Windows Event Logging for Detection
Configure Windows audit policies and event forwarding so security tools can spot threats.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 7 files
What it does
When installed, the agent follows a checklist for setting up Windows so it records the security events defenders need, such as logons, process starts with command lines, privilege use, and account changes. It explains how to set these audit policies through Group Policy, enlarge the Security log, and forward events to a central collector or SIEM. It also gives a reference list of Windows event IDs that signal suspicious activity. Two included Python scripts can read the current auditpol settings on a Windows machine and compare them with the recommended values.
Great for
- System administrators hardening Windows servers or domain endpoints
- Security engineers building detection rules in a SIEM
- Students learning which Windows event IDs matter for detection
Skip it if
- Sysmon configuration or Linux audit logging, which the skill explicitly says belong to other skills
- Changing production audit policy without testing, since broad auditing can flood logs and fill storage
- Environments without Windows or without Group Policy access, where the steps cannot be applied
Try asking
- “Set up advanced audit policy on our domain controllers for logon and privilege monitoring”
- “Enable command line logging for process creation events and explain what Event 4688 gives us”
- “Check which audit categories are currently enabled on this Windows machine and compare them to the recommended settings”
- “Plan Windows Event Forwarding from endpoints to a collector server”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.
configuring-windows-event-logging-for-detection.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip configuring-windows-event-logging-for-detection.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip configuring-windows-event-logging-for-detection.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Run the audit-check script in read-only mode first to see the current state before changing any GPO settings.
- Test audit policy changes on a non-production machine, because enabling Success and Failure on many categories can produce large log volumes.
- Review the included PowerShell and wevtutil commands before running them with administrator rights, since they modify system logging configuration.
What's inside
- assets/template.md
- references/api-reference.md
- references/standards.md
- references/workflows.md
- scripts/agent.py
- scripts/process.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.