[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVY3FDH31RBHRAS55SHMRV":3,"skill-same:01M6EVY3FDH31RBHRAS55SHMRV":120},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":14,"repositoryHtmlUrl":66,"repositoryHomepageUrl":67,"ownerHtmlUrl":68,"ownerBlogUrl":6,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M6EVY3FDH31RBHRAS55SHMRV","performing-log-source-onboarding-in-siem",null,"Perform structured log source onboarding into SIEM platforms by configuring collectors, parsers, normalization, and validation for complete security visibility.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-log-source-onboarding-in-siem\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"siem","onboarding","log","performing log source onboarding in siem","data-ingestion","de","cm","ingestion","parsers","SOC-operations","normalization","parsing","security","log-onboarding","log-management","t1566","t1078","data","soc","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-log-source-onboarding-in-siem\ndescription: Perform structured log source onboarding into SIEM platforms by configuring\n  collectors, parsers, normalization, and validation for complete security visibility.\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- siem\n- log-onboarding\n- log-management\n- data-ingestion\n- parsing\n- normalization\n- soc\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1078\n- T1685.002\n- T1685.005\n- T1566\n---\n\n# Performing Log Source Onboarding in SIEM\n\n## Overview\n\nLog source onboarding is the systematic process of integrating new data sources into a SIEM platform to enable security monitoring and detection. Proper onboarding requires planning data sources, configuring collection agents, building parsers, normalizing fields to a common schema, and validating data quality. According to the UK NCSC, onboarding should prioritize log sources that provide the highest security value relative to their ingestion cost.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing log source onboarding in siem\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- SIEM platform deployed (Splunk, Elastic, Sentinel, QRadar, or similar)\n- Network access from source systems to SIEM collectors\n- Administrative access on source systems for agent installation\n- Common Information Model (CIM) or equivalent schema documentation\n- Change management approval for production system modifications\n\n## Log Source Priority Framework\n\n### Tier 1 - Critical (Onboard First)\n\n| Source | Log Type | Security Value |\n|---|---|---|\n| Active Directory | Security Event Logs | Authentication, privilege escalation |\n| Firewalls | Traffic logs | Network access, C2 detection |\n| EDR\u002FAV | Endpoint alerts | Malware, process execution |\n| VPN\u002FRemote Access | Connection logs | Unauthorized access |\n| DNS Servers | Query logs | C2 beaconing, data exfiltration |\n| Email Gateway | Email security logs | Phishing, BEC |\n\n### Tier 2 - High Priority\n\n| Source | Log Type | Security Value |\n|---|---|---|\n| Web Proxy | HTTP\u002FHTTPS logs | Web-based attacks, data exfiltration |\n| Cloud platforms (AWS\u002FAzure\u002FGCP) | Audit logs | Cloud security posture |\n| Database servers | Audit\u002Fquery logs | Data access, SQL injection |\n| DHCP\u002FIPAM | Address allocation | Asset tracking |\n| File servers | Access logs | Data access monitoring |\n\n### Tier 3 - Standard\n\n| Source | Log Type | Security Value |\n|---|---|---|\n| Application servers | App logs | Application-level attacks |\n| Print servers | Print logs | Data loss prevention |\n| Badge\u002Fphysical access | Access logs | Physical security correlation |\n| Network devices (switches\u002Frouters) | Syslog | Network anomalies |\n\n## Onboarding Process\n\n### Step 1: Discovery and Assessment\n\n```\n1. Identify the log source:\n   - System type and version\n   - Log format (syslog, CEF, JSON, Windows Events, etc.)