Skip to content
Get packs

Splunk Security Log Analysis

Investigate security incidents by searching and correlating Splunk logs with SPL queries

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

This skill teaches an AI agent to investigate security incidents using Splunk, a log analysis platform, and its query language SPL. Once installed, the agent knows how to write searches that correlate Windows event logs, firewall, proxy and endpoint data, spot brute-force logins, lateral movement, suspicious PowerShell, possible data exfiltration, and build a unified incident timeline. It can also draft Splunk correlation searches to turn findings into ongoing detections. It also includes a Python helper script that connects to a Splunk server and runs such searches.

Great for

  • Security analysts or incident responders who already use Splunk Enterprise Security
  • SOC teams building or tuning SIEM detection rules
  • Engineers who want a starting set of SPL queries for common attack patterns

Skip it if

  • Anyone without a Splunk deployment, since the queries cannot run without access to Splunk logs
  • Real-time packet-level analysis, which the skill itself says should use Wireshark or Zeek instead
  • Running the queries against production systems without authorization or checking the host, IP and user values used in the examples, which are sample values

Try asking

  • “Investigate failed logons and possible brute force against user jsmith over the last 24 hours”
  • “Build a unified timeline for host WKSTN-042 between two timestamps across Windows, Sysmon and proxy logs”
  • “Write an SPL search to detect PowerShell launched by Word or Excel and convert it into a correlation search”
  • “Hunt for DNS tunneling or large outbound data transfers from internal hosts”
Step-by-step guide: how to use Splunk Security Log AnalysisInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-security-logs-with-splunk.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-security-logs-with-splunk.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-security-logs-with-splunk.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Start with narrow time ranges and specific hosts or users to keep searches fast and scoped
  • Test queries in a non-production Splunk instance first, since the helper script connects to a live server with credentials and runs searches
  • Review the helper script and store Splunk credentials securely rather than hardcoding them

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.