siem-log-analysis
CommunityCross-platform SIEM log forensics.
System Documentation
What problem does it solve?
Network-security-focused SIEM log analysis across Splunk, ELK, and QRadar platforms. Guides forensic timeline construction from network device syslog events — firewall denies, authentication failures, configuration changes, interface events, VPN tunnel state, and lateral movement indicators. Provides platform-independent diagnostic reasoning with platform-specific query syntax using [Splunk]/[ELK]/[QRadar] inline labels.
Core Features & Use Cases
- Platform-agnostic workflow guidance for normalization, correlation, anomaly detection, and triage across Splunk, ELK, and QRadar.
- Platform-specific query patterns and references to construct timelines, detect anomalies, and document findings.
- Real-world use cases include incident investigation timelines, threat-hunting evidence gathering, and compliance log-review checks.
Quick Start
Run an initial forensic timeline from 7 days of network device syslog across Splunk, ELK, and QRadar.
Dependency Matrix
Required Modules
None requiredComponents
💻 Claude Code Installation
Recommended: Let Claude install automatically. Simply copy and paste the text below to Claude Code.
Please help me install this Skill: Name: siem-log-analysis Download link: https://github.com/vahagn-madatyan/netsec-skills-suite/archive/main.zip#siem-log-analysis Please download this .zip file, extract it, and install it in the .claude/skills/ directory.
Agent Skills Search Helper
Install a tiny helper to your Agent, search and equip skill from 471,000+ vetted skills library on demand.