How to use the Cloud SIEM with Microsoft Sentinel agent skill

What does the Cloud SIEM with Microsoft Sentinel skill make the agent do?

An agent skill is a folder of instructions that an AI agent can load when a task matches it. This skill's main file, SKILL.md, sets out a workflow for deploying Microsoft Sentinel as a cloud-native SIEM and SOAR (security orchestration, automation and response) platform that collects logs from AWS, Azure and GCP.

The skill covers four areas: provisioning a Log Analytics workspace and data connectors, writing KQL detection and hunting queries that map to MITRE ATT&CK techniques, outlining Logic Apps response playbooks, and hunting across long-term retained data with the Sentinel data lake.

• Connect sources such as the AWS CloudTrail connector and Azure AD sign-in and audit logs
• Draft KQL analytics rules, for example for impossible travel sign-ins or AWS credential abuse
• Outline automated responses, such as disabling a compromised Azure AD user and adding a comment to the incident
• Write threat hunting queries, such as looking for cross-account lateral movement in AWS

How do you install the skill?

Download the skill's ZIP file from this page and unzip it. Where you put the folder decides who can use it. For a personal install available to all your projects, unzip it into ~/.claude/skills/. For a single project, unzip it into the .claude/skills/ folder inside that project.

If you use the Claude apps instead, open Settings, go to Capabilities, then Skills, and upload the skill there.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills, then upload the skill

How do you trigger the skill with a natural request?

You do not need a special command. The skill's description tells the agent when to use it: establishing a centralized SOC for multi-cloud environments, migrating from a legacy SIEM, or performing large-scale threat hunting. Ask for one of those tasks in plain language and name the platform so the agent can match the request.

Be specific about the log source and the output you want. A request that names the table, the threat and the format gives the agent more to work with than a general question about SIEM.

• Help me write a KQL analytics rule in Microsoft Sentinel that flags impossible travel sign-ins, and map it to MITRE ATT&CK.
• Draft a Logic Apps playbook outline that disables an Azure AD user when an incident has an account entity.
• Write a hunting query for AWS CloudTrail that finds possible credential abuse over the last 24 hours.
• Set up the data connectors for AWS CloudTrail and Azure AD in a new Sentinel workspace.

What do you need before you use it?

The skill assumes you already have Azure infrastructure and some skills of your own. The source lists these requirements. Check them before you ask the agent to deploy anything.

• An Azure subscription with Microsoft Sentinel and a Log Analytics workspace
• Azure CLI (az) with the sentinel extension
• Python with the azure-identity, azure-monitor-query and azure-mgmt-securityinsight packages
• Azure credentials: DefaultAzureCredential, or a service principal with tenant, client ID and secret
• An AWS IAM role for the CloudTrail connector
• Logic Apps or Azure Functions for playbooks
• KQL proficiency, since the skill's prerequisites assume you can review queries

Is it safe to run the scripts and playbooks?

The skill runs scripts and uses the network. The included scripts/agent.py runs KQL queries against a Log Analytics workspace using your Azure credentials. The playbook pattern can disable user accounts, and the queries read live security logs. Review every command, query and playbook before running it against production.

The skill's own guidance says AWS-only setups may not need Sentinel, since Security Hub and GuardDuty may be enough, and that endpoint detection should go to Defender for Endpoint.

• Read the az commands and check the workspace name and resource group before running them
• Test queries against a non-production workspace first
• Check the impossible travel thresholds (500 km and 60 minutes in the example) against your own users before relying on them
• Confirm any playbook that disables accounts in a test environment first

What tips help you get better results?

Start with a narrow scope, such as one cloud and one threat, and then widen it. Ask the agent to name the MITRE ATT&CK technique for each rule, since the skill maps its examples to techniques such as T1078.004 and T1530. Keep the logic readable so an analyst can tune it later.

The skill's example queries are starting points. Their time windows, thresholds and table names come from the example and should be adapted to your environment.

• Ask for one detection or one playbook per request
• Ask the agent to explain the logic of each query in plain words
• Use the hunting queries first to learn what normal looks like in your logs