmon EventCode=1 host=\"WKSTN-042\"\n  earliest=\"2025-11-15T14:00:00\" latest=\"2025-11-15T15:00:00\"\n| table _time, ParentImage, ParentCommandLine, Image, CommandLine, User, Hashes\n| sort _time\n\n| Detect suspicious PowerShell execution\nindex=sysmon EventCode=1 Image=\"*\\\\powershell.exe\"\n  (CommandLine=\"*-enc*\" OR CommandLine=\"*-encodedcommand*\"\n   OR CommandLine=\"*downloadstring*\" OR CommandLine=\"*iex*\")\n| table _time, host, User, ParentImage, CommandLine\n| sort _time\n\n| Detect LSASS credential dumping\nindex=sysmon EventCode=10 TargetImage=\"*\\\\lsass.exe\"\n  GrantedAccess=0x1010\n| table _time, host, SourceImage, SourceUser, GrantedAccess\n```\n\n### Step 4: Analyze Network Activity\n\nCorrelate network logs with endpoint events:\n\n```spl\n| Detect C2 beaconing pattern\nindex=proxy OR index=firewall dest_ip=\"185.220.101.42\"\n| timechart span=1m count by src_ip\n| where count > 0\n\n| Detect DNS tunneling (high query volume to single domain)\nindex=dns\n| rex field=query \"(?\u003Csubdomain>[^\\.]+)\\.(?\u003Cdomain>[^\\.]+\\.[^\\.]+)$\"\n| stats count, avg(len(query)) as avg_query_len by domain, src_ip\n| where count > 500 AND avg_query_len > 40\n| sort -count\n\n| Detect large data transfers (potential exfiltration)\nindex=proxy action=allowed\n| stats sum(bytes_out) as total_bytes by src_ip, dest_ip, dest_host\n| eval total_MB=round(total_bytes\u002F1024\u002F1024,2)\n| where total_MB > 100\n| sort -total_MB\n```\n\n### Step 5: Build the Incident Timeline\n\nReconstruct a unified timeline across all log sources:\n\n```spl\n| Unified incident timeline\nindex=windows OR index=sysmon OR index=proxy OR index=firewall\n  (host=\"WKSTN-042\" OR src_ip=\"10.1.5.42\" OR user=\"jsmith\")\n  earliest=\"2025-11-15T14:00:00\" latest=\"2025-11-15T16:00:00\"\n| eval event_summary=case(\n    sourcetype==\"WinEventLog:Security\" AND EventCode==4624, \"Logon: \".TargetUserName.\" from \".src_ip,\n    sourcetype==\"WinEventLog:Security\" AND EventCode==4625, \"Failed logon: \".TargetUserName,\n    sourcetype==\"XmlWinEventLog:Microsoft-Windows-Sysmon\u002FOperational\" AND EventCode==1,\n      \"Process: \".Image.\" by \".User,\n    sourcetype==\"proxy\", \"Web: \".http_method.\" \".url,\n    1==1, sourcetype.\": \".EventCode)\n| table _time, sourcetype, host, event_summary\n| sort _time\n```\n\n### Step 6: Create Detection Rules\n\nConvert investigation findings into persistent Splunk correlation searches:\n\n```spl\n| Correlation search: PowerShell spawned by Office applications\nindex=sysmon EventCode=1\n  Image=\"*\\\\powershell.exe\"\n  (ParentImage=\"*\\\\winword.exe\" OR ParentImage=\"*\\\\excel.exe\"\n   OR ParentImage=\"*\\\\outlook.exe\")\n| eval severity=\"high\"\n| eval mitre_technique=\"T1059.001\"\n| collect index=notable_events\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **SPL (Search Processing Language)** | Splunk's query language for searching, filtering, transforming, and visualizing machine data |\n| **CIM (Common Information Model)** | Splunk's field normalization standard that maps vendor-specific field names to common names for cross-source queries |\n| **Notable Event** | An event in Splunk Enterprise Security flagged for analyst review based on a correlation search match |\n| **Data Model** | Structured representation of indexed data in Splunk enabling accelerated searches and pivot-based analysis |\n| **Sourcetype** | Classification label in Splunk that defines the format and parsing rules for a specific log type |\n| **Correlation Search** | Scheduled Splunk search that runs continuously and generates notable events when conditions are met |\n| **Timechart** | SPL command that creates time-series visualizations for identifying patterns, anomalies, and trends |\n\n## Tools & Systems\n\n- **Splunk Enterprise Security (ES)**: Premium SIEM application providing correlation searches, risk-based alerting, and investigation workbench\n- **Splunk SOAR**: Orchestration platform integrated with Splunk ES for automated response playbooks\n- **Sysmon**: Microsoft system monitoring tool providing detailed process, network, and file change telemetry ingested into Splunk\n- **Splunk Attack Analyzer**: Automated threat analysis that detonates suspicious files and URLs, feeding results into Splunk\n- **BOSS of the SOC (BOTS)**: SANS\u002FSplunk training dataset for practicing incident investigation SPL queries\n\n## Common Scenarios\n\n### Scenario: Investigating Credential Stuffing Leading to Account Takeover\n\n**Context**: Security operations receives an alert for multiple successful logins to a single account from geographically dispersed IP addresses within a 30-minute window.