Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-windows-event-logs-in-splunknpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-windows-event-logs-in-splunk -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-windows-event-logs-in-splunk -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/analyzing-windows-event-logs-in-splunkgh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-windows-event-logs-in-splunkgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/analyzing-windows-event-logs-in-splunk ~/.claude/skills/analyzing-windows-event-logs-in-splunk # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/analyzing-windows-event-logs-in-splunk ~/.agents/skills/analyzing-windows-event-logs-in-splunk # Codex, Cursor, Gemini CLI, Copilot, OpenCode