\n   - Log volume estimate (EPS - events per second)\n   - Network location and firewall requirements\n\n2. Assess security value:\n   - What threats can this source help detect?\n   - Which MITRE ATT&CK techniques does it cover?\n   - Is there an existing SIEM parser?\n\n3. Estimate ingestion cost:\n   - Daily volume in GB\n   - License impact (per-GB or per-EPS pricing)\n   - Storage retention requirements\n```\n\n### Step 2: Configure Log Collection\n\n#### Syslog-Based Collection (Firewalls, Network Devices)\n\n```conf\n# rsyslog configuration for receiving syslog\n# \u002Fetc\u002Frsyslog.d\u002F10-siem-collection.conf\n\n# UDP reception\nmodule(load=\"imudp\")\ninput(type=\"imudp\" port=\"514\" ruleset=\"siem_forwarding\")\n\n# TCP reception\nmodule(load=\"imtcp\")\ninput(type=\"imtcp\" port=\"514\" ruleset=\"siem_forwarding\")\n\n# TLS reception\nmodule(load=\"imtcp\" StreamDriver.AuthMode=\"x509\u002Fname\"\n       StreamDriver.Mode=\"1\" StreamDriver.Name=\"gtls\")\ninput(type=\"imtcp\" port=\"6514\" ruleset=\"siem_forwarding\")\n\nruleset(name=\"siem_forwarding\") {\n    # Forward to SIEM\n    action(type=\"omfwd\" target=\"siem.company.com\" port=\"9514\"\n           protocol=\"tcp\" queue.type=\"LinkedList\"\n           queue.filename=\"siem_fwd\" queue.maxdiskspace=\"1g\"\n           queue.saveonshutdown=\"on\" action.resumeRetryCount=\"-1\")\n}\n```\n\n#### Windows Event Log Collection (Splunk Universal Forwarder)\n\n```conf\n# inputs.conf on Splunk Universal Forwarder\n[WinEventLog:\u002F\u002FSecurity]\ndisabled = 0\nindex = wineventlog\nsourcetype = WinEventLog:Security\nevt_resolve_ad_obj = 1\ncheckpointInterval = 5\n\n[WinEventLog:\u002F\u002FSystem]\ndisabled = 0\nindex = wineventlog\nsourcetype = WinEventLog:System\n\n[WinEventLog:\u002F\u002FMicrosoft-Windows-Sysmon\u002FOperational]\ndisabled = 0\nindex = wineventlog\nsourcetype = XmlWinEventLog:Microsoft-Windows-Sysmon\u002FOperational\nrenderXml = true\n\n[WinEventLog:\u002F\u002FMicrosoft-Windows-PowerShell\u002FOperational]\ndisabled = 0\nindex = wineventlog\nsourcetype = XmlWinEventLog:Microsoft-Windows-PowerShell\u002FOperational\n```\n\n#### Cloud Log Collection (AWS CloudTrail)\n\n```json\n{\n  \"AWSTemplateFormatVersion\": \"2010-09-09\",\n  \"Resources\": {\n    \"CloudTrailToSIEM\": {\n      \"Type\": \"AWS::CloudTrail::Trail\",\n      \"Properties\": {\n        \"TrailName\": \"siem-cloudtrail\",\n        \"S3BucketName\": \"company-cloudtrail-logs\",\n        \"IsLogging\": true,\n        \"IsMultiRegionTrail\": true,\n        \"IncludeGlobalServiceEvents\": true,\n        \"EnableLogFileValidation\": true,\n        \"EventSelectors\": [\n          {\n            \"ReadWriteType\": \"All\",\n            \"IncludeManagementEvents\": true,\n            \"DataResources\": [\n              {\n                \"Type\": \"AWS::S3::Object\",\n                \"Values\": [\"arn:aws:s3\"]\n              }\n            ]\n          }\n        ]\n      }\n    }\n  }\n}\n```\n\n### Step 3: Parse and Normalize\n\n#### Custom Parser Example (Splunk props.conf\u002Ftransforms.conf)\n\n```conf\n# props.conf\n[custom:firewall:logs]\nSHOULD_LINEMERGE = false\nLINE_BREAKER = ([\\r\\n]+)\nTIME_PREFIX = ^\nTIME_FORMAT = %Y-%m-%dT%H:%M:%S%z\nMAX_TIMESTAMP_LOOKAHEAD = 30\nTRANSFORMS-firewall = firewall_extract_fields\nFIELDALIAS-src = src_addr AS