[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71AVCQ03V1HS0Z98MZBKA26":3,"skill-same:01M71AVCQ03V1HS0Z98MZBKA26":68},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":53,"updatedAt":54,"install":55,"resources":67},"01M71AVCQ03V1HS0Z98MZBKA26","cyber-correlating-security-events-in-qradar",null,"Correlates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules, building blocks, and offense management to detect multi-stage attacks across network, endpoint, and application log sources. Use when SOC analysts need to investigate QRadar offenses, build correlation rules, or tune detection logic for reducing false positives.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-correlating-security-events-in-qradar\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"cyber correlating security events in qradar","events","qradar","correlating security events in qradar","security","attacks","endpoint","SOC-operations","network","subdomain","siem","across","log","soc","query","when","false","cybersecurity","Building Blocks","sources","2026-11-10 10:12:30",false,"---\nname: cyber-correlating-security-events-in-qradar\ndescription: \"Correlates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules, building blocks, and offense management to detect multi-stage attacks across network, endpoint, and application log sources. Use when SOC analysts need to investigate QRadar offenses, build correlation rules, or tune detection logic for reducing false positives.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: correlating-security-events-in-qradar | description: 'Correlates security events in IBM QRadar SIEM using AQL (Ariel Query |   Language), custom rules, building blocks, and offense management to detect multi-stage |   attacks across network, endpoint, and application log sources. Use when SOC analysts |   need to investigate QRadar offenses, build correlation rules, or tune detection |   logic for reducing false positives. |  |   ' | domain: cybersecurity | subdomain: soc-operations | tags\"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Correlating Security Events in QRadar\n\n## When to Use\n\nUse this skill when:\n- SOC analysts need to investigate QRadar offenses and correlate events across multiple log sources\n- Detection engineers build custom correlation rules to identify multi-stage attacks\n- Alert tuning is required to reduce false positive offenses and improve signal quality\n- The team migrates from basic event monitoring to behavior-based correlation\n\n**Do not use** for log source onboarding or parsing — that requires QRadar administrator access and DSM editor knowledge.\n\n## Prerequisites\n\n- IBM QRadar SIEM 7.5+ with offense management enabled\n- AQL knowledge for ad-hoc event and flow queries\n- Log sources normalized with proper QID mappings (Windows, firewall, proxy, endpoint)\n- User role with offense management, rule creation, and AQL search permissions\n- Reference sets\u002Fmaps configured for whitelist and watchlist management\n\n## Workflow\n\n### Step 1: Investigate an Offense with AQL\n\nOpen an offense in QRadar and query contributing events using AQL (Ariel Query Language):\n\n```sql\nSELECT DATEFORMAT(startTime, 'yyyy-MM-dd HH:mm:ss') AS event_time,\n       sourceIP, destinationIP, username,\n       LOGSOURCENAME(logSourceId) AS log_source,\n       QIDNAME(qid) AS event_name,\n       category, magnitude\nFROM events\nWHERE INOFFENSE(12345)\nORDER BY startTime ASC\nLIMIT 500\n```\n\nPivot on the source IP to find all activity:\n\n```sql\nSELECT DATEFORMAT(startTime, 'yyyy-MM-dd HH:mm:ss') AS event_time,\n       destinationIP, destinationPort, username,\n       QIDNAME(qid) AS event_name,\n       eventCount, category\nFROM events\nWHERE sourceIP = '192.168.1.105'\n  AND startTime > NOW() - 24*60*60*1000\nORDER BY startTime ASC\nLIMIT 1000\n```\n\n### Step 2: Build a Custom Correlation Rule\n\nCreate a multi-condition rule detecting brute force followed by successful login:\n\n**Rule 1 — Brute Force Detection (Building Block):**\n```\nRule Type: Event\nRule Name: BB: Multiple Failed Logins from Same Source\nTests:\n  - When the event(s) were