skills.rest
ancoleman
ancolemanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

siem-logging

Configure SIEM systems for threat detection, log aggregation, and compliance.

503|73|Updated Nov 13, 2025
Search Tags:#compliance#log aggregation#incident response#threat detection#siem#security logging
One-click install
npx skills add https://github.com/ancoleman/ai-design-components --skill siem-logging
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: siem-logging
Source: https://github.com/ancoleman/ai-design-components/tree/main/skills/siem-logging
Command: npx skills add https://github.com/ancoleman/ai-design-components --skill siem-logging

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps you establish a robust Security Information and Event Management (SIEM) system to centralize security logs, enabling effective threat detection, incident investigation, and compliance.

Core Features & Use Cases

  • SIEM Platform Selection: Provides a decision framework for choosing between Elastic SIEM, Microsoft Sentinel, Wazuh, and Splunk based on budget, infrastructure, and expertise.
  • Detection Rule Development: Guides the creation of universal SIGMA rules and platform-specific queries (EQL, KQL, SPL) for threat detection.
  • Log Aggregation Architecture: Details centralized, distributed, and cloud-native architectures for collecting logs.
  • Compliance & Retention: Outlines log retention policies to meet GDPR, HIPAA, PCI DSS, and SOC 2 requirements.
  • Alert Tuning: Strategies for reducing false positives and optimizing alert quality.
  • Use Case: Implement a SIEM solution to monitor for brute-force attacks, detect privilege escalation, and ensure audit trails for compliance.

Quick Start

Use the siem-logging skill to configure Microsoft Sentinel for Azure AD log ingestion.

Frequently Asked Questions about siem-logging

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I choose the best SIEM platform for threat detection and compliance?▼

Choosing a SIEM platform involves evaluating budget, infrastructure, and expertise to select between Elastic SIEM, Microsoft Sentinel, Wazuh, and Splunk for effective threat detection and compliance.

How do I write detection rules using SIGMA and platform-specific languages?▼

Detection rule development uses universal SIGMA rules alongside platform-specific queries like EQL, KQL, and SPL to identify threats such as privilege escalation and brute-force attacks.

What log retention policies are needed for GDPR, HIPAA, and PCI DSS compliance?▼

Log retention policies for GDPR, HIPAA, PCI DSS, and SOC 2 compliance require configuring specific data preservation durations within your SIEM to ensure audit trails meet regulatory standards.

Can I configure Microsoft Sentinel for Azure AD log ingestion?▼

Configuring Microsoft Sentinel for Azure AD log ingestion is supported, utilizing a cloud-native log aggregation architecture to centralize security events for incident investigation.

What architectures support centralized security logging across cloud and on-premise infrastructure?▼

Centralized security logging across cloud and on-premise infrastructure utilizes centralized, distributed, and cloud-native architectures to aggregate logs for threat hunting and regulatory compliance.

Why does my SIEM generate so many false positives during threat detection?▼

High false positives in threat detection occur when SIEM rules lack optimization; alert tuning strategies reduce noise by refining detection rules to improve overall alert quality.

Related Skills

Explore More Legal & Compliance Skills→
KILWA73KILWA73

siem-incident-summarizer

Extract remediation guidance from SIEM logs into before/after code fixes.

Community
Advanced
Happy-Technologies-LLCHappy-Technologies-LLC
34

incident-response

Automate security incident detection, classification, containment, investigation, and remediation in ServiceNow.

Official
Advanced
dandyedandye
120

enrich-ioc

Enrich IOC indicators with GTI and Chronicle SIEM context to output threat findings and summaries.

Community
Advanced
oborchersoborchers
28

security-monitoring-from-day-one

Deploy managed cloud security services for threat detection and compliance scanning.

Community
Advanced