src_ip\nFIELDALIAS-dst = dst_addr AS dest_ip\nEVAL-action = case(fw_action==\"allow\", \"allowed\", fw_action==\"deny\", \"blocked\", true(), \"unknown\")\nEVAL-vendor_product = \"Custom Firewall\"\nLOOKUP-geo = geo_ip_lookup ip AS dest_ip OUTPUT country, city, latitude, longitude\n\n# transforms.conf\n[firewall_extract_fields]\nREGEX = ^(\\S+)\\s+(\\S+)\\s+action=(\\w+)\\s+src=(\\S+):(\\d+)\\s+dst=(\\S+):(\\d+)\\s+proto=(\\w+)\\s+bytes=(\\d+)\nFORMAT = timestamp::$1 hostname::$2 fw_action::$3 src_addr::$4 src_port::$5 dst_addr::$6 dst_port::$7 protocol::$8 bytes::$9\n```\n\n#### CIM Field Mapping\n\n| Raw Field | CIM Field | Data Model |\n|---|---|---|\n| src_addr | src_ip | Network_Traffic |\n| dst_addr | dest_ip | Network_Traffic |\n| dst_port | dest_port | Network_Traffic |\n| fw_action | action | Network_Traffic |\n| bytes_sent + bytes_recv | bytes | Network_Traffic |\n| user_name | user | Authentication |\n| login_result | action | Authentication |\n| process_path | process | Endpoint |\n\n### Step 4: Validate Data Quality\n\n```spl\n# Verify events are arriving\nindex=new_source earliest=-1h\n| stats count by sourcetype, host, source\n\n# Check field extraction quality\nindex=new_source earliest=-1h\n| stats count(src_ip) as has_src count(dest_ip) as has_dest count(action) as has_action count by sourcetype\n| eval src_coverage=round(has_src\u002Fcount*100,1)\n| eval dest_coverage=round(has_dest\u002Fcount*100,1)\n| eval action_coverage=round(has_action\u002Fcount*100,1)\n\n# Verify CIM compliance\n| datamodel Network_Traffic search\n| search sourcetype=new_sourcetype\n| stats count by source, sourcetype\n\n# Check for timestamp parsing issues\nindex=new_source earliest=-1h\n| eval time_diff=abs(_time - _indextime)\n| stats avg(time_diff) as avg_lag max(time_diff) as max_lag by host\n| where avg_lag > 300\n```\n\n### Step 5: Enable Detection Coverage\n\n```spl\n# Verify existing correlation searches work with new source\nindex=new_source sourcetype=new_sourcetype\n| tstats count from datamodel=Authentication by _time span=1h\n| timechart span=1h count\n\n# Create source-specific detection rule\n[New Source - Authentication Anomaly]\nsearch = index=new_source sourcetype=new_sourcetype action=failure \\\n| stats count by src_ip, user \\\n| where count > 10\n```\n\n## Onboarding Checklist\n\n- [ ] Log source assessed and approved\n- [ ] Network connectivity verified\n- [ ] Collection agent\u002Fmethod configured\n- [ ] Log forwarding confirmed\n- [ ] Parser\u002Ffield extraction configured\n- [ ] CIM compliance validated\n- [ ] Data model acceleration enabled\n- [ ] Volume within license budget\n- [ ] Retention policy configured\n- [ ] Detection rules enabled\u002Fcreated\n- [ ] Dashboard updated\n- [ ] Documentation completed\n- [ ] SOC team notified\n\n## References\n\n- [UK NCSC - Onboarding Systems and Log Sources](https:\u002F\u002Fwww.ncsc.gov.uk\u002Fcollection\u002Fbuilding-a-security-operations-centre\u002Fonboarding-systems-and-log-sources)\n- [Sumo Logic - Cloud SIEM Onboarding Checklist](https:\u002F\u002Fhelp.sumologic.com\u002Fdocs\u002Fcse\u002Fget-started-with-cloud-siem\u002Fonboarding-checklist-cse\u002F)\n- [SIEM Logging Best Practices - Coralogix](https:\u002F\u002Fcoralogix.com\u002Fguides\u002Fsiem\u002Fsiem-logging\u002F)\n- [Huntress - SIEM Implementation Guide](https:\u002F\u002Fwww.huntress.com\u002Fsiem-guide\u002Fsiem-implementation-guide)\n","# Performing Log Source Onboarding in SIEM\n\n## Overview\n\nLog source onboarding is the systematic process of integrating new data sources into a SIEM platform to enable security monitoring and detection. Proper onboarding requires planning data sources, configuring collection agents, building parsers, normalizing fields to a common schema, and validating data quality. According to the UK NCSC, onboarding should prioritize log sources that provide the highest security value relative to their ingestion cost.