siem-log-analysis

Build a forensic timeline by ingesting network device syslog into Splunk, ELK, or QRadar, then applying normalization, correlation, and anomaly detection. The Skill provides platform-specific query patterns and platform-agnostic triage guidance to construct incident timelines.

Yes, you can analyze firewall denies, VPN tunnel state, authentication failures, and configuration changes across Splunk, ELK, and QRadar. The Skill provides platform-agnostic diagnostic reasoning with inline platform-specific query syntax for cross-platform network log forensics.

Detect lateral movement indicators by correlating network device syslog events like authentication failures and configuration changes. The Skill guides threat hunting evidence gathering with platform-specific queries for Splunk, ELK, and QRadar to surface anomalies.

Yes, this SIEM log analysis approach works for compliance log reviews. It provides platform-agnostic workflow guidance for normalizing and correlating network syslog events across Splunk, ELK, and QRadar to document findings for compliance checks.

Normalize and correlate multi-vendor network logs by applying platform-agnostic diagnostic reasoning to syslog events. The Skill provides specific query patterns for Splunk, ELK, and QRadar to triage firewall denies, interface events, and lateral movement indicators.

Yes, you need Splunk, ELK, or QRadar to execute the platform-specific query patterns provided by the Skill. The Skill delivers platform-agnostic normalization and correlation guidance, but relies on these SIEM platforms to query network device syslog events.