[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFWT2912TB8DX4DCSXR3MH":3,"skill-same:01M6AFWT2912TB8DX4DCSXR3MH":129},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":73,"repositoryHtmlUrl":74,"repositoryHomepageUrl":75,"ownerHtmlUrl":76,"ownerBlogUrl":77,"ownerDescription":78,"updatedAt":79,"install":80,"resources":93},"01M6AFWT2912TB8DX4DCSXR3MH","performing-log-source-onboarding-in-siem",null,"Perform structured log source onboarding into SIEM platforms (Splunk, Elastic, Sentinel, QRadar, or similar) by prioritizing sources with a tiered value framework, configuring collectors, building parsers, normalizing fields to a common schema (e.g. CIM), and validating data quality. Use when planning or executing the integration of new log sources — such as Active Directory, firewalls, EDR, VPN, DNS, or cloud audit logs — into a SIEM for security monitoring and detection.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-log-source-onboarding-in-siem\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000038","人力资源",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"performing log source onboarding in siem","siem","onboarding","dns","log-management","t1566","t1078","edr","sentinel","elastic","data","splunk","directory","soc","monitoring","logs","audit","framework","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: performing-log-source-onboarding-in-siem\ndescription: Perform structured log source onboarding into SIEM platforms (Splunk,\n  Elastic, Sentinel, QRadar, or similar) by prioritizing sources with a tiered value\n  framework, configuring collectors, building parsers, normalizing fields to a common\n  schema (e.g. CIM), and validating data quality. Use when planning or executing\n  the integration of new log sources — such as Active Directory, firewalls, EDR,\n  VPN, DNS, or cloud audit logs — into a SIEM for security monitoring and detection.\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- siem\n- log-onboarding\n- log-management\n- data-ingestion\n- parsing\n- normalization\n- soc\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1078\n- T1685.002\n- T1685.005\n- T1566\n---\n\n# Performing Log Source Onboarding in SIEM\n\n## Overview\n\nLog source onboarding is the systematic process of integrating new data sources into a SIEM platform to enable security monitoring and detection. Proper onboarding requires planning data sources, configuring collection agents, building parsers, normalizing fields to a common schema, and validating data quality. According to the UK NCSC, onboarding should prioritize log sources that provide the highest security value relative to their ingestion cost.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing log source onboarding in siem\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- SIEM platform deployed (Splunk, Elastic, Sentinel, QRadar, or similar)\n- Network access from source systems to SIEM collectors\n- Administrative access on source systems for agent installation\n- Common Information Model (CIM) or equivalent schema documentation\n- Change management approval for production system modifications\n\n## Log Source Priority Framework\n\n### Tier 1 - Critical (Onboard First)\n\n| Source | Log Type | Security Value |\n|---|---|---|\n| Active Directory | Security Event Logs | Authentication, privilege escalation |\n| Firewalls | Traffic logs | Network access, C2 detection |\n| EDR\u002FAV | Endpoint alerts | Malware, process execution |\n| VPN\u002FRemote Access | Connection logs | Unauthorized access |\n| DNS Servers | Query logs | C2 beaconing, data exfiltration |\n| Email Gateway | Email security logs | Phishing, BEC |\n\n### Tier 2 - High Priority\n\n| Source | Log Type | Security Value |\n|---|---|---|\n| Web Proxy | HTTP\u002FHTTPS logs | Web-based attacks, data exfiltration |\n| Cloud platforms (AWS\u002FAzure\u002FGCP) | Audit logs | Cloud security posture |\n| Database servers | Audit\u002Fquery logs | Data access, SQL injection |\n| DHCP\u002FIPAM | Address allocation | Asset tracking |\n| File servers | Access logs | Data access monitoring |\n\n### Tier 3 - Standard\n\n| Source | Log Type | Security Value |\n|---|---|---|\n| Application servers | App logs | Application-level attacks |\n| Print servers | Print logs | Data loss prevention |\n| Badge\u002Fphysical access | Access logs | Physical security correlation |\n| Network devices (switches\u002Frouters) | Syslog | Network anomalies |\n\n## Onboarding Process\n\n### Step 1: Discovery and Assessment\n\n```\n1. Identify the log source:\n   - System type and version\n   - Log format (syslog, CEF, JSON, Windows Events, etc.)\n   - Log volume estimate (EPS - events per second)\n   - Network location and firewall requirements\n\n2. Assess security value:\n   - What threats can this source help detect?\n   - Which MITRE ATT&CK techniques does it cover?\n   - Is there an existing SIEM parser?\n\n3. Estimate ingestion cost:\n   - Daily volume in GB\n   - License impact (per-GB or per-EPS pricing)\n   - Storage retention requirements\n```\n\n### Step 2: Configure Log Collection\n\n#### Syslog-Based Collection (Firewalls, Network Devices)\n\n```conf\n# rsyslog configuration for receiving syslog\n# \u002Fetc\u002Frsyslog.d\u002F10-siem-collection.conf\n\n# UDP reception\nmodule(load=\"imudp\")\ninput(type=\"imudp\" port=\"514\" ruleset=\"siem_forwarding\")\n\n# TCP reception\nmodule(load=\"imtcp\")\ninput(type=\"imtcp\" port=\"514\" ruleset=\"siem_forwarding\")\n\n# TLS reception\nmodule(load=\"imtcp\" StreamDriver.AuthMode=\"x509\u002Fname\"\n       StreamDriver.Mode=\"1\" StreamDriver.Name=\"gtls\")\ninput(type=\"imtcp\" port=\"6514\" ruleset=\"siem_forwarding\")\n\nruleset(name=\"siem_forwarding\") {\n    # Forward to SIEM\n    action(type=\"omfwd\" target=\"siem.company.com\" port=\"9514\"\n           protocol=\"tcp\" queue.type=\"LinkedList\"\n           queue.filename=\"siem_fwd\" queue.maxdiskspace=\"1g\"\n           queue.saveonshutdown=\"on\" action.resumeRetryCount=\"-1\")\n}\n```\n\n#### Windows Event Log Collection (Splunk Universal Forwarder)\n\n```conf\n# inputs.conf on Splunk Universal Forwarder\n[WinEventLog:\u002F\u002FSecurity]\ndisabled = 0\nindex = wineventlog\nsourcetype = WinEventLog:Security\nevt_resolve_ad_obj = 1\ncheckpointInterval = 5\n\n[WinEventLog:\u002F\u002FSystem]\ndisabled = 0\nindex = wineventlog\nsourcetype = WinEventLog:System\n\n[WinEventLog:\u002F\u002FMicrosoft-Windows-Sysmon\u002FOperational]\ndisabled = 0\nindex = wineventlog\nsourcetype = XmlWinEventLog:Microsoft-Windows-Sysmon\u002FOperational\nrenderXml = true\n\n[WinEventLog:\u002F\u002FMicrosoft-Windows-PowerShell\u002FOperational]\ndisabled = 0\nindex = wineventlog\nsourcetype = XmlWinEventLog:Microsoft-Windows-PowerShell\u002FOperational\n```\n\n#### Cloud Log Collection (AWS CloudTrail)\n\n```json\n{\n  \"AWSTemplateFormatVersion\": \"2010-09-09\",\n  \"Resources\": {\n    \"CloudTrailToSIEM\": {\n      \"Type\": \"AWS::CloudTrail::Trail\",\n      \"Properties\": {\n        \"TrailName\": \"siem-cloudtrail\",\n        \"S3BucketName\": \"company-cloudtrail-logs\",\n        \"IsLogging\": true,\n        \"IsMultiRegionTrail\": true,\n        \"IncludeGlobalServiceEvents\": true,\n        \"EnableLogFileValidation\": true,\n        \"EventSelectors\": [\n          {\n            \"ReadWriteType\": \"All\",\n            \"IncludeManagementEvents\": true,\n            \"DataResources\": [\n              {\n                \"Type\": \"AWS::S3::Object\",\n                \"Values\": [\"arn:aws:s3\"]\n              }\n            ]\n          }\n        ]\n      }\n    }\n  }\n}\n```\n\n### Step 3: Parse and Normalize\n\n#### Custom Parser Example (Splunk props.conf\u002Ftransforms.conf)\n\n```conf\n# props.conf\n[custom:firewall:logs]\nSHOULD_LINEMERGE = false\nLINE_BREAKER = ([\\r\\n]+)\nTIME_PREFIX = ^\nTIME_FORMAT = %Y-%m-%dT%H:%M:%S%z\nMAX_TIMESTAMP_LOOKAHEAD = 30\nTRANSFORMS-firewall = firewall_extract_fields\nFIELDALIAS-src = src_addr AS src_ip\nFIELDALIAS-dst = dst_addr AS dest_ip\nEVAL-action = case(fw_action==\"allow\", \"allowed\", fw_action==\"deny\", \"blocked\", true(), \"unknown\")\nEVAL-vendor_product = \"Custom Firewall\"\nLOOKUP-geo = geo_ip_lookup ip AS dest_ip OUTPUT country, city, latitude, longitude\n\n# transforms.conf\n[firewall_extract_fields]\nREGEX = ^(\\S+)\\s+(\\S+)\\s+action=(\\w+)\\s+src=(\\S+):(\\d+)\\s+dst=(\\S+):(\\d+)\\s+proto=(\\w+)\\s+bytes=(\\d+)\nFORMAT = timestamp::$1 hostname::$2 fw_action::$3 src_addr::$4 src_port::$5 dst_addr::$6 dst_port::$7 protocol::$8 bytes::$9\n```\n\n#### CIM Field Mapping\n\n| Raw Field | CIM Field | Data Model |\n|---|---|---|\n| src_addr | src_ip | Network_Traffic |\n| dst_addr | dest_ip | Network_Traffic |\n| dst_port | dest_port | Network_Traffic |\n| fw_action | action | Network_Traffic |\n| bytes_sent + bytes_recv | bytes | Network_Traffic |\n| user_name | user | Authentication |\n| login_result | action | Authentication |\n| process_path | process | Endpoint |\n\n### Step 4: Validate Data Quality\n\n```spl\n# Verify events are arriving\nindex=new_source earliest=-1h\n| stats count by sourcetype, host, source\n\n# Check field extraction quality\nindex=new_source earliest=-1h\n| stats count(src_ip) as has_src count(dest_ip) as has_dest count(action) as has_action count by sourcetype\n| eval src_coverage=round(has_src\u002Fcount*100,1)\n| eval dest_coverage=round(has_dest\u002Fcount*100,1)\n| eval action_coverage=round(has_action\u002Fcount*100,1)\n\n# Verify CIM compliance\n| datamodel Network_Traffic search\n| search sourcetype=new_sourcetype\n| stats count by source, sourcetype\n\n# Check for timestamp parsing issues\nindex=new_source earliest=-1h\n| eval time_diff=abs(_time - _indextime)\n| stats avg(time_diff) as avg_lag max(time_diff) as max_lag by host\n| where avg_lag > 300\n```\n\n### Step 5: Enable Detection Coverage\n\n```spl\n# Verify existing correlation searches work with new source\nindex=new_source sourcetype=new_sourcetype\n| tstats count from datamodel=Authentication by _time span=1h\n| timechart span=1h count\n\n# Create source-specific detection rule\n[New Source - Authentication Anomaly]\nsearch = index=new_source sourcetype=new_sourcetype action=failure \\\n| stats count by src_ip, user \\\n| where count > 10\n```\n\n## Onboarding Checklist\n\n- [ ] Log source assessed and approved\n- [ ] Network connectivity verified\n- [ ] Collection agent\u002Fmethod configured\n- [ ] Log forwarding confirmed\n- [ ] Parser\u002Ffield extraction configured\n- [ ] CIM compliance validated\n- [ ] Data model acceleration enabled\n- [ ] Volume within license budget\n- [ ] Retention policy configured\n- [ ] Detection rules enabled\u002Fcreated\n- [ ] Dashboard updated\n- [ ] Documentation completed\n- [ ] SOC team notified\n\n## References\n\n- [UK NCSC - Onboarding Systems and Log Sources](https:\u002F\u002Fwww.ncsc.gov.uk\u002Fcollection\u002Fbuilding-a-security-operations-centre\u002Fonboarding-systems-and-log-sources)\n- [Sumo