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing log source onboarding in siem\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- SIEM platform deployed (Splunk, Elastic, Sentinel, QRadar, or similar)\n- Network access from source systems to SIEM collectors\n- Administrative access on source systems for agent installation\n- Common Information Model (CIM) or equivalent schema documentation\n- Change management approval for production system modifications\n\n## Log Source Priority Framework\n\n### Tier 1 - Critical (Onboard First)\n\n| Source | Log Type | Security Value |\n|---|---|---|\n| Active Directory | Security Event Logs | Authentication, privilege escalation |\n| Firewalls | Traffic logs | Network access, C2 detection |\n| EDR\u002FAV | Endpoint alerts | Malware, process execution |\n| VPN\u002FRemote Access | Connection logs | Unauthorized access |\n| DNS Servers | Query logs | C2 beaconing, data exfiltration |\n| Email Gateway | Email security logs | Phishing, BEC |\n\n### Tier 2 - High Priority\n\n| Source | Log Type | Security Value |\n|---|---|---|\n| Web Proxy | HTTP\u002FHTTPS logs | Web-based attacks, data exfiltration |\n| Cloud platforms (AWS\u002FAzure\u002FGCP) | Audit logs | Cloud security posture |\n| Database servers | Audit\u002Fquery logs | Data access, SQL injection |\n| DHCP\u002FIPAM | Address allocation | Asset tracking |\n| File servers | Access logs | Data access monitoring |\n\n### Tier 3 - Standard\n\n| Source | Log Type | Security Value |\n|---|---|---|\n| Application servers | App logs | Application-level attacks |\n| Print servers | Print logs | Data loss prevention |\n| Badge\u002Fphysical access | Access logs | Physical security correlation |\n| Network devices (switches\u002Frouters) | Syslog | Network anomalies |\n\n## Onboarding Process\n\n### Step 1: Discovery and Assessment\n\n```\n1. Identify the log source:\n   - System type and version\n   - Log format (syslog, CEF, JSON, Windows Events, etc.)\n   - Log volume estimate (EPS - events per second)\n   - Network location and firewall requirements\n\n2. Assess security value:\n   - What threats can this source help detect?\n   - Which MITRE ATT&CK techniques does it cover?\n   - Is there an existing SIEM parser?\n\n3. Estimate ingestion cost:\n   - Daily volume in GB\n   - License impact (per-GB or per-EPS pricing)\n   - Storage retention requirements\n```\n\n### Step 2: Configure Log Collection\n\n#### Syslog-Based Collection (Firewalls, Network Devices)\n\n```conf\n# rsyslog configuration for receiving syslog\n# \u002Fetc\u002Frsyslog.d\u002F10-siem-collection.conf\n\n# UDP reception\nmodule(load=\"imudp\")\ninput(type=\"imudp\" port=\"514\" ruleset=\"siem_forwarding\")\n\n# TCP reception\nmodule(load=\"imtcp\")\ninput(type=\"imtcp\" port=\"514\" ruleset=\"siem_forwarding\")\n\n# TLS reception\nmodule(load=\"imtcp\" StreamDriver.AuthMode=\"x509\u002Fname\"\n       StreamDriver.Mode=\"1\" StreamDriver.Name=\"gtls\")\ninput(type=\"imtcp\" port=\"6514\" ruleset=\"siem_forwarding\")\n\nruleset(name=\"siem_forwarding\") {\n    # Forward to SIEM\n    action(type=\"omfwd\" target=\"siem.company.com\" port=\"9514\"\n           protocol=\"tcp\" queue.type=\"LinkedList\"\n           queue.filename=\"siem_fwd\" queue.maxdiskspace=\"1g\"\n           queue.saveonshutdown=\"on\" action.resumeRetryCount=\"-1\")\n}\n```\n\n#### Windows