skills.rest
SherifEldeeb
SherifEldeebCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

log-forensics

Correlate Windows Event Logs, Syslog, and web logs to construct forensic timelines.

5|Updated Jan 12, 2026
Search Tags:#timeline#parsing#IOC#forensics#log-analysis#windows-evtx#syslog
One-click install
npx skills add https://github.com/SherifEldeeb/agentskills --skill log-forensics
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: log-forensics
Source: https://github.com/SherifEldeeb/agentskills/tree/main/skills/forensics/log-forensics
Command: npx skills add https://github.com/SherifEldeeb/agentskills --skill log-forensics

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Log data from multiple sources is often scattered, making forensic investigations slow and error-prone. This Skill provides a unified approach to parsing, normalizing, and analyzing logs to reconstruct events and detect indicators of compromise.

Core Features & Use Cases

  • Windows Event Log Analysis: Parse EVTX files and extract security-relevant events.
  • Syslog and web/server log integration: Correlate across sources and build timelines.
  • IOC and anomaly detection: Identify indicators, unusual patterns, and cross-source correlations.
  • Use Case: Investigate a security incident by aligning events from EVTX, Syslog, and web logs to determine attacker steps and affected hosts.

Quick Start

Load logs with the LogForensics parser and generate a timeline to start an investigation.

Frequently Asked Questions about log-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I correlate Windows Event Logs and Syslog for a forensic investigation?▼

Correlating Windows Event Logs and Syslog for forensic investigations involves parsing EVTX files and syslog data to normalize events across sources. This Skill aligns logs from diverse sources to build unified timelines and extract indicators of compromise.

How does log parsing help reconstruct events during post-incident analysis?▼

Log parsing for post-incident analysis works by extracting security-relevant events from EVTX, syslog, and web server logs. This process normalizes scattered log data to reconstruct attacker steps and detect anomalies across affected hosts.

Do I need Python and specific libraries to parse EVTX files for IOC extraction?▼

Yes, parsing EVTX files for IOC extraction requires Python 3.9 or higher. You also need optional libraries such as python-evtx, lxml, and pandas to support log parsing, timeline construction, and cross-source correlation.

Can I use this approach to analyze web server logs and application logs together?▼

Yes, you can analyze web server logs and application logs together. This Skill provides a unified approach to parsing and normalizing diverse log sources, enabling cross-source correlations and timeline construction for post-incident analysis.

What is the best way to build a forensic timeline from scattered log sources?▼

The best way to build a forensic timeline from scattered logs is to load data with a unified parser that normalizes timestamps and events. This Skill aligns EVTX, syslog, and web logs to determine attacker steps and generate an actionable timeline.

Related Skills

Explore More Data & Analytics Skills→
FuzzdkkFuzzdkk
3

log-analysis

Parse and analyze security logs to detect anomalous activity.

Community
Intermediate
zenobi-uszenobi-us
68

incident-responder

Coordinate incident response for security breaches and operational incidents.

Official
Advanced
jmaglyjmagly
175

ioc-extraction

Extracts and classifies ICOs from investigatorial source files, mapping them to STIX 2.1 objects.

Community
Advanced
JansenAnalyticsJansenAnalytics
5

error-monitor

Monitor application logs and stderr to detect errors, crashes, and exceptions.

Community
Intermediate