[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE6RHJY9MGAF425P0WSSST":3,"skill-same:01M6AE6RHJY9MGAF425P0WSSST":110},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":36,"linkOnly":37,"markdownContent":38,"markdownBody":39,"frontMatter":40,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":60,"repositoryHtmlUrl":61,"repositoryHomepageUrl":62,"ownerHtmlUrl":63,"ownerBlogUrl":64,"ownerDescription":65,"updatedAt":66,"install":67,"resources":80},"01M6AE6RHJY9MGAF425P0WSSST","correlating-security-events-in-qradar",null,"Correlates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules, building blocks, and offense management to detect multi-stage attacks across network, endpoint, and application log sources. Use when SOC analysts need to investigate QRadar offenses, build correlation rules, or tune detection logic for reducing false positives.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fcorrelating-security-events-in-qradar\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35],"security","correlating security events in qradar","cybersecurity","siem","soc","network","correlation","endpoint","qradar","aql","offense-management","ibm","2026-11-10 10:12:30",false,"---\nname: correlating-security-events-in-qradar\ndescription: 'Correlates security events in IBM QRadar SIEM using AQL (Ariel Query\n  Language), custom rules, building blocks, and offense management to detect multi-stage\n  attacks across network, endpoint, and application log sources. Use when SOC analysts\n  need to investigate QRadar offenses, build correlation rules, or tune detection\n  logic for reducing false positives.\n\n  '\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- qradar\n- siem\n- aql\n- correlation\n- offense-management\n- ibm\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1078\n- T1110.003\n- T1021\n- T1071.001\n- T1041\n---\n# Correlating Security Events in QRadar\n\n## When to Use\n\nUse this skill when:\n- SOC analysts need to investigate QRadar offenses and correlate events across multiple log sources\n- Detection engineers build custom correlation rules to identify multi-stage attacks\n- Alert tuning is required to reduce false positive offenses and improve signal quality\n- The team migrates from basic event monitoring to behavior-based correlation\n\n**Do not use** for log source onboarding or parsing — that requires QRadar administrator access and DSM editor knowledge.\n\n## Prerequisites\n\n- IBM QRadar SIEM 7.5+ with offense management enabled\n- AQL knowledge for ad-hoc event and flow queries\n- Log sources normalized with proper QID mappings (Windows, firewall, proxy, endpoint)\n- User role with offense management, rule creation, and AQL search permissions\n- Reference sets\u002Fmaps configured for whitelist and watchlist management\n\n## Workflow\n\n### Step 1: Investigate an Offense with AQL\n\nOpen an offense in QRadar and query contributing events using AQL (Ariel Query Language):\n\n```sql\nSELECT DATEFORMAT(startTime, 'yyyy-MM-dd HH:mm:ss') AS event_time,\n       sourceIP, destinationIP, username,\n       LOGSOURCENAME(logSourceId) AS log_source,\n       QIDNAME(qid) AS event_name,\n       category, magnitude\nFROM events\nWHERE INOFFENSE(12345)\nORDER BY startTime ASC\nLIMIT 500\n```\n\nPivot on the source IP to find all activity:\n\n```sql\nSELECT DATEFORMAT(startTime, 'yyyy-MM-dd HH:mm:ss') AS event_time,\n       destinationIP, destinationPort, username,\n       QIDNAME(qid) AS event_name,\n       eventCount, category\nFROM events\nWHERE sourceIP = '192.168.1.105'\n  AND startTime > NOW() - 24*60*60*1000\nORDER BY startTime ASC\nLIMIT 1000\n```\n\n### Step 2: Build a Custom Correlation Rule\n\nCreate a multi-condition rule