Event Log Collection (Splunk Universal Forwarder)\n\n```conf\n# inputs.conf on Splunk Universal Forwarder\n[WinEventLog:\u002F\u002FSecurity]\ndisabled = 0\nindex = wineventlog\nsourcetype = WinEventLog:Security\nevt_resolve_ad_obj = 1\ncheckpointInterval = 5\n\n[WinEventLog:\u002F\u002FSystem]\ndisabled = 0\nindex = wineventlog\nsourcetype = WinEventLog:System\n\n[WinEventLog:\u002F\u002FMicrosoft-Windows-Sysmon\u002FOperational]\ndisabled = 0\nindex = wineventlog\nsourcetype = XmlWinEventLog:Microsoft-Windows-Sysmon\u002FOperational\nrenderXml = true\n\n[WinEventLog:\u002F\u002FMicrosoft-Windows-PowerShell\u002FOperational]\ndisabled = 0\nindex = wineventlog\nsourcetype = XmlWinEventLog:Microsoft-Windows-PowerShell\u002FOperational\n```\n\n#### Cloud Log Collection (AWS CloudTrail)\n\n```json\n{\n  \"AWSTemplateFormatVersion\": \"2010-09-09\",\n  \"Resources\": {\n    \"CloudTrailToSIEM\": {\n      \"Type\": \"AWS::CloudTrail::Trail\",\n      \"Properties\": {\n        \"TrailName\": \"siem-cloudtrail\",\n        \"S3BucketName\": \"company-cloudtrail-logs\",\n        \"IsLogging\": true,\n        \"IsMultiRegionTrail\": true,\n        \"IncludeGlobalServiceEvents\": true,\n        \"EnableLogFileValidation\": true,\n        \"EventSelectors\": [\n          {\n            \"ReadWriteType\": \"All\",\n            \"IncludeManagementEvents\": true,\n            \"DataResources\": [\n              {\n                \"Type\": \"AWS::S3::Object\",\n                \"Values\": [\"arn:aws:s3\"]\n              }\n            ]\n          }\n        ]\n      }\n    }\n  }\n}\n```\n\n### Step 3: Parse and Normalize\n\n#### Custom Parser Example (Splunk props.conf\u002Ftransforms.conf)\n\n```conf\n# props.conf\n[custom:firewall:logs]\nSHOULD_LINEMERGE = false\nLINE_BREAKER = ([\\r\\n]+)\nTIME_PREFIX = ^\nTIME_FORMAT = %Y-%m-%dT%H:%M:%S%z\nMAX_TIMESTAMP_LOOKAHEAD = 30\nTRANSFORMS-firewall = firewall_extract_fields\nFIELDALIAS-src = src_addr AS src_ip\nFIELDALIAS-dst = dst_addr AS dest_ip\nEVAL-action = case(fw_action==\"allow\", \"allowed\", fw_action==\"deny\", \"blocked\", true(), \"unknown\")\nEVAL-vendor_product = \"Custom Firewall\"\nLOOKUP-geo = geo_ip_lookup ip AS dest_ip OUTPUT country, city, latitude, longitude\n\n# transforms.conf\n[firewall_extract_fields]\nREGEX = ^(\\S+)\\s+(\\S+)\\s+action=(\\w+)\\s+src=(\\S+):(\\d+)\\s+dst=(\\S+):(\\d+)\\s+proto=(\\w+)\\s+bytes=(\\d+)\nFORMAT = timestamp::$1 hostname::$2 fw_action::$3 src_addr::$4 src_port::$5 dst_addr::$6 dst_port::$7 protocol::$8 bytes::$9\n```\n\n#### CIM Field Mapping\n\n| Raw Field | CIM Field | Data Model |\n|---|---|---|\n| src_addr | src_ip | Network_Traffic |\n| dst_addr | dest_ip | Network_Traffic |\n| dst_port | dest_port | Network_Traffic |\n| fw_action | action | Network_Traffic |\n| bytes_sent + bytes_recv | bytes | Network_Traffic |\n| user_name | user | Authentication |\n| login_result | action | Authentication |\n| process_path | process | Endpoint |\n\n### Step 4: Validate Data Quality\n\n```spl\n# Verify events are arriving\nindex=new_source earliest=-1h\n| stats count by sourcetype, host, source\n\n# Check field extraction quality\nindex=new_source earliest=-1h\n| stats count(src_ip) as has_src count(dest_ip) as has_dest count(action) as has_action count by sourcetype\n| eval src_coverage=round(has_src\u002Fcount*100,1)\n| eval dest_coverage=round(has_dest\u002Fcount*100,1)\n| eval action_coverage=round(has_action\u002Fcount*100,1)\n\n# Verify CIM compliance\n| datamodel Network_Traffic search\n| search sourcetype=new_sourcetype\n| stats count by source, sourcetype\n\n# Check for timestamp