detected by one or more of [Local]\n  - AND when the event QID is one of [Authentication Failure (5000001)]\n  - AND when at least 10 events are seen with the same Source IP\n    in 5 minutes\nRule Action: Dispatch new event (Category: Authentication, QID: Custom_BruteForce)\n```\n\n**Rule 2 — Brute Force Succeeded (Correlation Rule):**\n```\nRule Type: Offense\nRule Name: COR: Brute Force with Subsequent Successful Login\nTests:\n  - When an event matches the building block BB: Multiple Failed Logins from Same Source\n  - AND when an event with QID [Authentication Success (5000000)] is detected\n    from the same Source IP within 10 minutes\n  - AND the Destination IP is the same for both events\nRule Action: Create offense, set severity to High, set relevance to 8\n```\n\n### Step 3: Use AQL for Cross-Source Correlation\n\nCorrelate authentication failures with network flows to detect lateral movement:\n\n```sql\nSELECT e.sourceIP, e.destinationIP, e.username,\n       QIDNAME(e.qid) AS event_name,\n       e.eventCount,\n       f.sourceBytes, f.destinationBytes\nFROM events e\nLEFT JOIN flows f ON e.sourceIP = f.sourceIP\n  AND e.destinationIP = f.destinationIP\n  AND f.startTime BETWEEN e.startTime AND e.startTime + 300000\nWHERE e.category = 'Authentication'\n  AND e.sourceIP IN (\n    SELECT sourceIP FROM events\n    WHERE QIDNAME(qid) = 'Authentication Failure'\n      AND startTime > NOW() - 3600000\n    GROUP BY sourceIP\n    HAVING COUNT(*) > 20\n  )\n  AND e.startTime > NOW() - 3600000\nORDER BY e.startTime ASC\n```\n\nDetect data exfiltration by correlating DNS queries with large outbound flows:\n\n```sql\nSELECT sourceIP, destinationIP,\n       SUM(sourceBytes) AS total_bytes_out,\n       COUNT(*) AS flow_count\nFROM flows\nWHERE sourceIP IN (\n    SELECT sourceIP FROM events\n    WHERE QIDNAME(qid) ILIKE '%DNS%'\n      AND destinationIP NOT IN (\n        SELECT ip FROM reference_data.sets('Internal_DNS_Servers')\n      )\n      AND startTime > NOW() - 86400000\n    GROUP BY sourceIP\n    HAVING COUNT(*) > 500\n  )\n  AND destinationPort NOT IN (80, 443, 53)\n  AND startTime > NOW() - 86400000\nGROUP BY sourceIP, destinationIP\nHAVING SUM(sourceBytes) > 104857600\nORDER BY total_bytes_out DESC\n```\n\n### Step 4: Configure Reference Sets for Context Enrichment\n\nCreate reference sets for dynamic whitelists and watchlists:\n\n```bash\n# Create reference set via QRadar API\ncurl -X POST \"https:\u002F\u002Fqradar.example.com\u002Fapi\u002Freference_data\u002Fsets\" \\\n  -H \"SEC: YOUR_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"Known_Pen_Test_IPs\",\n    \"element_type\": \"IP\",\n    \"timeout_type\": \"LAST_SEEN\",\n    \"time_to_live\": \"30 days\"\n  }'\n\n# Add entries\ncurl -X POST \"https:\u002F\u002Fqradar.example.com\u002Fapi\u002Freference_data\u002Fsets\u002FKnown_Pen_Test_IPs\" \\\n  -H \"SEC: YOUR_API_TOKEN\" \\\n  -d \"value=10.0.5.100\"\n```\n\nUse reference sets in rule conditions to exclude known benign activity:\n\n```\nTest: AND when the Source IP is NOT contained in any of [Known_Pen_Test_IPs]\nTest: AND when the Destination IP is contained in any of [Critical_Asset_IPs]\n```\n\n### Step 5: Tune Offense Generation\n\nReduce false positives by adding building block filters:\n\n```sql\n-- Find top false positive generators\nSELECT QIDNAME(qid) AS event_name,\n       LOGSOURCENAME(logSourceId) AS log_source,\n       COUNT(*) AS event_count,\n       COUNT(DISTINCT sourceIP) AS unique_sources\nFROM events\nWHERE INOFFENSE(\n    SELECT offenseId FROM offenses\n    WHERE status = 'CLOSED'\n      AND closeReason = 'False Positive'\n      AND startTime > NOW() - 30*24*60*60*1000\n  )\nGROUP BY qid, logSourceId\nORDER BY event_count DESC\nLIMIT 20\n```\n\nApply tuning:\n- Add high-frequency false positive sources to reference set exclusions\n- Increase event thresholds on noisy rules (e.g., 10 failed logins -> 25 for service accounts)\n- Set offense coalescing to group related events under a single offense\n\n### Step 6: Build Custom Dashboard for Correlation Monitoring\n\nCreate a QRadar Pulse dashboard with key correlation metrics:\n\n```sql\n-- Active offenses by