detecting brute force followed by successful login:\n\n**Rule 1 — Brute Force Detection (Building Block):**\n```\nRule Type: Event\nRule Name: BB: Multiple Failed Logins from Same Source\nTests:\n  - When the event(s) were detected by one or more of [Local]\n  - AND when the event QID is one of [Authentication Failure (5000001)]\n  - AND when at least 10 events are seen with the same Source IP\n    in 5 minutes\nRule Action: Dispatch new event (Category: Authentication, QID: Custom_BruteForce)\n```\n\n**Rule 2 — Brute Force Succeeded (Correlation Rule):**\n```\nRule Type: Offense\nRule Name: COR: Brute Force with Subsequent Successful Login\nTests:\n  - When an event matches the building block BB: Multiple Failed Logins from Same Source\n  - AND when an event with QID [Authentication Success (5000000)] is detected\n    from the same Source IP within 10 minutes\n  - AND the Destination IP is the same for both events\nRule Action: Create offense, set severity to High, set relevance to 8\n```\n\n### Step 3: Use AQL for Cross-Source Correlation\n\nCorrelate authentication failures with network flows to detect lateral movement:\n\n```sql\nSELECT e.sourceIP, e.destinationIP, e.username,\n       QIDNAME(e.qid) AS event_name,\n       e.eventCount,\n       f.sourceBytes, f.destinationBytes\nFROM events e\nLEFT JOIN flows f ON e.sourceIP = f.sourceIP\n  AND e.destinationIP = f.destinationIP\n  AND f.startTime BETWEEN e.startTime AND e.startTime + 300000\nWHERE e.category = 'Authentication'\n  AND e.sourceIP IN (\n    SELECT sourceIP FROM events\n    WHERE QIDNAME(qid) = 'Authentication Failure'\n      AND startTime > NOW() - 3600000\n    GROUP BY sourceIP\n    HAVING COUNT(*) > 20\n  )\n  AND e.startTime > NOW() - 3600000\nORDER BY e.startTime ASC\n```\n\nDetect data exfiltration by correlating DNS queries with large outbound flows:\n\n```sql\nSELECT sourceIP, destinationIP,\n       SUM(sourceBytes) AS total_bytes_out,\n       COUNT(*) AS flow_count\nFROM flows\nWHERE sourceIP IN (\n    SELECT sourceIP FROM events\n    WHERE QIDNAME(qid) ILIKE '%DNS%'\n      AND destinationIP NOT IN (\n        SELECT ip FROM reference_data.sets('Internal_DNS_Servers')\n      )\n      AND startTime > NOW() - 86400000\n    GROUP BY sourceIP\n    HAVING COUNT(*) > 500\n  )\n  AND destinationPort NOT IN (80, 443, 53)\n  AND startTime > NOW() - 86400000\nGROUP BY sourceIP, destinationIP\nHAVING SUM(sourceBytes) > 104857600\nORDER BY total_bytes_out DESC\n```\n\n### Step 4: Configure Reference Sets for Context Enrichment\n\nCreate reference sets for dynamic whitelists and watchlists:\n\n```bash\n# Create reference set via QRadar API\ncurl -X POST \"https:\u002F\u002Fqradar.example.com\u002Fapi\u002Freference_data\u002Fsets\" \\\n  -H \"SEC: YOUR_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"Known_Pen_Test_IPs\",\n    \"element_type\": \"IP\",\n    \"timeout_type\": \"LAST_SEEN\",\n    \"time_to_live\": \"30 days\"\n  }'\n\n# Add entries\ncurl -X POST \"https:\u002F\u002Fqradar.example.com\u002Fapi\u002Freference_data\u002Fsets\u002FKnown_Pen_Test_IPs\" \\\n  -H \"SEC: YOUR_API_TOKEN\" \\\n  -d \"value=10.0.5.100\"\n```\n\nUse reference sets in rule conditions to exclude known benign activity:\n\n```\nTest: AND when the Source IP is NOT contained in any of [Known_Pen_Test_IPs]\nTest: AND when the Destination IP is contained in any of [Critical_Asset_IPs]\n```\n\n### Step 5: Tune Offense Generation\n\nReduce false positives by adding building block filters:\n\n```sql\n-- Find top false positive generators\nSELECT QIDNAME(qid) AS event_name,\n       LOGSOURCENAME(logSourceId) AS log_source,\n       COUNT(*) AS event_count,\n       COUNT(DISTINCT sourceIP) AS unique_sources\nFROM