skills.rest
GhostPWN
GhostPWNOFFICIAL
Explore all skills by this author →
GitHub

Log Analysis & SIEM Integration

Parse security logs and generate SIEM detection queries for Splunk, Elastic, QRadar, Sentinel, and Sigma.

4|Updated Mar 10, 2026
Search Tags:#log analysis#anomaly detection#siem#splunk#kql#sigma#security logs
One-click install
npx skills add https://github.com/GhostPWN/ghostpwn --skill log-analysis-siem-integration
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Log Analysis & SIEM Integration
Source: https://github.com/GhostPWN/ghostpwn/tree/main/src/skills/12-log-analysis
Command: npx skills add https://github.com/GhostPWN/ghostpwn --skill log-analysis-siem-integration

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

It helps security teams quickly understand large volumes of logs by parsing raw events, surfacing suspicious behavior, and turning findings into actionable detections.

Core Features & Use Cases

  • Log Parsing: Normalize Windows, Linux, web, and raw log samples into structured events.
  • Detection Engineering: Build and translate Splunk, Elastic, QRadar, Sentinel, and Sigma queries for brute force, persistence, lateral movement, and credential dumping scenarios.
  • Anomaly Analysis: Spot spikes, rare sources, after-hours activity, and baseline deviations to prioritize investigation.
  • Use Case: A SOC analyst pastes mixed authentication logs and gets a parsed summary, suspicious patterns, and a starting detection query for the target platform.

Quick Start

Use this skill to analyze the pasted log sample, summarize the suspicious activity, and produce the most relevant SIEM detection query.

Frequently Asked Questions about Log Analysis & SIEM Integration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze security logs and generate SIEM detection queries from raw events?▼

SIEM detection engineering builds queries for Splunk, Elastic, QRadar, Microsoft Sentinel, and Sigma to identify brute force, persistence, lateral movement, and credential dumping. It requires structured parsing, timestamp-aware aggregation, and heuristic anomaly scoring.

What is the best way to detect anomalies and suspicious activity in authentication logs?▼

Yes, Sigma rules are fully supported. The Skill translates parsed suspicious activity patterns into Sigma queries alongside Splunk, Elastic, QRadar, and Microsoft Sentinel detection formats for cross-platform security coverage.

Can I build Splunk or KQL queries for brute force and credential dumping from pasted log samples?▼

Yes, you can paste mixed authentication log samples to receive a parsed summary, suspicious behavior findings, and starting detection queries for Splunk, KQL, Elastic, QRadar, or Sigma targeting brute force and credential dumping.

How does baseline comparison work for spotting rare sources and after-hours activity in syslog data?▼

Baseline comparison works by aggregating timestamp-aware Linux syslog and auth data to identify deviations, rare sources, and after-hours activity spikes, applying heuristic anomaly scoring to prioritize investigated events.

Do I need structured parsing before detecting lateral movement and persistence patterns in web server logs?▼

Structured parsing is required to normalize raw web server logs into structured events before applying heuristic anomaly scoring and generating SIEM detection queries for lateral movement and persistence scenarios.

Related Skills

Explore More Data & Analytics Skills→
FuzzdkkFuzzdkk
3

log-analysis

Parse and analyze security logs to detect anomalous activity.

Community
Intermediate
woohyun212woohyun212
21

siem-rule

Convert threat objectives into Sigma rules and cross-platform SIEM detection queries.

Community
Advanced
workromancerworkromancer

web-load2

Fetch web URLs and extract all text content.

Community
Basic
protoLabsAIprotoLabsAI
2

Blue Team / Defensive Methodology Skill

Automate defensive security assessments, incident response workflows, and purple team coverage analysis.

Official
Advanced