Skip to content
Get packs

Cloud SIEM with Microsoft Sentinel

Guides an agent through setting up Microsoft Sentinel, writing KQL detection queries and building Logic Apps response playbooks

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

This skill gives an AI agent a structured playbook for deploying Microsoft Sentinel, Azure's cloud-based security information and event management (SIEM) service, to collect logs from AWS, Azure and GCP. The agent can write KQL (Kusto Query Language) detection rules for threats such as impossible travel sign-ins and AWS credential abuse, map them to MITRE ATT&CK techniques, and outline automated response playbooks in Logic Apps, such as disabling a compromised Azure AD user. It also includes a Python helper script that runs KQL queries against a Log Analytics workspace using Azure credentials.

Great for

  • Security engineers standing up a central SOC across multiple clouds
  • Teams already on Azure who want cloud-native SIEM and SOAR automation
  • Analysts who know KQL and want an agent to draft detection and hunting queries

Skip it if

  • AWS-only environments, where the skill itself says Security Hub and GuardDuty may be enough
  • Endpoint detection needs, which the skill directs to Defender for Endpoint instead
  • Anyone running the playbooks or scripts against production without reviewing them first, since they can disable accounts and query live security logs

Try asking

  • “Write a KQL analytics rule that flags successful sign-ins from locations more than 500 km apart within an hour”
  • “Draft a Logic Apps playbook that disables an Azure AD user when a high-severity incident is raised”
  • “Create a KQL hunting query for mass S3 object deletion in AWS CloudTrail logs”
  • “Give me the az CLI commands to connect AWS CloudTrail to a new Sentinel workspace”
Step-by-step guide: how to use Cloud SIEM with Microsoft SentinelInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    building-cloud-siem-with-sentinel.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip building-cloud-siem-with-sentinel.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip building-cloud-siem-with-sentinel.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Review every az command and Logic Apps action before running it, especially the ones that disable users or change connectors; placeholder ARNs and resource names must be replaced
  • Use a least-privilege service principal or role for scripts/agent.py rather than broad subscription rights, and keep the client secret out of source control
  • Test KQL queries in a non-production workspace first, since the example thresholds (500 km, 100 deletes) are illustrative and need tuning to your environment

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.