events\nWHERE INOFFENSE(\n    SELECT offenseId FROM offenses\n    WHERE status = 'CLOSED'\n      AND closeReason = 'False Positive'\n      AND startTime > NOW() - 30*24*60*60*1000\n  )\nGROUP BY qid, logSourceId\nORDER BY event_count DESC\nLIMIT 20\n```\n\nApply tuning:\n- Add high-frequency false positive sources to reference set exclusions\n- Increase event thresholds on noisy rules (e.g., 10 failed logins -> 25 for service accounts)\n- Set offense coalescing to group related events under a single offense\n\n### Step 6: Build Custom Dashboard for Correlation Monitoring\n\nCreate a QRadar Pulse dashboard with key correlation metrics:\n\n```sql\n-- Active offenses by category\nSELECT offenseType, status, COUNT(*) AS offense_count,\n       AVG(magnitude) AS avg_magnitude\nFROM offenses\nWHERE status = 'OPEN'\nGROUP BY offenseType, status\nORDER BY offense_count DESC\n\n-- Mean time to close offenses\nSELECT DATEFORMAT(startTime, 'yyyy-MM-dd') AS day,\n       AVG(closeTime - startTime) \u002F 60000 AS avg_close_minutes,\n       COUNT(*) AS closed_count\nFROM offenses\nWHERE status = 'CLOSED'\n  AND startTime > NOW() - 30*24*60*60*1000\nGROUP BY DATEFORMAT(startTime, 'yyyy-MM-dd')\nORDER BY day\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **AQL** | Ariel Query Language — QRadar's SQL-like query language for searching events, flows, and offenses |\n| **Offense** | QRadar's correlated incident grouping multiple events\u002Fflows under a single investigation unit |\n| **Building Block** | Reusable rule component that categorizes events without generating offenses, used as input to correlation rules |\n| **Magnitude** | QRadar's calculated offense severity combining relevance, severity, and credibility scores (1-10) |\n| **Reference Set** | Dynamic lookup table in QRadar for whitelists, watchlists, and enrichment data used in rules |\n| **QID** | QRadar Identifier — unique numeric ID mapping vendor-specific events to normalized categories |\n| **Coalescing** | QRadar's mechanism for grouping related events into a single offense to reduce analyst workload |\n\n## Tools & Systems\n\n- **IBM QRadar SIEM**: Enterprise SIEM platform with event correlation, offense management, and AQL query engine\n- **QRadar Pulse**: Dashboard framework for building custom visualizations of offense and event metrics\n- **QRadar API**: RESTful API for automating reference set management, offense operations, and rule deployment\n- **QRadar Use Case Manager**: App for mapping detection rules to MITRE ATT&CK framework coverage\n- **QRadar Assistant**: AI-powered analysis tool helping analysts investigate offenses with natural language\n\n## Common Scenarios\n\n- **Brute Force to Compromise**: Correlate failed auth events with subsequent successful login from same source\n- **Lateral Movement Chain**: Track authentication events across multiple internal hosts from a single source\n- **C2 Beaconing**: Correlate periodic DNS queries with low-entropy payloads to unusual domains\n- **Privilege Escalation**: Correlate user account changes (group additions) with prior suspicious authentication\n- **Data Exfiltration**: Correlate large outbound flow volumes with prior internal reconnaissance activity\n\n## Output Format\n\n```\nQRADAR OFFENSE INVESTIGATION — Offense #12345\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nOffense Type:   Brute Force with Subsequent Access\nMagnitude:      8\u002F10 (Severity: 8, Relevance: 9, Credibility: 7)\nCreated:        2024-03-15 14:23:07 UTC\nContributing:   247 events from 3 log sources\n\nCorrelation Chain:\n  14:10-14:22  — 234 Authentication Failures (EventCode 4625) from 192.168.1.105 to DC-01\n  14:23:07     — Authentication Success (EventCode 