\n\n**Approach**:\n1. Query Event ID 4624 for the affected account to map all login sources and times\n2. Correlate login IPs against threat intelligence feeds using a Splunk lookup table\n3. Check proxy logs for suspicious activity from the authenticated sessions\n4. Search for lateral movement from the compromised account (Event ID 4624 Type 3 to other hosts)\n5. Build a timeline showing credential stuffing attempts, successful login, and post-compromise activity\n6. Create a correlation search to detect similar patterns on other accounts\n\n**Pitfalls**:\n- Searching only the last 24 hours when the credential stuffing may have occurred over weeks\n- Not checking for VPN logs that may show the same account authenticating from impossible travel distances\n- Failing to normalize timestamps across log sources in different time zones\n\n## Output Format\n\n```\nSPLUNK INVESTIGATION REPORT\n============================\nIncident:        INC-2025-1547\nAnalyst:         [Name]\nInvestigation Period: 2025-11-14 00:00 UTC - 2025-11-16 00:00 UTC\n\nSEARCH SCOPE\nIndexes:         windows, sysmon, proxy, firewall, dns\nHosts:           WKSTN-042, SRV-FILE01\nUsers:           jsmith, svc-backup\nSource IPs:      10.1.5.42, 10.1.10.15\n\nKEY FINDINGS\n1. [timestamp] - Initial compromise via phishing (Sysmon Event 1)\n2. [timestamp] - C2 established (proxy logs, beacon pattern detected)\n3. [timestamp] - Credential theft (Sysmon Event 10, LSASS access)\n4. [timestamp] - Lateral movement to SRV-FILE01 (Event 4624 Type 3)\n5. [timestamp] - Data staging and exfiltration (proxy bytes_out anomaly)\n\nSPL QUERIES USED\n[numbered list of key queries with descriptions]\n\nDETECTION GAPS IDENTIFIED\n- No Sysmon deployed on SRV-FILE01 (blind spot)\n- Proxy logs missing SSL inspection for C2 domain\n- PowerShell ScriptBlock logging not enabled\n\nRECOMMENDED DETECTIONS\n1. Correlation search for Office-spawned PowerShell\n2. Threshold alert for LSASS access patterns\n3. Behavioral rule for beacon-interval network traffic\n```\n","# Analyzing Security Logs with Splunk\n\n## When to Use\n\n- Investigating a security incident that requires correlation across multiple log sources\n- Hunting for adversary activity using known TTPs and IOCs\n- Building detection rules for specific attack patterns\n- Reconstructing an incident timeline from disparate log sources\n- Analyzing authentication anomalies, lateral movement, or data exfiltration patterns\n\n**Do not use** for real-time packet-level analysis; use Wireshark or Zeek for full packet capture analysis.\n\n## Prerequisites\n\n- Splunk Enterprise or Splunk Cloud with Enterprise Security (ES) app installed\n- Log sources ingested: Windows Event Logs (via Splunk Universal Forwarder or WEF), firewall, proxy, DNS, EDR, email gateway\n- Splunk CIM (Common Information Model) data models configured for normalized field names\n- SPL proficiency at intermediate level or higher\n- Role-based access with `search` and `accelerate_search` capabilities in Splunk\n\n## Workflow\n\n### Step 1: Scope the Investigation in Splunk\n\nDefine search parameters based on incident triage data:\n\n```spl\n| Set initial investigation scope\nindex=windows OR index=firewall OR index=proxy\n  earliest=\"2025-11-14T00:00:00\" latest=\"2025-11-16T00:00:00\"\n  (host=\"WKSTN-042\" OR src_ip=\"10.1.5.42\" OR user=\"jsmith\")\n| stats count by index, sourcetype, host\n| sort -count\n```\n\nThis query establishes which log sources contain relevant data for the investigation timeframe and affected assets.