How to use the Windows Event Log Analysis in Splunk agent skill

What the skill makes the agent do

Once installed, the agent follows a workflow written for investigating Windows-based threats in Splunk. The skill covers authentication attack detection (brute force, password spray, and a successful logon after repeated failures), privilege escalation (new admin accounts, special privileges, and token manipulation against LSASS), persistence (scheduled tasks, registry Run keys and WMI event subscriptions), and lateral movement over SMB, PsExec and RDP.

It also includes steps for building a forensic timeline of a compromised host and a lookup table of Windows Event ID context. The skill is scoped to Windows data: it says it is not for Linux or macOS endpoint analysis or network-only investigations.

Install the skill

Download the skill ZIP from this page and unzip it. For a personal install, place the unzipped folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder. Alternatively, in the Claude apps, go to Settings → Capabilities → Skills and upload the ZIP.

The package contains SKILL.md (the instructions), scripts/agent.py (a Python helper) and references/api-reference.md (Event ID tables and a splunk-sdk connection example).

• Personal: ~/.claude/skills/
• Project: .claude/skills/ inside the project
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Check the requirements before you start

The skill assumes a working Splunk environment. Splunk Enterprise must have Windows Security, System and Sysmon logs ingested under the sourcetypes WinEventLog:Security, WinEventLog:System and XmlWinEventLog:Microsoft-Windows-Sysmon/Operational. Sysmon should be deployed with a known configuration, either SwiftOnSecurity or Olaf Hartong. CIM data model acceleration is needed for the Endpoint and Authentication data models.

The optional Python helper needs Python with the splunklib library and Splunk username and password credentials.

• Splunk Enterprise with Windows Security, System and Sysmon logs ingested
• Sysmon deployed with the SwiftOnSecurity or Olaf Hartong configuration
• CIM acceleration for Endpoint and Authentication data models
• Python with splunklib and Splunk credentials (only for scripts/agent.py)

Trigger the skill with natural requests

You do not need to name the skill. Describe the investigation in plain terms that match its scope, such as the attack type, the Windows event, or the host. The skill's description mentions SOC investigations, detection queries and forensic timelines, so requests like these tend to fit.

Be specific about the data you have. If you know your index names or the host, say so, because the queries use index=wineventlog and index=sysmon as examples and may need changing.

• Write a Splunk search for failed logons (4625) that could indicate a password spray from one source IP.
• Build a forensic timeline in Splunk for WORKSTATION-042 between two dates.
• Draft an SPL detection for scheduled tasks created with powershell or from a Temp folder.
• Find PsExec activity in our Sysmon data and map it to MITRE ATT&CK.
• Check for RDP lateral movement: source IPs logging on to more than two hosts via logon type 10.

Read the outputs and tune before you run

Each query is a starting point. The thresholds (for example, count > 20 for brute force or unique_users > 10 for spray), the field names and the status codes are examples taken from the skill and may not match your environment. Run queries against a test or lab index first, check field names in your data, and adjust thresholds to your baseline.

The skill maps detections to MITRE ATT&CK techniques such as T1110 (brute force), T1053.005 (scheduled task), T1547.001 (registry Run keys), T1021.002 (SMB/admin shares) and T1021.001 (RDP).

• Test in a lab or non-production index first
• Confirm field names such as Logon_Type, TargetUserName and src_ip exist in your events
• Tune count and time-span thresholds to your normal activity

Safety notes: scripts and network access

This skill runs scripts and uses the network. scripts/agent.py can connect to a Splunk server (the reference example uses port 8089) with a username and password and run a brute-force search. Its connection example in references/api-reference.md contains placeholder credentials, which you should replace with your own handled securely, not hardcoded in shared files.

Because the helper can contact a live Splunk instance, review the script before running it and point it only at systems you are authorised to query. Avoid running the SPL queries unreviewed against production data.

• Read scripts/agent.py before executing it
• Use a service account with the least access needed rather than an admin password
• Do not commit credentials to project folders or shared directories