4624) from 192.168.1.105 to DC-01 (user: admin)\n  14:25:33     — New Process: cmd.exe spawned by admin on DC-01\n  14:26:01     — Net.exe user \u002Fadd detected on DC-01\n\nSources Correlated:\n  Windows Security Logs (DC-01)\n  Sysmon (DC-01)\n  Firewall (Palo Alto PA-5260)\n\nDisposition:    TRUE POSITIVE — Escalated to Incident Response\nTicket:         IR-2024-0432\n```\n","# Correlating Security Events in QRadar\n\n## When to Use\n\nUse this skill when:\n- SOC analysts need to investigate QRadar offenses and correlate events across multiple log sources\n- Detection engineers build custom correlation rules to identify multi-stage attacks\n- Alert tuning is required to reduce false positive offenses and improve signal quality\n- The team migrates from basic event monitoring to behavior-based correlation\n\n**Do not use** for log source onboarding or parsing — that requires QRadar administrator access and DSM editor knowledge.\n\n## Prerequisites\n\n- IBM QRadar SIEM 7.5+ with offense management enabled\n- AQL knowledge for ad-hoc event and flow queries\n- Log sources normalized with proper QID mappings (Windows, firewall, proxy, endpoint)\n- User role with offense management, rule creation, and AQL search permissions\n- Reference sets\u002Fmaps configured for whitelist and watchlist management\n\n## Workflow\n\n### Step 1: Investigate an Offense with AQL\n\nOpen an offense in QRadar and query contributing events using AQL (Ariel Query Language):\n\n```sql\nSELECT DATEFORMAT(startTime, 'yyyy-MM-dd HH:mm:ss') AS event_time,\n       sourceIP, destinationIP, username,\n       LOGSOURCENAME(logSourceId) AS log_source,\n       QIDNAME(qid) AS event_name,\n       category, magnitude\nFROM events\nWHERE INOFFENSE(12345)\nORDER BY startTime ASC\nLIMIT 500\n```\n\nPivot on the source IP to find all activity:\n\n```sql\nSELECT DATEFORMAT(startTime, 'yyyy-MM-dd HH:mm:ss') AS event_time,\n       destinationIP, destinationPort, username,\n       QIDNAME(qid) AS event_name,\n       eventCount, category\nFROM events\nWHERE sourceIP = '192.168.1.105'\n  AND startTime > NOW() - 24*60*60*1000\nORDER BY startTime ASC\nLIMIT 1000\n```\n\n### Step 2: Build a Custom Correlation Rule\n\nCreate a multi-condition rule detecting brute force followed by successful login:\n\n**Rule 1 — Brute Force Detection (Building Block):**\n```\nRule Type: Event\nRule Name: BB: Multiple Failed Logins from Same Source\nTests:\n  - When the event(s) were detected by one or more of [Local]\n  - AND when the event QID is one of [Authentication Failure (5000001)]\n  - AND when at least 10 events are seen with the same Source IP\n    in 5 minutes\nRule Action: Dispatch new event (Category: Authentication, QID: Custom_BruteForce)\n```\n\n**Rule 2 — Brute Force Succeeded (Correlation Rule):**\n```\nRule Type: Offense\nRule Name: COR: Brute Force with Subsequent Successful Login\nTests:\n  - When an event matches the building block BB: Multiple Failed Logins from Same Source\n  - AND when an event with QID [Authentication Success (5000000)] is detected\n    from the same Source IP within 10 minutes\n  - AND the Destination IP is the same for both events\nRule Action: Create offense, set severity to High, set relevance to 8\n```\n\n### Step 3: Use AQL for Cross-Source Correlation\n\nCorrelate authentication failures with network flows to detect lateral movement:\n\n```sql\nSELECT e.sourceIP, e.destinationIP, e.username,\n       QIDNAME(e.qid) AS event_name,\n       e.eventCount,\n       f.sourceBytes, f.destinationBytes\nFROM events e\nLEFT JOIN flows f ON e.sourceIP = f.sourceIP\n  AND e.destinationIP = f.destinationIP\n  AND f.startTime BETWEEN e.startTime AND e.startTime + 300000\nWHERE e.category = 