log-analysis

Security Log Analysis

Frameworks: MITRE ATT&CK v16, NIST SP 800-92 (Guide to Computer Security Log Management) Role: SOC Analyst, Security Engineer Time: 20-40 min per analysis Output: Log analysis findings, anomaly identification, baseline recommendations, ATT&CK-mapped observations

---

1. When to Use

If a target is provided via arguments, focus the review on: $ARGUMENTS

Invoke this skill when any of the following conditions are met:

• Log review -- The analyst needs to examine logs from a specific system, time window, or user to identify suspicious activity.
• Anomaly investigation -- An unusual pattern has been observed (unexpected logon, unfamiliar process, abnormal network traffic) and requires log-based investigation.
• Baseline establishment -- The team needs to define what "normal" looks like for a log source to enable future anomaly detection.
• Event ID interpretation -- The analyst needs to understand what a specific Windows Event ID, Sysmon Event ID, or Linux log entry means in a security context.
• Log correlation -- Multiple log sources need to be analyzed together to reconstruct a sequence of events or trace an attacker's actions.
• Post-incident log review -- After an alert or incident, logs need to be systematically reviewed to determine scope, timeline, and impact.
• Log architecture assessment -- The team is evaluating whether the right log sources are being collected for security monitoring.

Do not use when: The task is writing SIEM detection rules (use siem-rules), triaging a fired alert (use alert-triage), or authoring Sigma rules (use detection-engineering).

---

2. Context the Agent Needs

Before beginning analysis, gather or confirm:

• Analysis objective: What question are you trying to answer? (e.g., "Was this account compromised?", "What happened on this server between 2:00 and 3:00 AM?", "Is this outbound traffic malicious?")
• Time window: The specific time range to analyze.
• Scope: Which hosts, users, IP addresses, or network segments are in scope?
• Available log sources: Which logs are available? (Windows Event Logs, Sysmon, EDR, firewall, proxy, DNS, cloud audit, application logs.)
• Known-good context: What is expected/normal for this environment? (Authorized admin accounts, expected service accounts, normal working hours, approved applications.)
• Related alerts or incidents: Are there existing alerts, tickets, or incident reports associated with this investigation?
• SIEM access: Which SIEM platform contains the logs? (Determines query language and table names.)