parsing issues\nindex=new_source earliest=-1h\n| eval time_diff=abs(_time - _indextime)\n| stats avg(time_diff) as avg_lag max(time_diff) as max_lag by host\n| where avg_lag > 300\n```\n\n### Step 5: Enable Detection Coverage\n\n```spl\n# Verify existing correlation searches work with new source\nindex=new_source sourcetype=new_sourcetype\n| tstats count from datamodel=Authentication by _time span=1h\n| timechart span=1h count\n\n# Create source-specific detection rule\n[New Source - Authentication Anomaly]\nsearch = index=new_source sourcetype=new_sourcetype action=failure \\\n| stats count by src_ip, user \\\n| where count > 10\n```\n\n## Onboarding Checklist\n\n- [ ] Log source assessed and approved\n- [ ] Network connectivity verified\n- [ ] Collection agent\u002Fmethod configured\n- [ ] Log forwarding confirmed\n- [ ] Parser\u002Ffield extraction configured\n- [ ] CIM compliance validated\n- [ ] Data model acceleration enabled\n- [ ] Volume within license budget\n- [ ] Retention policy configured\n- [ ] Detection rules enabled\u002Fcreated\n- [ ] Dashboard updated\n- [ ] Documentation completed\n- [ ] SOC team notified\n\n## References\n\n- [UK NCSC - Onboarding Systems and Log Sources](https:\u002F\u002Fwww.ncsc.gov.uk\u002Fcollection\u002Fbuilding-a-security-operations-centre\u002Fonboarding-systems-and-log-sources)\n- [Sumo Logic - Cloud SIEM Onboarding Checklist](https:\u002F\u002Fhelp.sumologic.com\u002Fdocs\u002Fcse\u002Fget-started-with-cloud-siem\u002Fonboarding-checklist-cse\u002F)\n- [SIEM Logging Best Practices - Coralogix](https:\u002F\u002Fcoralogix.com\u002Fguides\u002Fsiem\u002Fsiem-logging\u002F)\n- [Huntress - SIEM Implementation Guide](https:\u002F\u002Fwww.huntress.com\u002Fsiem-guide\u002Fsiem-implementation-guide)\n",{"name":5,"tags":49,"author":50,"domain":43,"license":15,"version":51,"nist_csf":52,"subdomain":57,"description":7,"mitre_attack":58},[24,37,38,28,35,34,42],"mahipal","1.0",[53,54,55,56],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations",[59,60,61,62],"T1078","T1685.002","T1685.005","T1566","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fperforming-log-source-onboarding-in-siem","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill performing-log-source-onboarding-in-siem",{"tool":77,"command":78},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill performing-log-source-onboarding-in-siem",{"tool":80,"command":81},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill performing-log-source-onboarding-in-siem","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-log-source-onboarding-in-siem\u002FSKILL.md",true,[85,91,96,102,106,110,116],{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"assets\u002Ftemplate.md","ASSET","资产文件",1120,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-log-source-onboarding-in-siem\u002Fassets\u002Ftemplate.md",{"path":92,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-log-source-onboarding-in-siem\u002FLICENSE",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fapi-reference.md","REFERENCE","参考文档",1593,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-log-source-onboarding-in-siem\u002Freferences\u002Fapi-reference.md",{"path":103,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fstandards.md",1253,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-log-source-onboarding-in-siem\u002Freferences\u002Fstandards.md",{"path":107,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fworkflows.md",1366,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-log-source-onboarding-in-siem\u002Freferences\u002Fworkflows.md",{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002