\n\n### Step 2: Analyze Authentication Events\n\nInvestigate suspicious authentication patterns using Windows Security Event Logs:\n\n```spl\n| Detect brute force and credential stuffing\nindex=windows sourcetype=\"WinEventLog:Security\" EventCode=4625\n  earliest=-24h\n| stats count as failed_attempts, values(src_ip) as source_ips,\n  dc(src_ip) as unique_sources by TargetUserName\n| where failed_attempts > 10\n| sort -failed_attempts\n\n| Detect pass-the-hash (Logon Type 9 - NewCredentials)\nindex=windows sourcetype=\"WinEventLog:Security\" EventCode=4624\n  Logon_Type=9\n| table _time, host, TargetUserName, src_ip, LogonProcessName\n\n| Detect lateral movement via RDP\nindex=windows sourcetype=\"WinEventLog:Security\" EventCode=4624\n  Logon_Type=10\n| stats count, values(host) as targets by TargetUserName, src_ip\n| where count > 3\n| sort -count\n```\n\n### Step 3: Trace Process Execution\n\nUse Sysmon logs to reconstruct process execution chains:\n\n```spl\n| Process creation with parent chain (Sysmon Event ID 1)\nindex=sysmon EventCode=1 host=\"WKSTN-042\"\n  earliest=\"2025-11-15T14:00:00\" latest=\"2025-11-15T15:00:00\"\n| table _time, ParentImage, ParentCommandLine, Image, CommandLine, User, Hashes\n| sort _time\n\n| Detect suspicious PowerShell execution\nindex=sysmon EventCode=1 Image=\"*\\\\powershell.exe\"\n  (CommandLine=\"*-enc*\" OR CommandLine=\"*-encodedcommand*\"\n   OR CommandLine=\"*downloadstring*\" OR CommandLine=\"*iex*\")\n| table _time, host, User, ParentImage, CommandLine\n| sort _time\n\n| Detect LSASS credential dumping\nindex=sysmon EventCode=10 TargetImage=\"*\\\\lsass.exe\"\n  GrantedAccess=0x1010\n| table _time, host, SourceImage, SourceUser, GrantedAccess\n```\n\n### Step 4: Analyze Network Activity\n\nCorrelate network logs with endpoint events:\n\n```spl\n| Detect C2 beaconing pattern\nindex=proxy OR index=firewall dest_ip=\"185.220.101.42\"\n| timechart span=1m count by src_ip\n| where count > 0\n\n| Detect DNS tunneling (high query volume to single domain)\nindex=dns\n| rex field=query \"(?\u003Csubdomain>[^\\.]+)\\.(?\u003Cdomain>[^\\.]+\\.[^\\.]+)$\"\n| stats count, avg(len(query)) as avg_query_len by domain, src_ip\n| where count > 500 AND avg_query_len > 40\n| sort -count\n\n| Detect large data transfers (potential exfiltration)\nindex=proxy action=allowed\n| stats sum(bytes_out) as total_bytes by src_ip, dest_ip, dest_host\n| eval total_MB=round(total_bytes\u002F1024\u002F1024,2)\n| where total_MB > 100\n| sort -total_MB\n```\n\n### Step 5: Build the Incident Timeline\n\nReconstruct a unified timeline across all log sources:\n\n```spl\n| Unified incident timeline\nindex=windows OR index=sysmon OR index=proxy OR index=firewall\n  (host=\"WKSTN-042\" OR src_ip=\"10.1.5.42\" OR user=\"jsmith\")\n  earliest=\"2025-11-15T14:00:00\" latest=\"2025-11-15T16:00:00\"\n| eval event_summary=case(\n    sourcetype==\"WinEventLog:Security\" AND EventCode==4624, \"Logon: \".TargetUserName.\" from \".src_ip,\n    sourcetype==\"WinEventLog:Security\" AND EventCode==4625, \"Failed logon: \".TargetUserName,\n    sourcetype==\"XmlWinEventLog:Microsoft-Windows-Sysmon\u002FOperational\" AND EventCode==1,\n      \"Process: \".Image.\" by \".User,\n    sourcetype==\"proxy\", \"Web: \".http_method.\" \".url,\n    1==1, sourcetype.\": \".EventCode)\n| table _time, sourcetype, host, event_summary\n| sort _time\n```\n\n### Step 6: Create Detection Rules\n\nConvert investigation findings into persistent Splunk correlation searches:\n\n```spl\n| Correlation search: PowerShell spawned by Office applications\nindex=sysmon EventCode=1\n  Image=\"*\\\\powershell.exe\"\n  (ParentImage=\"*\\\\winword.exe\" OR ParentImage=\"*\\\\excel.exe\"\n   OR ParentImage=\"*\\\\outlook.exe\")\n| eval severity=\"high\"\n| eval mitre_technique=\"T1059.001\"\n| collect index=notable_events\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **SPL (Search Processing Language)** | Splunk's query language for searching, filtering, transforming, and visualizing machine data |\n| **CIM (Common Information Model)** | Splunk's field normalization standard that maps vendor-specific field names to common names for cross-source queries |\n| **Notable Event** | An event in Splunk Enterprise Security flagged for analyst review based on a correlation search match |\n| **Data Model** | Structured representation of indexed data in Splunk enabling accelerated searches and pivot-based analysis |\n| **Sourcetype** | Classification label in Splunk that defines the format and parsing rules for a specific log type |\n| **Correlation Search** | Scheduled Splunk search that runs continuously and generates notable events when conditions are met |\n| **Timechart** | SPL command that creates time-series visualizations for identifying patterns, anomalies, and trends |\n\n## Tools & Systems\n\n- **Splunk Enterprise Security (ES)**: Premium SIEM application providing correlation searches, risk-based alerting, and investigation workbench\n- **Splunk SOAR**: Orchestration platform integrated with Splunk ES for automated response playbooks\n- **Sysmon**: Microsoft system monitoring tool providing detailed process, network, and file change telemetry ingested into Splunk\n- **Splunk Attack Analyzer**: Automated threat analysis that detonates suspicious files and URLs, feeding results into Splunk\n- **BOSS of the SOC (BOTS)**: SANS\u002FSplunk training dataset for practicing incident investigation SPL queries\n\n## Common Scenarios\n\n### Scenario: Investigating Credential Stuffing Leading to Account Takeover\n\n**Context**: Security operations receives an alert for multiple successful logins to a single account from geographically dispersed IP addresses within a 30-minute window.\n\n**Approach**:\n1. Query Event ID 4624 for the affected account to map all login sources and times\n2. Correlate login IPs against threat intelligence feeds using a Splunk lookup table\n3. Check proxy logs for suspicious activity from the authenticated sessions\n4. Search for lateral movement from the compromised account (Event ID 4624 Type 3 to other hosts)\n5. Build a timeline showing credential stuffing attempts, successful login, and post-compromise activity\n6. Create a correlation search to detect similar patterns on other accounts\n\n**Pitfalls**:\n- Searching only the last 24 hours when the credential stuffing may have occurred over weeks\n- Not checking for VPN logs that may show the same account authenticating from impossible travel distances\n- Failing to normalize timestamps across log sources in different time zones\n\n## Output Format\n\n```\nSPLUNK INVESTIGATION REPORT\n============================\nIncident:        INC-2025-1547\nAnalyst:         [Name]\nInvestigation Period: 2025-11-14 00:00 UTC - 2025-11-16 00:00 UTC\n\nSEARCH SCOPE\nIndexes:         windows, sysmon, proxy, firewall, dns\nHosts:           WKSTN-042, SRV-FILE01\nUsers:           jsmith, svc-backup\nSource IPs:      10.1.5.42, 10.1.10.15\n\nKEY FINDINGS\n1. [timestamp] - Initial compromise via phishing (Sysmon Event 1)\n2. [timestamp] - C2 established (proxy logs, beacon pattern detected)\n3. [timestamp] - Credential theft (Sysmon Event 10, LSASS access)\n4. [timestamp] - Lateral movement to SRV-FILE01 (Event 4624 Type 3)\n5. [timestamp] - Data staging and exfiltration (proxy bytes_out anomaly)\n\nSPL QUERIES USED\n[numbered list of key queries with descriptions]\n\nDETECTION GAPS IDENTIFIED\n- No Sysmon deployed on SRV-FILE01 (blind spot)\n- Proxy logs missing SSL inspection for C2 domain\n- PowerShell ScriptBlock logging not enabled\n\nRECOMMENDED DETECTIONS\n1. Correlation search for Office-spawned PowerShell\n2. Threshold alert for LSASS access patterns\n3. Behavioral rule for beacon-interval network traffic\n```\n",{"name":5,"tags":52,"author":56,"domain":43,"license":15,"version":57,"nist_csf":58,"subdomain":63,"description":64,"nist_ai_rmf":65,"mitre_attack":71,"atlas_techniques":76,"d3fend_techniques":80},[31,53,54,35,55],"SPL","SIEM","security-monitoring","mahipal","1.0.0",[59,60,61,62],"RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01","incident-response","Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. Covers Windows event logs, firewall logs, proxy logs, and authentication data analysis. Activates for requests involving Splunk investigation, SPL queries, SIEM log analysis, security event correlation, or log-based incident investigation.