Log Analysis & SIEM Integration

What problem does it solve?

It helps security teams quickly understand large volumes of logs by parsing raw events, surfacing suspicious behavior, and turning findings into actionable detections.

Core Features & Use Cases

• Log Parsing: Normalize Windows, Linux, web, and raw log samples into structured events.
• Detection Engineering: Build and translate Splunk, Elastic, QRadar, Sentinel, and Sigma queries for brute force, persistence, lateral movement, and credential dumping scenarios.
• Anomaly Analysis: Spot spikes, rare sources, after-hours activity, and baseline deviations to prioritize investigation.
• Use Case: A SOC analyst pastes mixed authentication logs and gets a parsed summary, suspicious patterns, and a starting detection query for the target platform.

Quick Start

Use this skill to analyze the pasted log sample, summarize the suspicious activity, and produce the most relevant SIEM detection query.