category\nSELECT offenseType, status, COUNT(*) AS offense_count,\n       AVG(magnitude) AS avg_magnitude\nFROM offenses\nWHERE status = 'OPEN'\nGROUP BY offenseType, status\nORDER BY offense_count DESC\n\n-- Mean time to close offenses\nSELECT DATEFORMAT(startTime, 'yyyy-MM-dd') AS day,\n       AVG(closeTime - startTime) \u002F 60000 AS avg_close_minutes,\n       COUNT(*) AS closed_count\nFROM offenses\nWHERE status = 'CLOSED'\n  AND startTime > NOW() - 30*24*60*60*1000\nGROUP BY DATEFORMAT(startTime, 'yyyy-MM-dd')\nORDER BY day\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **AQL** | Ariel Query Language — QRadar's SQL-like query language for searching events, flows, and offenses |\n| **Offense** | QRadar's correlated incident grouping multiple events\u002Fflows under a single investigation unit |\n| **Building Block** | Reusable rule component that categorizes events without generating offenses, used as input to correlation rules |\n| **Magnitude** | QRadar's calculated offense severity combining relevance, severity, and credibility scores (1-10) |\n| **Reference Set** | Dynamic lookup table in QRadar for whitelists, watchlists, and enrichment data used in rules |\n| **QID** | QRadar Identifier — unique numeric ID mapping vendor-specific events to normalized categories |\n| **Coalescing** | QRadar's mechanism for grouping related events into a single offense to reduce analyst workload |\n\n## Tools & Systems\n\n- **IBM QRadar SIEM**: Enterprise SIEM platform with event correlation, offense management, and AQL query engine\n- **QRadar Pulse**: Dashboard framework for building custom visualizations of offense and event metrics\n- **QRadar API**: RESTful API for automating reference set management, offense operations, and rule deployment\n- **QRadar Use Case Manager**: App for mapping detection rules to MITRE ATT&CK framework coverage\n- **QRadar Assistant**: AI-powered analysis tool helping analysts investigate offenses with natural language\n\n## Common Scenarios\n\n- **Brute Force to Compromise**: Correlate failed auth events with subsequent successful login from same source\n- **Lateral Movement Chain**: Track authentication events across multiple internal hosts from a single source\n- **C2 Beaconing**: Correlate periodic DNS queries with low-entropy payloads to unusual domains\n- **Privilege Escalation**: Correlate user account changes (group additions) with prior suspicious authentication\n- **Data Exfiltration**: Correlate large outbound flow volumes with prior internal reconnaissance activity\n\n## Output Format\n\n```\nQRADAR OFFENSE INVESTIGATION — Offense #12345\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nOffense Type:   Brute Force with Subsequent Access\nMagnitude:      8\u002F10 (Severity: 8, Relevance: 9, Credibility: 7)\nCreated:        2024-03-15 14:23:07 UTC\nContributing:   247 events from 3 log sources\n\nCorrelation Chain:\n  14:10-14:22  — 234 Authentication Failures (EventCode 4625) from 192.168.1.105 to DC-01\n  14:23:07     — Authentication Success (EventCode 4624) from 192.168.1.105 to DC-01 (user: admin)\n  14:25:33     — New Process: cmd.exe spawned by admin on DC-01\n  14:26:01     — Net.exe user \u002Fadd detected on DC-01\n\nSources Correlated:\n  Windows Security Logs (DC-01)\n  Sysmon (DC-01)\n  Firewall (Palo Alto PA-5260)\n\nDisposition:    TRUE POSITIVE — Escalated to Incident Response\nTicket:         IR-2024-0432\n```\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Correlating Security Events in QRadar\n\n## When to Use\n\nUse this skill when:\n- SOC analysts need to investigate QRadar offenses and correlate events across multiple log sources\n- Detection engineers build custom correlation rules to identify multi-stage attacks\n- Alert tuning is required to reduce false positive offenses and improve signal quality\n- The team migrates from basic event monitoring to behavior-based correlation\n\n**Do not use** for log source onboarding or parsing — that requires QRadar administrator access and DSM editor knowledge.