Fagent.py","SCRIPT","脚本",7811,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-log-source-onboarding-in-siem\u002Fscripts\u002Fagent.py",{"path":117,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":118,"sourceHtmlUrl":119},"scripts\u002Fprocess.py",8104,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-log-source-onboarding-in-siem\u002Fscripts\u002Fprocess.py",[121,162,171,180,202,230],{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":125,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":142,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[128,133,136,139],{"categoryNo":129,"categoryName":130,"taxonomyType":131,"taxonomyTypeDesc":132},"01JBSEEDCAT000000000000002","文档处理","SCENARIO","使用场景",{"categoryNo":134,"categoryName":135,"taxonomyType":131,"taxonomyTypeDesc":132},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":137,"categoryName":138,"taxonomyType":131,"taxonomyTypeDesc":132},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000034","行政与办公人员",[123,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":163,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":125,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":170,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[166,167,168,169],{"categoryNo":129,"categoryName":130,"taxonomyType":131,"taxonomyTypeDesc":132},{"categoryNo":134,"categoryName":135,"taxonomyType":131,"taxonomyTypeDesc":132},{"categoryNo":137,"categoryName":138,"taxonomyType":131,"taxonomyTypeDesc":132},{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},[123,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161],{"skillNo":172,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":125,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":179,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[175,176,177,178],{"categoryNo":129,"categoryName":130,"taxonomyType":131,"taxonomyTypeDesc":132},{"categoryNo":134,"categoryName":135,"taxonomyType":131,"taxonomyTypeDesc":132},{"categoryNo":137,"categoryName":138,"taxonomyType":131,"taxonomyTypeDesc":132},{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},[123,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161],{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":125,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":186,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[187,188,189,190,191,192,193,194,195,196,197,198,199,200,201],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":125,"licenseFileUrl":6,"sourceHtmlUrl":206,"categories":207,"keywords":211,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[208],{"categoryNo":209,"categoryName":210,"taxonomyType":131,"taxonomyTypeDesc":132},"01JBSEEDCAT000000000000023","Skill与智能体开发",[212,213,214,215,216,217,218,219,220,221,222,154,155,223,224,225,226,227,228,229],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":231,"name":232,"nameZh":6,"description":233,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":125,"licenseFileUrl":6,"sourceHtmlUrl":234,"categories":235,"keywords":246,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[236,239,242,243],{"categoryNo":237,"categoryName":238,"taxonomyType":131,"taxonomyTypeDesc":132},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":240,"categoryName":241,"taxonomyType":131,"taxonomyTypeDesc":132},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":209,"categoryName":210,"taxonomyType":131,"taxonomyTypeDesc":132},{"categoryNo":244,"categoryName":245,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",[247,248,249,250,251,252,253,254,151,255,154,155,156,256,257,258,259,260,201,261],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]