Logic - Cloud SIEM Onboarding Checklist](https:\u002F\u002Fhelp.sumologic.com\u002Fdocs\u002Fcse\u002Fget-started-with-cloud-siem\u002Fonboarding-checklist-cse\u002F)\n- [SIEM Logging Best Practices - Coralogix](https:\u002F\u002Fcoralogix.com\u002Fguides\u002Fsiem\u002Fsiem-logging\u002F)\n- [Huntress - SIEM Implementation Guide](https:\u002F\u002Fwww.huntress.com\u002Fsiem-guide\u002Fsiem-implementation-guide)\n","# Performing Log Source Onboarding in SIEM\n\n## Overview\n\nLog source onboarding is the systematic process of integrating new data sources into a SIEM platform to enable security monitoring and detection. Proper onboarding requires planning data sources, configuring collection agents, building parsers, normalizing fields to a common schema, and validating data quality. According to the UK NCSC, onboarding should prioritize log sources that provide the highest security value relative to their ingestion cost.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing log source onboarding in siem\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- SIEM platform deployed (Splunk, Elastic, Sentinel, QRadar, or similar)\n- Network access from source systems to SIEM collectors\n- Administrative access on source systems for agent installation\n- Common Information Model (CIM) or equivalent schema documentation\n- Change management approval for production system modifications\n\n## Log Source Priority Framework\n\n### Tier 1 - Critical (Onboard First)\n\n| Source | Log Type | Security Value |\n|---|---|---|\n| Active Directory | Security Event Logs | Authentication, privilege escalation |\n| Firewalls | Traffic logs | Network access, C2 detection |\n| EDR\u002FAV | Endpoint alerts | Malware, process execution |\n| VPN\u002FRemote Access | Connection logs | Unauthorized access |\n| DNS Servers | Query logs | C2 beaconing, data exfiltration |\n| Email Gateway | Email security logs | Phishing, BEC |\n\n### Tier 2 - High Priority\n\n| Source | Log Type | Security Value |\n|---|---|---|\n| Web Proxy | HTTP\u002FHTTPS logs | Web-based attacks, data exfiltration |\n| Cloud platforms (AWS\u002FAzure\u002FGCP) | Audit logs | Cloud security posture |\n| Database servers | Audit\u002Fquery logs | Data access, SQL injection |\n| DHCP\u002FIPAM | Address allocation | Asset tracking |\n| File servers | Access logs | Data access monitoring |\n\n### Tier 3 - Standard\n\n| Source | Log Type | Security Value |\n|---|---|---|\n| Application servers | App logs | Application-level attacks |\n| Print servers | Print logs | Data loss prevention |\n| Badge\u002Fphysical access | Access logs | Physical security correlation |\n| Network devices (switches\u002Frouters) | Syslog | Network anomalies |\n\n## Onboarding Process\n\n### Step 1: Discovery and Assessment\n\n```\n1. Identify the log source:\n   - System type and version\n   - Log format (syslog, CEF, JSON, Windows Events, etc.)\n   - Log volume estimate (EPS - events per second)\n   - Network location and firewall requirements\n\n2. Assess security value:\n   - What threats can this source help detect?\n   - Which MITRE ATT&CK techniques does it cover?\n   - Is there an existing SIEM parser?