\n\n## Prerequisites\n\n- IBM QRadar SIEM 7.5+ with offense management enabled\n- AQL knowledge for ad-hoc event and flow queries\n- Log sources normalized with proper QID mappings (Windows, firewall, proxy, endpoint)\n- User role with offense management, rule creation, and AQL search permissions\n- Reference sets\u002Fmaps configured for whitelist and watchlist management\n\n## Workflow\n\n### Step 1: Investigate an Offense with AQL\n\nOpen an offense in QRadar and query contributing events using AQL (Ariel Query Language):\n\n```sql\nSELECT DATEFORMAT(startTime, 'yyyy-MM-dd HH:mm:ss') AS event_time,\n       sourceIP, destinationIP, username,\n       LOGSOURCENAME(logSourceId) AS log_source,\n       QIDNAME(qid) AS event_name,\n       category, magnitude\nFROM events\nWHERE INOFFENSE(12345)\nORDER BY startTime ASC\nLIMIT 500\n```\n\nPivot on the source IP to find all activity:\n\n```sql\nSELECT DATEFORMAT(startTime, 'yyyy-MM-dd HH:mm:ss') AS event_time,\n       destinationIP, destinationPort, username,\n       QIDNAME(qid) AS event_name,\n       eventCount, category\nFROM events\nWHERE sourceIP = '192.168.1.105'\n  AND startTime > NOW() - 24*60*60*1000\nORDER BY startTime ASC\nLIMIT 1000\n```\n\n### Step 2: Build a Custom Correlation Rule\n\nCreate a multi-condition rule detecting brute force followed by successful login:\n\n**Rule 1 — Brute Force Detection (Building Block):**\n```\nRule Type: Event\nRule Name: BB: Multiple Failed Logins from Same Source\nTests:\n  - When the event(s) were detected by one or more of [Local]\n  - AND when the event QID is one of [Authentication Failure (5000001)]\n  - AND when at least 10 events are seen with the same Source IP\n    in 5 minutes\nRule Action: Dispatch new event (Category: Authentication, QID: Custom_BruteForce)\n```\n\n**Rule 2 — Brute Force Succeeded (Correlation Rule):**\n```\nRule Type: Offense\nRule Name: COR: Brute Force with Subsequent Successful Login\nTests:\n  - When an event matches the building block BB: Multiple Failed Logins from Same Source\n  - AND when an event with QID [Authentication Success (5000000)] is detected\n    from the same Source IP within 10 minutes\n  - AND the Destination IP is the same for both events\nRule Action: Create offense, set severity to High, set relevance to 8\n```\n\n### Step 3: Use AQL for Cross-Source Correlation\n\nCorrelate authentication failures with network flows to detect lateral movement:\n\n```sql\nSELECT e.sourceIP, e.destinationIP, e.username,\n       QIDNAME(e.qid) AS event_name,\n       e.eventCount,\n       f.sourceBytes, f.destinationBytes\nFROM events e\nLEFT JOIN flows f ON e.sourceIP = f.sourceIP\n  AND e.destinationIP = f.destinationIP\n  AND f.startTime BETWEEN e.startTime AND e.startTime + 300000\nWHERE e.category = 'Authentication'\n  AND e.sourceIP IN (\n    SELECT sourceIP FROM events\n    WHERE QIDNAME(qid) = 'Authentication Failure'\n      AND startTime > NOW() - 3600000\n    GROUP BY sourceIP\n    HAVING COUNT(*) > 20\n  )\n  AND e.startTime > NOW() - 3600000\nORDER BY e.startTime ASC\n```\n\nDetect data exfiltration by correlating DNS queries with large outbound flows:\n\n```sql\nSELECT sourceIP, destinationIP,\n       SUM(sourceBytes) AS total_bytes_out,\n       COUNT(*) AS flow_count\nFROM flows\nWHERE sourceIP IN (\n    SELECT sourceIP FROM events\n    WHERE QIDNAME(qid) ILIKE '%DNS%'\n      AND destinationIP NOT IN (\n        SELECT ip FROM reference_data.sets('Internal_DNS_Servers')\n      )\n      AND startTime > NOW() - 86400000\n    GROUP BY sourceIP\n    HAVING COUNT(*) > 500\n  )\n  AND destinationPort NOT IN (80, 443, 53)\n  AND startTime > NOW() - 86400000\nGROUP BY sourceIP, destinationIP\nHAVING SUM(sourceBytes) > 104857600\nORDER BY total_bytes_out DESC\n```\n\n### Step 4: Configure Reference Sets for Context Enrichment\n\nCreate reference sets for dynamic whitelists and watchlists:\n\n```bash\n# Create reference set via QRadar API\ncurl -X POST \"https:\u002F\u002Fqradar.example.com\u002Fapi\u002Freference_data\u002Fsets\" \\\n  -H \"SEC: YOUR_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"Known_Pen_Test_IPs\",\n    \"element_type\": \"IP\",\n    \"timeout_type\": \"LAST_SEEN\",\n    \"time_to_live\": \"30 days\"\n  }'\n\n# Add entries\ncurl -X POST \"https:\u002F\u002Fqradar.example.com\u002Fapi\u002Freference_data\u002Fsets\u002FKnown_Pen_Test_IPs\" \\\n  -H \"SEC: YOUR_API_TOKEN\" \\\n  -d \"value=10.0.5.100\"\n```\n\nUse reference sets in rule conditions to exclude known benign activity:\n\n```\nTest: AND when the Source IP is NOT contained in any of [Known_Pen_Test_IPs]\nTest: AND when the Destination IP is contained in any of [Critical_Asset_IPs]\n```\n\n### Step 5: Tune Offense Generation\n\nReduce false positives by adding building block filters:\n\n```sql\n-- Find top false positive generators\nSELECT QIDNAME(qid) AS event_name,\n       LOGSOURCENAME(logSourceId) AS log_source,\n       COUNT(*) AS event_count,\n       COUNT(DISTINCT sourceIP) AS unique_sources\nFROM events\nWHERE INOFFENSE(\n    SELECT offenseId FROM offenses\n    WHERE status = 'CLOSED'\n      AND closeReason = 'False Positive'\n      AND startTime > NOW() - 30*24*60*60*1000\n  )\nGROUP BY qid, logSourceId\nORDER BY event_count DESC\nLIMIT 20\n```\n\nApply tuning:\n- Add high-frequency false positive sources to reference set exclusions\n- Increase event thresholds on noisy rules (e.g., 10 failed logins -> 25 for service accounts)\n- Set offense coalescing to group related events under a single offense\n\n### Step 6: Build Custom Dashboard for Correlation Monitoring\n\nCreate a QRadar Pulse dashboard with key correlation metrics:\n\n```sql\n-- Active offenses by category\nSELECT offenseType, status, COUNT(*) AS offense_count,\n       AVG(magnitude) AS avg_magnitude\nFROM offenses\nWHERE status = 'OPEN'\nGROUP BY offenseType, status\nORDER BY offense_count DESC\n\n-- Mean time to close offenses\nSELECT DATEFORMAT(startTime, 'yyyy-MM-dd') AS day,\n       AVG(closeTime - startTime) \u002F 60000 AS avg_close_minutes,\n       COUNT(*) AS closed_count\nFROM offenses\nWHERE status = 'CLOSED'\n  AND startTime > NOW() - 30*24*60*60*1000\nGROUP BY DATEFORMAT(startTime, 'yyyy-MM-dd')\nORDER BY day\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **AQL** | Ariel Query Language — QRadar's SQL-like query language for searching events, flows, and offenses |\n| **Offense** | QRadar's correlated incident grouping multiple events\u002Fflows under a single investigation unit |\n| **Building Block** | Reusable rule component that categorizes events without generating offenses, used as input to correlation rules |\n| **Magnitude** | QRadar's calculated offense severity combining relevance, severity, and credibility scores (1-10) |\n| **Reference Set** | Dynamic lookup table in QRadar for whitelists, watchlists, and enrichment data used in rules |\n| **QID** | QRadar Identifier — unique numeric ID mapping vendor-specific events to normalized categories |\n| **Coalescing** | QRadar's mechanism for grouping related events into a single offense to reduce analyst workload |\n\n## Tools & Systems\n\n- **IBM QRadar SIEM**: Enterprise SIEM platform with event correlation, offense management, and AQL query engine\n- **QRadar Pulse**: Dashboard framework for building custom visualizations of offense and event metrics\n- **QRadar API**: RESTful API for automating reference set management, offense operations, and rule deployment\n- **QRadar Use Case Manager**: App for mapping detection rules to MITRE ATT&CK framework coverage\n- **QRadar Assistant**: AI-powered analysis tool helping analysts investigate offenses with natural language\n\n## Common Scenarios\n\n- **Brute Force to Compromise**: Correlate failed auth events with subsequent successful login from same source\n- **Lateral Movement Chain**: Track authentication events across multiple internal hosts from a single source\n- **C2 Beaconing**: Correlate periodic DNS queries with low-entropy payloads to unusual domains\n- **Privilege Escalation**: Correlate user account changes (group additions) with prior suspicious authentication\n- **Data Exfiltration**: Correlate large outbound flow volumes with prior internal reconnaissance activity\n\n## Output Format\n\n```\nQRADAR OFFENSE INVESTIGATION — Offense #12345\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nOffense Type:   Brute Force with Subsequent Access\nMagnitude:      8\u002F10 (Severity: 