skills.rest
UnitOneAI
UnitOneAIOFFICIAL
Explore all skills by this author →
WebsiteGitHub

log-analysis

Analyze security events and generate incident reports with this tool.

44|128|Updated Mar 6, 2026
Search Tags:#anomaly detection#mitre att&ck#security log analysis#soc investigation#nist sp 800-92#event id interpretation
One-click install
npx skills add https://github.com/UnitOneAI/SecuritySkills --skill log-analysis-unitoneai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: log-analysis
Source: https://github.com/UnitOneAI/SecuritySkills/tree/main/skills/secops/log-analysis
Command: npx skills add https://github.com/UnitOneAI/SecuritySkills --skill log-analysis-unitoneai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps SOC analysts and security engineers interpret raw authentication, network, endpoint, and cloud audit logs to identify suspicious activity, build baselines for anomaly detection, and produce findings that map to verifiable MITRE ATT&CK techniques.

Core Features & Use Cases

  • Log source taxonomy: Clarifies what each log source reveals (authentication, DNS, network traffic, endpoint telemetry, cloud audit) and which ATT&CK data sources it supports.
  • Event ID and pattern guidance: Interprets common Windows Event IDs (e.g., 4624/4625/4688) and Linux auth patterns (e.g., sudo usage, SSH successes/failures) in security context.
  • Anomaly + baseline workflow: Recommends how to define “normal” per NIST SP 800-92 using historical clean data, thresholds, and ongoing updates.
  • Cross-source correlation: Provides practical correlation strategies (temporal joins, entity pivoting, kill-chain reconstruction) to reconstruct attacker sequences.
  • Reportable outputs: Generates analysis using a structured report format with severity (P1–P4), evidence, and timeline entries mapped to ATT&CK.

Quick Start

Analyze the provided log data for the suspicious activity affecting the user and time window and return a MITRE ATT&CK-mapped report with findings, timeline, baselines, visibility gaps, and recommendations.

Frequently Asked Questions about log-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze security logs and map findings to MITRE ATT&CK techniques?▼

To analyze security logs and map findings to MITRE ATT&CK techniques, you parse authentication, network, endpoint, and cloud audit data to detect anomalies. This produces auditable reports with severity classifications and ATT&CK v16 technique mapping.

What is the best way to interpret Windows Event IDs like 4624 and 4688 during a SOC investigation?▼

Interpreting Windows Event IDs like 4624 and 4688 during a SOC investigation involves evaluating authentication successes, failures, and process creation events within their security context. This identifies suspicious activity and maps endpoint telemetry to relevant ATT&CK data sources.

How do I establish a baseline for anomaly detection using NIST SP 800-92 guidance?▼

Establishing a baseline for anomaly detection using NIST SP 800-92 involves analyzing historical clean log data to define normal behavior thresholds. Continuous updates to this baseline allow accurate identification of suspicious or anomalous behavior across log sources.

Can I use cross-source correlation to reconstruct attack sequences from raw authentication and network logs?▼

Yes, you can use cross-source correlation to reconstruct attack sequences from raw authentication and network logs. By applying temporal joins and entity pivoting, you reconstruct the kill-chain across cloud audit and endpoint sources for incident investigation.

Does security log analysis work for both Linux auth patterns and cloud audit sources?▼

Security log analysis works for both Linux auth patterns and cloud audit sources by interpreting sudo usage, SSH successes, and cloud telemetry. It clarifies what each log source reveals and maps the findings to verifiable MITRE ATT&CK data sources.

What severity classifications are used when generating incident investigation reports from endpoint telemetry?▼

Generating incident investigation reports from endpoint telemetry uses a structured format with severity classifications ranging from P1 to P4. These reports include evidence, timeline entries, visibility gaps, and recommendations mapped directly to MITRE ATT&CK techniques.

Related Skills

Explore More Data & Analytics Skills→
jaskaranhundaljaskaranhundal
3

threat-hunting

Execute hypothesis-driven, IOC-driven, and anomaly-driven threat hunting across endpoint, network, and cloud telemetry.

Community
Advanced
aviskaaraviskaar
6

security-operations

Establish and manage SOC capabilities with SIEM configuration and incident response.

Official
Advanced
matteocervellimatteocervelli
25

vulnerability-assessor

Assess software vulnerabilities with CVSS scoring and remediation planning.

Community
Advanced
coreymaypraycoreymaypray
1

threat-detection-engineer

Author Sigma detection rules with MITRE ATT&CK mapping for SIEM deployment.

Community
Advanced