\n",[66,67,68,69,70],"MEASURE-2.7","MAP-5.1","MANAGE-2.4","MANAGE-3.1","MEASURE-3.1",[72,73,74,37,75],"T1110","T1550.002","T1021.001","T1003.001",[77,78,79],"AML.T0070","AML.T0066","AML.T0082",[81,82,83,84,85],"Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fanalyzing-security-logs-with-splunk","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":95,"prompt":105,"zipAvailable":106},[96,99,102],{"tool":97,"command":98},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill analyzing-security-logs-with-splunk",{"tool":100,"command":101},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill analyzing-security-logs-with-splunk",{"tool":103,"command":104},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill analyzing-security-logs-with-splunk","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-security-logs-with-splunk\u002FSKILL.md",true,[108,113,119],{"path":109,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":111,"sourceHtmlUrl":112},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-security-logs-with-splunk\u002FLICENSE",{"path":114,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":117,"sourceHtmlUrl":118},"references\u002Fapi-reference.md","REFERENCE","参考文档",2610,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-security-logs-with-splunk\u002Freferences\u002Fapi-reference.md",{"path":120,"resourceType":121,"resourceTypeDesc":122,"sizeBytes":123,"sourceHtmlUrl":124},"scripts\u002Fagent.py","SCRIPT","脚本",6590,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-security-logs-with-splunk\u002Fscripts\u002Fagent.py",[126,166,175,184,206,231],{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":147,"publishedAt":47},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[133,136,139,142],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":143,"categoryName":144,"taxonomyType":145,"taxonomyTypeDesc":146},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[128,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,28],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube",{"skillNo":167,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":174,"publishedAt":47},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[170,171,172,173],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":143,"categoryName":144,"taxonomyType":145,"taxonomyTypeDesc":146},[128,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,28],{"skillNo":176,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":183,"publishedAt":47},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[179,180,181,182],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":143,"categoryName":144,"taxonomyType":145,"taxonomyTypeDesc":146},[128,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,28],{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":190,"publishedAt":47},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[191,192,193,194,195,196,197,198,199,200,201,202,203,204,205],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":213,"publishedAt":47},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[212],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[214,215,216,217,218,219,40,220,221,222,223,159,160,224,225,226,227,228,229,230],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":235,"categories":236,"keywords":247,"publishedAt":47},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[237,240,243,244],{"categoryNo":238,"categoryName":239,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":241,"categoryName":242,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":245,"categoryName":246,"taxonomyType":145,"taxonomyTypeDesc":146},"01JBSEEDCAT000000000000036","内容创作者",[248,249,250,251,252,253,254,255,156,256,159,160,161,257,258,259,260,261,205,262],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]