\n\n3. Estimate ingestion cost:\n   - Daily volume in GB\n   - License impact (per-GB or per-EPS pricing)\n   - Storage retention requirements\n```\n\n### Step 2: Configure Log Collection\n\n#### Syslog-Based Collection (Firewalls, Network Devices)\n\n```conf\n# rsyslog configuration for receiving syslog\n# \u002Fetc\u002Frsyslog.d\u002F10-siem-collection.conf\n\n# UDP reception\nmodule(load=\"imudp\")\ninput(type=\"imudp\" port=\"514\" ruleset=\"siem_forwarding\")\n\n# TCP reception\nmodule(load=\"imtcp\")\ninput(type=\"imtcp\" port=\"514\" ruleset=\"siem_forwarding\")\n\n# TLS reception\nmodule(load=\"imtcp\" StreamDriver.AuthMode=\"x509\u002Fname\"\n       StreamDriver.Mode=\"1\" StreamDriver.Name=\"gtls\")\ninput(type=\"imtcp\" port=\"6514\" ruleset=\"siem_forwarding\")\n\nruleset(name=\"siem_forwarding\") {\n    # Forward to SIEM\n    action(type=\"omfwd\" target=\"siem.company.com\" port=\"9514\"\n           protocol=\"tcp\" queue.type=\"LinkedList\"\n           queue.filename=\"siem_fwd\" queue.maxdiskspace=\"1g\"\n           queue.saveonshutdown=\"on\" action.resumeRetryCount=\"-1\")\n}\n```\n\n#### Windows Event Log Collection (Splunk Universal Forwarder)\n\n```conf\n# inputs.conf on Splunk Universal Forwarder\n[WinEventLog:\u002F\u002FSecurity]\ndisabled = 0\nindex = wineventlog\nsourcetype = WinEventLog:Security\nevt_resolve_ad_obj = 1\ncheckpointInterval = 5\n\n[WinEventLog:\u002F\u002FSystem]\ndisabled = 0\nindex = wineventlog\nsourcetype = WinEventLog:System\n\n[WinEventLog:\u002F\u002FMicrosoft-Windows-Sysmon\u002FOperational]\ndisabled = 0\nindex = wineventlog\nsourcetype = XmlWinEventLog:Microsoft-Windows-Sysmon\u002FOperational\nrenderXml = true\n\n[WinEventLog:\u002F\u002FMicrosoft-Windows-PowerShell\u002FOperational]\ndisabled = 0\nindex = wineventlog\nsourcetype = XmlWinEventLog:Microsoft-Windows-PowerShell\u002FOperational\n```\n\n#### Cloud Log Collection (AWS CloudTrail)\n\n```json\n{\n  \"AWSTemplateFormatVersion\": \"2010-09-09\",\n  \"Resources\": {\n    \"CloudTrailToSIEM\": {\n      \"Type\": \"AWS::CloudTrail::Trail\",\n      \"Properties\": {\n        \"TrailName\": \"siem-cloudtrail\",\n        \"S3BucketName\": \"company-cloudtrail-logs\",\n        \"IsLogging\": true,\n        \"IsMultiRegionTrail\": true,\n        \"IncludeGlobalServiceEvents\": true,\n        \"EnableLogFileValidation\": true,\n        \"EventSelectors\": [\n          {\n            \"ReadWriteType\": \"All\",\n            \"IncludeManagementEvents\": true,\n            \"DataResources\": [\n              {\n                \"Type\": \"AWS::S3::Object\",\n                \"Values\": [\"arn:aws:s3\"]\n              }\n            ]\n          }\n        ]\n      }\n    }\n  }\n}\n```\n\n### Step 3: Parse and Normalize\n\n#### Custom Parser Example (Splunk props.conf\u002Ftransforms.conf)\n\n```conf\n# props.conf\n[custom:firewall:logs]\nSHOULD_LINEMERGE = false\nLINE_BREAKER = ([\\r\\n]+)\nTIME_PREFIX = ^\nTIME_FORMAT = %Y-%m-%dT%H:%M:%S%z\nMAX_TIMESTAMP_LOOKAHEAD = 30\nTRANSFORMS-firewall = firewall_extract_fields\nFIELDALIAS-src = src_addr AS src_ip\nFIELDALIAS-dst = dst_addr AS dest_ip\nEVAL-action = case(fw_action==\"allow\", \"allowed\", fw_action==\"deny\", \"blocked\", true(), \"unknown\")\nEVAL-vendor_product = \"Custom Firewall\"\nLOOKUP-geo = geo_ip_lookup ip AS dest_ip OUTPUT country, city, latitude, longitude\n\n# transforms.conf\n[firewall_extract_fields]\nREGEX = ^(\\S+)\\s+(\\S+)\\s+action=(\\w+)\\s+src=(\\S+):(\\d+)\\s+dst=(\\S+):(\\d+)\\s+proto=(\\w+)\\s+bytes=(\\d+)\nFORMAT = timestamp::$1 hostname::$2 fw_action::$3 src_addr::$4 src_port::$5 dst_addr::$6 dst_port::$7 protocol::$8 bytes::$9\n```\n\n#### CIM Field Mapping\n\n| Raw Field | CIM Field | Data Model |\n|---|---|---|\n| src_addr | src_ip | Network_Traffic |\n| dst_addr | dest_ip | Network_Traffic |\n| dst_port | dest_port | Network_Traffic |\n| fw_action | action | Network_Traffic |\n| bytes_sent + bytes_recv | bytes | Network_Traffic |\n| user_name | user | Authentication |\n| login_result | action | Authentication |\n| process_path | process | Endpoint |\n\n### Step 4: Validate Data Quality\n\n```spl\n# Verify events are arriving\nindex=new_source earliest=-1h\n| stats count by sourcetype, host, source\n\n# Check field extraction quality\nindex=new_source earliest=-1h\n| stats count(src_ip) as has_src count(dest_ip) as has_dest count(action) as has_action count by sourcetype\n| eval src_coverage=round(has_src\u002Fcount*100,1)\n| eval dest_coverage=round(has_dest\u002Fcount*100,1)\n| eval action_coverage=round(has_action\u002Fcount*100,1)\n\n# Verify CIM compliance\n| datamodel Network_Traffic search\n| search sourcetype=new_sourcetype\n| stats count by source, sourcetype\n\n# Check for timestamp parsing issues\nindex=new_source earliest=-1h\n| eval time_diff=abs(_time - _indextime)\n| stats avg(time_diff) as avg_lag max(time_diff) as max_lag by host\n| where avg_lag > 300\n```\n\n### Step 5: Enable Detection Coverage\n\n```spl\n# Verify existing correlation searches work with new source\nindex=new_source sourcetype=new_sourcetype\n| tstats count from datamodel=Authentication by _time span=1h\n| timechart span=1h count\n\n# Create source-specific detection rule\n[New Source - Authentication Anomaly]\nsearch = index=new_source sourcetype=new_sourcetype action=failure \\\n| stats count by src_ip, user \\\n| where count > 10\n```\n\n## Onboarding Checklist\n\n- [ ] Log source assessed and approved\n- [ ] Network connectivity verified\n- [ ] Collection agent\u002Fmethod configured\n- [ ] Log forwarding confirmed\n- [ ] Parser\u002Ffield extraction configured\n- [ ] CIM compliance validated\n- [ ] Data model acceleration enabled\n- [ ] Volume within license budget\n- [ ] Retention policy configured\n- [ ] Detection rules enabled\u002Fcreated\n- [ ] Dashboard updated\n- [ ] Documentation completed\n- [ ] SOC team notified\n\n## References\n\n- [UK NCSC - Onboarding Systems and Log Sources](https:\u002F\u002Fwww.ncsc.gov.uk\u002Fcollection\u002Fbuilding-a-security-operations-centre\u002Fonboarding-systems-and-log-sources)\n- [Sumo Logic - Cloud SIEM Onboarding Checklist](https:\u002F\u002Fhelp.sumologic.com\u002Fdocs\u002Fcse\u002Fget-started-with-cloud-siem\u002Fonboarding-checklist-cse\u002F)\n- [SIEM Logging Best Practices - Coralogix](https:\u002F\u002Fcoralogix.com\u002Fguides\u002Fsiem\u002Fsiem-logging\u002F)\n- [Huntress - SIEM Implementation Guide](https:\u002F\u002Fwww.huntress.com\u002Fsiem-guide\u002Fsiem-implementation-guide)\n",{"name":5,"tags":52,"author":57,"domain":45,"license":15,"version":58,"nist_csf":59,"subdomain":64,"description":7,"mitre_attack":65},[28,53,31,54,55,56,40],"log-onboarding","data-ingestion","parsing","normalization","mahipal","1.0",[60,61,62,63],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations",[66,67,68,69],"T1078","T1685.002","T1685.005","T1566","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-log-source-onboarding-in-siem",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":81,"prompt":91,"zipAvailable":92},[82,85,88],{"tool":83,"command":84},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-log-source-onboarding-in-siem",{"tool":86,"command":87},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-log-source-onboarding-in-siem",{"tool":89,"command":90},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-log-source-onboarding-in-siem","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-log-source-onboarding-in-siem\u002FSKILL.md",true,[94,100,105,111,115,119,125],{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"assets\u002Ftemplate.md","ASSET","资产文件",1120,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-log-source