Guide · Agent skill
How to use the Splunk Security Log Analysis agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide shows you how to install and use the analyzing-security-logs-with-splunk agent skill, a set of instructions that lets an AI agent investigate security incidents with Splunk and its query language, SPL. It is written for security analysts and engineers who already run Splunk and want the agent to draft searches for common attack patterns. By the end you will know what the skill covers, how to install it, how to phrase requests, and what you need in place before the queries will return anything.
Splunk Security Log Analysismukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from the page you are reading and unzip it on your computer.
- 2Place the folder. Move the unzipped folder into ~/.claude/skills/ for personal use, or into .claude/skills/ in a project folder.
- 3Or upload it in the app. In the Claude apps, open Settings, go to Capabilities, then Skills, and upload the skill.
- 4Confirm your Splunk setup. Check that Splunk Enterprise or Splunk Cloud, the Enterprise Security app and your log sources are in place.
- 5Ask in plain language. Describe the investigation and mention Splunk or SPL, for example a brute-force check on failed logons.
- 6Review and run the SPL. Confirm index, sourcetype and sample values match your data, then paste the query into Splunk and run it.
What an agent skill is and what this one does
An agent skill is a folder containing a SKILL.md file and optional supporting files. When a skill is installed and your request matches its description, the agent reads those instructions and follows them for the task.
This skill, named analyzing-security-logs-with-splunk, activates for requests about Splunk investigation, SPL queries, SIEM log analysis, security event correlation, or log-based incident investigation. Once active, the agent can write searches that correlate Windows event logs, firewall, proxy and endpoint data; look for brute-force logins, pass-the-hash and RDP lateral movement, suspicious PowerShell, LSASS credential dumping, C2 beaconing, DNS tunneling and large outbound transfers; build a unified incident timeline; and draft a correlation search to turn a finding into an ongoing detection.
Install the skill in Claude
Download the ZIP for this skill from the page you are reading and unzip it. For a personal install, place the unzipped folder inside ~/.claude/skills/. To make it available only within one project, place it inside that project's .claude/skills/ folder.
You can also upload the skill in the Claude apps. Go to Settings, then Capabilities, then Skills, and upload the skill there.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project folder
- Claude apps: Settings → Capabilities → Skills
Check what you need before you start
The skill assumes a working Splunk environment. The queries cannot return results without access to Splunk logs, so confirm these items first. The skill does not provide any data of its own.
- Splunk Enterprise or Splunk Cloud, with the Enterprise Security (ES) app installed
- Log sources ingested, such as Windows Event Logs via a Splunk Universal Forwarder or Windows Event Forwarding (WEF), plus firewall, proxy, DNS, EDR or email gateway data
- Splunk CIM (Common Information Model) data models configured for normalized field names
- SPL skill at intermediate level or higher
- A role with the search and accelerate_search capabilities
- For the helper script only: Python with splunk-sdk (splunklib) and a Splunk username and password or other credentials
Trigger the skill with natural requests
You do not need special syntax. Describe the investigation in plain language and mention Splunk, SPL or the log type. The skill is designed to activate on requests like the ones below. Replace the sample host, IP and user values with your own, because the examples in the skill use sample values such as WKSTN-042 and 10.1.5.42.
The agent will normally return SPL you can paste into the Splunk search bar. Review each query before you run it, and confirm the index and sourcetype names match your deployment.
- "Using Splunk, find accounts with more than 10 failed logons in the last 24 hours."
- "Write an SPL search for pass-the-hash using Logon Type 9 events."
- "Build a unified timeline in Splunk for host WKSTN-042 between 14:00 and 16:00 on 15 November."
- "Draft a Splunk correlation search that alerts when PowerShell is launched by Word, Excel or Outlook."
Example: what the skill's queries look like
The skill includes example SPL for each stage of an investigation. The brute-force example counts failed Windows logons (EventCode 4625) per account and keeps accounts with more than 10 failures. The timeline example combines Windows, Sysmon, proxy and firewall sources into one table sorted by time.
The helper script scripts/agent.py connects to a Splunk server and runs searches like these. The API reference shows how the splunklib client connects and how it runs blocking and oneshot searches.
index=windows sourcetype="WinEventLog:Security" EventCode=4625
earliest=-24h
| stats count as failed_attempts, values(src_ip) as source_ips,
dc(src_ip) as unique_sources by TargetUserName
| where failed_attempts > 10
| sort -failed_attemptsSafety notes: scripts and network access
This skill runs scripts and uses the network. The included scripts/agent.py connects to a Splunk server, and the API reference example passes a username and password directly in code. Use a dedicated account with the minimum access needed, and do not paste production passwords into a shared project.
Only run the queries against systems you are authorised to investigate. The sample time ranges, hosts, IPs and users in the skill are examples. The skill also states that real-time packet-level analysis should use Wireshark or Zeek instead of this skill.
- Read scripts/agent.py before running it, and confirm the host and port point to your own Splunk server
- Do not store passwords in files that are shared or committed to version control
- Check every host, IP and user value in a query against your own data before acting on results
Tips for better results
Give the agent your index names and sourcetypes. The skill's examples use names such as windows, sysmon, proxy and firewall, which may differ in your environment. Tell the agent the time window, because every example uses an explicit earliest and latest or a relative value.
Ask for one stage at a time. A good sequence is scope, then authentication, then process execution, then network, then timeline, then detection. This matches the workflow in the skill and makes each query easier to check.
- State your index and sourcetype names up front
- Give a precise time window
- Ask for one investigation stage per request
- Ask the agent to explain each query so you can tune thresholds such as the count of 10 failed logons
What people use it for
- Scoping an incident by finding which indexes and sourcetypes contain data for one host, IP or user in a time window
- Spotting brute-force or credential stuffing by counting failed Windows logons (EventCode 4625) per account
- Tracing suspicious PowerShell from Sysmon process creation events, including encoded commands
- Building a unified incident timeline across Windows, Sysmon, proxy and firewall logs
- Drafting a Splunk correlation search that writes findings to a notable_events index for analyst review
Frequently asked questions
How do I install the analyzing-security-logs-with-splunk skill?
Download the ZIP from this page and unzip it. Place the folder in ~/.claude/skills/ for personal use, or in a project's .claude/skills/ folder. In the Claude apps, you can instead upload it under Settings, then Capabilities, then Skills.
What do I need to use this Splunk skill?
You need Splunk Enterprise or Splunk Cloud with the Enterprise Security app, ingested log sources, and CIM data models. The helper script also needs Python with splunk-sdk (splunklib) and Splunk credentials. Without a Splunk deployment the queries cannot return data.
Is this skill free?
The skill is licensed under Apache-2.0, as stated on this page. Splunk itself is a separate commercial product, and the skill does not include a Splunk licence.
Does the skill work without Splunk Enterprise Security?
The skill's prerequisites list Splunk Enterprise Security as required, and several of its examples rely on ES features such as correlation searches and notable events. Check the prerequisites against your own setup before relying on it.
What alternatives should I consider for packet-level analysis?
The skill itself says not to use it for real-time packet-level analysis and recommends Wireshark or Zeek for full packet capture analysis.
Why does the agent's query return no results?
Common causes are that the index or sourcetype names differ from the skill's examples, the time window is wrong, or the required log sources are not ingested. Also confirm the sample host, IP and user values are replaced with values from your data.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security analysts and SOC teams who already run Splunk Enterprise Security and want a starting set of SPL searches for common attack patterns. It is not useful without a Splunk deployment and access to the relevant logs. If you need packet-level analysis, the skill points you to Wireshark or Zeek instead.
Download the skill