'Authentication'\n  AND e.sourceIP IN (\n    SELECT sourceIP FROM events\n    WHERE QIDNAME(qid) = 'Authentication Failure'\n      AND startTime > NOW() - 3600000\n    GROUP BY sourceIP\n    HAVING COUNT(*) > 20\n  )\n  AND e.startTime > NOW() - 3600000\nORDER BY e.startTime ASC\n```\n\nDetect data exfiltration by correlating DNS queries with large outbound flows:\n\n```sql\nSELECT sourceIP, destinationIP,\n       SUM(sourceBytes) AS total_bytes_out,\n       COUNT(*) AS flow_count\nFROM flows\nWHERE sourceIP IN (\n    SELECT sourceIP FROM events\n    WHERE QIDNAME(qid) ILIKE '%DNS%'\n      AND destinationIP NOT IN (\n        SELECT ip FROM reference_data.sets('Internal_DNS_Servers')\n      )\n      AND startTime > NOW() - 86400000\n    GROUP BY sourceIP\n    HAVING COUNT(*) > 500\n  )\n  AND destinationPort NOT IN (80, 443, 53)\n  AND startTime > NOW() - 86400000\nGROUP BY sourceIP, destinationIP\nHAVING SUM(sourceBytes) > 104857600\nORDER BY total_bytes_out DESC\n```\n\n### Step 4: Configure Reference Sets for Context Enrichment\n\nCreate reference sets for dynamic whitelists and watchlists:\n\n```bash\n# Create reference set via QRadar API\ncurl -X POST \"https:\u002F\u002Fqradar.example.com\u002Fapi\u002Freference_data\u002Fsets\" \\\n  -H \"SEC: YOUR_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"Known_Pen_Test_IPs\",\n    \"element_type\": \"IP\",\n    \"timeout_type\": \"LAST_SEEN\",\n    \"time_to_live\": \"30 days\"\n  }'\n\n# Add entries\ncurl -X POST \"https:\u002F\u002Fqradar.example.com\u002Fapi\u002Freference_data\u002Fsets\u002FKnown_Pen_Test_IPs\" \\\n  -H \"SEC: YOUR_API_TOKEN\" \\\n  -d \"value=10.0.5.100\"\n```\n\nUse reference sets in rule conditions to exclude known benign activity:\n\n```\nTest: AND when the Source IP is NOT contained in any of [Known_Pen_Test_IPs]\nTest: AND when the Destination IP is contained in any of [Critical_Asset_IPs]\n```\n\n### Step 5: Tune Offense Generation\n\nReduce false positives by adding building block filters:\n\n```sql\n-- Find top false positive generators\nSELECT QIDNAME(qid) AS event_name,\n       LOGSOURCENAME(logSourceId) AS log_source,\n       COUNT(*) AS event_count,\n       COUNT(DISTINCT sourceIP) AS unique_sources\nFROM events\nWHERE INOFFENSE(\n    SELECT offenseId FROM offenses\n    WHERE status = 'CLOSED'\n      AND closeReason = 'False Positive'\n      AND startTime > NOW() - 30*24*60*60*1000\n  )\nGROUP BY qid, logSourceId\nORDER BY event_count DESC\nLIMIT 20\n```\n\nApply tuning:\n- Add high-frequency false positive sources to reference set exclusions\n- Increase event thresholds on noisy rules (e.g., 10 failed logins -> 25 for service accounts)\n- Set offense coalescing to group related events under a single offense\n\n### Step 6: Build Custom Dashboard for Correlation Monitoring\n\nCreate a QRadar Pulse dashboard with key correlation metrics:\n\n```sql\n-- Active offenses by category\nSELECT offenseType, status, COUNT(*) AS offense_count,\n       AVG(magnitude) AS avg_magnitude\nFROM offenses\nWHERE status = 'OPEN'\nGROUP BY offenseType, status\nORDER BY offense_count DESC\n\n-- Mean time to close offenses\nSELECT DATEFORMAT(startTime, 'yyyy-MM-dd') AS day,\n       AVG(closeTime - startTime) \u002F 60000 AS avg_close_minutes,\n       COUNT(*) AS closed_count\nFROM offenses\nWHERE status = 'CLOSED'\n  AND startTime > NOW() - 30*24*60*60*1000\nGROUP BY DATEFORMAT(startTime, 'yyyy-MM-dd')\nORDER BY day\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **AQL** | Ariel Query Language — QRadar's SQL-like query language for searching events, flows, and offenses |\n| **Offense** | QRadar's correlated incident grouping multiple events\u002Fflows under a single investigation unit |\n| **Building Block** | Reusable rule component that categorizes events without generating offenses, used as input to correlation rules |\n| **Magnitude** | QRadar's calculated offense severity combining relevance, severity, and credibility scores (1-10) |\n| **Reference Set** | Dynamic lookup table in QRadar for whitelists, watchlists, and enrichment data used in rules |\n| **QID** | QRadar Identifier — unique numeric ID mapping vendor-specific events to normalized categories |\n| **Coalescing** | QRadar's mechanism for grouping related events into a single offense to reduce analyst workload |\n\n## Tools & Systems\n\n- **IBM QRadar SIEM**: Enterprise SIEM platform with event correlation, offense management, and AQL query engine\n- **QRadar Pulse**: Dashboard framework for building custom visualizations of offense and event metrics\n- **QRadar API**: RESTful API for automating reference set management, offense operations, and rule deployment\n- **QRadar Use Case Manager**: App for mapping detection rules to MITRE ATT&CK framework coverage\n- **QRadar Assistant**: AI-powered analysis tool helping analysts investigate offenses with natural language\n\n## Common Scenarios\n\n- **Brute Force to Compromise**: Correlate failed auth events with subsequent successful login from same source\n- **Lateral Movement Chain**: Track authentication events across multiple internal hosts from a single source\n- **C2 Beaconing**: Correlate periodic DNS queries with low-entropy payloads to unusual domains\n- **Privilege Escalation**: Correlate user account changes (group additions) with prior suspicious authentication\n- **Data Exfiltration**: Correlate large outbound flow volumes with prior internal reconnaissance activity\n\n## Output Format\n\n```\nQRADAR OFFENSE INVESTIGATION — Offense #12345\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nOffense Type:   Brute Force with Subsequent Access\nMagnitude:      8\u002F10 (Severity: 8, Relevance: 9, Credibility: 7)\nCreated:        2024-03-15 14:23:07 UTC\nContributing:   247 events from 3 log sources\n\nCorrelation Chain:\n  14:10-14:22  — 234 Authentication Failures (EventCode 4625) from 192.168.1.105 to DC-01\n  14:23:07     — Authentication Success (EventCode 4624) from 192.168.1.105 to DC-01 (user: admin)\n  14:25:33     — New Process: cmd.exe spawned by admin on DC-01\n  14:26:01     — Net.exe user \u002Fadd detected on DC-01\n\nSources Correlated:\n  Windows Security Logs (DC-01)\n  Sysmon (DC-01)\n  Firewall (Palo Alto PA-5260)\n\nDisposition:    TRUE POSITIVE — Escalated to Incident Response\nTicket:         IR-2024-0432\n```\n",{"name":5,"tags":41,"author":42,"domain":26,"license":15,"version":43,"nist_csf":44,"subdomain":49,"description":50,"mitre_attack":51},[28,32,27,33,30,34,35],"mahipal","1.0",[45,46,47,48],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations","Correlates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules, building blocks, and offense management to detect multi-stage attacks across network, endpoint, and application log sources. Use when SOC analysts need to investigate QRadar offenses, build correlation rules, or tune detection logic for reducing false positives.