-onboarding-in-siem\u002Fassets\u002Ftemplate.md",{"path":101,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-log-source-onboarding-in-siem\u002FLICENSE",{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fapi-reference.md","REFERENCE","参考文档",1593,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-log-source-onboarding-in-siem\u002Freferences\u002Fapi-reference.md",{"path":112,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fstandards.md",1253,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-log-source-onboarding-in-siem\u002Freferences\u002Fstandards.md",{"path":116,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":117,"sourceHtmlUrl":118},"references\u002Fworkflows.md",1366,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-log-source-onboarding-in-siem\u002Freferences\u002Fworkflows.md",{"path":120,"resourceType":121,"resourceTypeDesc":122,"sizeBytes":123,"sourceHtmlUrl":124},"scripts\u002Fagent.py","SCRIPT","脚本",7811,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-log-source-onboarding-in-siem\u002Fscripts\u002Fagent.py",{"path":126,"resourceType":121,"resourceTypeDesc":122,"sizeBytes":127,"sourceHtmlUrl":128},"scripts\u002Fprocess.py",8104,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-log-source-onboarding-in-siem\u002Fscripts\u002Fprocess.py",[130,160,184,211,235,261],{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":141,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[136],{"categoryNo":137,"categoryName":138,"taxonomyType":139,"taxonomyTypeDesc":140},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[142,143,144,145,46,45,146,147,148,149,150,151,152,153,154,155,156,157,158,159],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":167,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[166],{"categoryNo":137,"categoryName":138,"taxonomyType":139,"taxonomyTypeDesc":140},[168,156,169,170,46,171,45,148,172,173,174,175,176,177,178,179,180,181,182,183],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":194,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[190,193],{"categoryNo":191,"categoryName":192,"taxonomyType":139,"taxonomyTypeDesc":140},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":137,"categoryName":138,"taxonomyType":139,"taxonomyTypeDesc":140},[178,195,196,197,198,45,199,200,172,201,202,203,204,205,206,33,207,208,209,210],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":218,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[217],{"categoryNo":137,"categoryName":138,"taxonomyType":139,"taxonomyTypeDesc":140},[219,220,221,45,222,223,42,224,225,226,227,37,228,229,230,231,175,232,233,234],"windows","kape","triaging windows with kape","registry","browser","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":236,"name":237,"nameZh":6,"description":238,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":239,"categories":240,"keywords":242,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[241],{"categoryNo":137,"categoryName":138,"taxonomyType":139,"taxonomyTypeDesc":140},[243,44,244,45,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260],"vulnerabilities","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":262,"name":263,"nameZh":6,"description":264,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":265,"categories":266,"keywords":268,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[267],{"categoryNo":137,"categoryName":138,"taxonomyType":139,"taxonomyTypeDesc":140},[46,269,45,28,270,271,40,272,273,274,34,33,275,207,276,277,278,279,280,281],"triaging security incident","file","ioc","NIST-800-61","NIST","severity","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]