What problem does it solve? Operators of a TinySocs SIEM install often cannot tell whether the detection pipeline is actually working — health checks show ambiguous WARN/INFO rows, smoke tests have historically shipped broken, and naive OpenSearch queries produce false misses. This Skill provides verified, measurement-only procedures to prove whether event collection, detection, alerting, ledger integrity, and retention purging are genuinely functioning. ## Core Features & Use Cases - Health Check Interpretation: Explains all 16 Test-TinySocsHealth checks, which are structurally INFO/WARN on a minimal install, and why the literal $allPassed value — not the PASS count — is the real verdict. - End-to-End Smoke Test: Documents Invoke-TinySocsSmokeTest, which fires 20 failed logons to trip the TS-001 brute-force rule (threshold 15), including the historical scar where the committed test could never fire. - Direct Pipeline Queries: Provides curl.exe-based OpenSearch query patterns (day-index scoping, detection-floor timestamps, _source projection) that avoid PowerShell 5.1 TLS and ConvertFrom-Json pitfalls. - Coverage, Ledger, and Storage Diagnostics: Covers mitre_coverage.py regeneration, check_ledger.py --verify chain/anchor validation, ISM policy binding checks, purge endpoints, and agent disk-queue inspection. - Use Case: After a fresh install, run the 10-minute prove-the-pipeline runbook to confirm Windows audit events flow through the agent, OpenSearch, and detection engine into a real TS-001 alert document. ## Quick Start Ask the assistant to run the TinySocs health check and smoke test on this install and prove the alert pipeline works end to end.