8, Relevance: 9, Credibility: 7)\nCreated:        2024-03-15 14:23:07 UTC\nContributing:   247 events from 3 log sources\n\nCorrelation Chain:\n  14:10-14:22  — 234 Authentication Failures (EventCode 4625) from 192.168.1.105 to DC-01\n  14:23:07     — Authentication Success (EventCode 4624) from 192.168.1.105 to DC-01 (user: admin)\n  14:25:33     — New Process: cmd.exe spawned by admin on DC-01\n  14:26:01     — Net.exe user \u002Fadd detected on DC-01\n\nSources Correlated:\n  Windows Security Logs (DC-01)\n  Sysmon (DC-01)\n  Firewall (Palo Alto PA-5260)\n\nDisposition:    TRUE POSITIVE — Escalated to Incident Response\nTicket:         IR-2024-0432\n```\n",{"hide":44,"name":5,"source":45,"license":15,"description":7,"authorized_lab":40,"origin_frontmatter":46},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: correlating-security-events-in-qradar | description: 'Correlates security events in IBM QRadar SIEM using AQL (Ariel Query |   Language), custom rules, building blocks, and offense management to detect multi-stage |   attacks across network, endpoint, and application log sources. Use when SOC analysts |   need to investigate QRadar offenses, build correlation rules, or tune detection |   logic for reducing false positives. |  |   ' | domain: cybersecurity | subdomain: soc-operations | tags","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-correlating-security-events-in-qradar",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-11-11 16:42:59",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":44},[57,60,63],{"tool":58,"command":59},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-correlating-security-events-in-qradar",{"tool":61,"command":62},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-correlating-security-events-in-qradar",{"tool":64,"command":65},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-correlating-security-events-in-qradar","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-correlating-security-events-in-qradar\u002FSKILL.md",[],[69,92,116,146,175,194],{"skillNo":70,"name":71,"nameZh":6,"description":72,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":76,"publishedAt":39},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[77,78,79,80,81,82,83,84,85,86,87,34,88,89,90,91],"zoom out","zoom","with","harness","how","section","re","true","understand","use","perspective","you","code","it","context",{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":39},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[99,100,80,101,102,103,104,105,106,107,108,86,109,34,110,111,112,113,114,115],"yuri shura","parallel","architecture review","planning","for","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":127,"publishedAt":39},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[122],{"categoryNo":123,"categoryName":124,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",[128,129,130,131,132,133,134,135,136,34,137,138,139,140,141,142,143,103,144,145],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":160,"publishedAt":39},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[152,155],{"categoryNo":153,"categoryName":154,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":156,"categoryName":157,"taxonomyType":158,"taxonomyTypeDesc":159},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[161,89,162,128,80,163,164,165,103,166,167,168,169,170,171,172,173,174,86,34],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":39},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[182,183,184,185,186,187,188,189,190,34,191,110,192,193],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":212,"publishedAt":39},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[200,203,206,209],{"categoryNo":201,"categoryName":202,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":204,"categoryName":205,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":207,"categoryName":208,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":210,"categoryName":211,"taxonomyType":158,"taxonomyTypeDesc":159},"01JBSEEDCAT000000000000036","内容创作者",[213,214,215,34,110,216,80,217,104,86,218],"writing","writing skills","new","work","editing","Existing"]