Windows Event Log Analysis in Splunk
Lets an agent hunt Windows authentication, privilege, persistence and lateral-movement threats in Splunk using SPL queries.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
When installed, this skill gives an AI agent a SOC-analyst playbook for Windows security logs stored in Splunk. It knows which Windows and Sysmon event IDs matter, and provides ready-made Splunk search queries (SPL) for spotting brute-force and password-spray attacks, privilege escalation, persistence such as scheduled tasks and registry Run keys, and lateral movement via SMB, PsExec and RDP, each mapped to MITRE ATT&CK techniques. It also includes a small Python helper that can connect to a Splunk server and run a brute-force search.
Great for
- SOC analysts investigating Windows alerts in Splunk who want faster query drafting
- Detection engineers writing or tuning Windows-based SPL detections
- Incident responders building forensic timelines of Windows hosts or domain controllers
Skip it if
- Linux or macOS endpoint analysis, which the skill itself says it does not cover
- Environments without Splunk and Windows event data ingested, since the queries will return nothing useful
- Running the queries unreviewed against production data: thresholds and field names are examples and may need tuning, and the Python helper can contact a live Splunk instance with credentials
Try asking
- “Write an SPL search to detect password spraying against our domain controllers over the last 24 hours”
- “Check our Splunk data for new scheduled tasks created from PowerShell or temp folders (T1053.005)”
- “Build a forensic timeline for host WS-042 from Windows Security and Sysmon logs”
- “Help me tune the brute-force threshold for RDP logons (Logon_Type 10) in our environment”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-windows-event-logs-in-splunk.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-windows-event-logs-in-splunk.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-windows-event-logs-in-splunk.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Test every query on a non-production Splunk index first and adjust thresholds (for example count > 20) to your baseline to reduce false positives.
- Use a least-privilege Splunk account with read-only search rights for scripts/agent.py rather than an admin password.
- Note that the Python file is incomplete (it ends mid-definition), so expect to use the SPL queries directly rather than running the script as-is.
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.