\n",[52,53,54,55,56],"T1078","T1110.003","T1021","T1071.001","T1041","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fcorrelating-security-events-in-qradar",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":68,"prompt":78,"zipAvailable":79},[69,72,75],{"tool":70,"command":71},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill correlating-security-events-in-qradar",{"tool":73,"command":74},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill correlating-security-events-in-qradar",{"tool":76,"command":77},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill correlating-security-events-in-qradar","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fcorrelating-security-events-in-qradar\u002FSKILL.md",true,[81,87,92,96,100,104],{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"agents\u002Fopenai.yaml","REFERENCE","参考文档",350,"https:\u002F\u002Fgithub.com\u002Fpydantic\u002Fpydantic-ai\u002Fblob\u002Fmain\u002Fpydantic_ai_slim\u002Fpydantic_ai\u002F.agents\u002Fskills\u002Fmigrating-pi-to-pydantic-ai\u002Fagents\u002Fopenai.yaml",{"path":88,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fcorrelating-security-events-in-qradar\u002FLICENSE",{"path":93,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fapi-reference.md",2295,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fcorrelating-security-events-in-qradar\u002Freferences\u002Fapi-reference.md",{"path":97,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002FRESEARCH-AND-MAPPING.md",12364,"https:\u002F\u002Fgithub.com\u002Fpydantic\u002Fpydantic-ai\u002Fblob\u002Fmain\u002Fpydantic_ai_slim\u002Fpydantic_ai\u002F.agents\u002Fskills\u002Fmigrating-pi-to-pydantic-ai\u002Freferences\u002FRESEARCH-AND-MAPPING.md",{"path":101,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002FVERIFICATION-AND-CUTOVER.md",7244,"https:\u002F\u002Fgithub.com\u002Fpydantic\u002Fpydantic-ai\u002Fblob\u002Fmain\u002Fpydantic_ai_slim\u002Fpydantic_ai\u002F.agents\u002Fskills\u002Fmigrating-pi-to-pydantic-ai\u002Freferences\u002FVERIFICATION-AND-CUTOVER.md",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"scripts\u002Fagent.py","SCRIPT","脚本",6651,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fcorrelating-security-events-in-qradar\u002Fscripts\u002Fagent.py",[111,137,161,189,215,242],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":118,"publishedAt":36},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[117],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[119,120,121,122,24,26,123,124,125,126,127,128,129,130,131,132,133,134,135,136],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":144,"publishedAt":36},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[143],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[145,133,146,147,24,148,26,125,149,150,151,152,153,154,155,156,157,158,159,160],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":171,"publishedAt":36},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[167,170],{"categoryNo":168,"categoryName":169,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[155,172,173,174,175,26,176,177,149,178,179,180,181,182,183,184,185,186,187,188],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":196,"publishedAt":36},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[195],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[197,198,199,26,200,201,202,203,204,205,206,207,208,209,210,211,152,212,213,214],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":216,"name":217,"nameZh":6,"description":218,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":219,"categories":220,"keywords":222,"publishedAt":36},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[221],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[223,224,225,26,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":243,"name":244,"nameZh":6,"description":245,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":246,"categories":247,"keywords":249,"publishedAt":36},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[248],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[24,250,26,27,251,252,28,253,254,255,256,184,257,185,258,259,260,261,262,263],"triaging security incident","file","ioc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]