Results for “event-log-analysis”

Build comprehensive forensic super-timelines using Plaso (log2timeline) to correlate events across file systems, logs, and artifacts into a unified chronological view.

**Server Logs:**

Append-only event log — the probabilistic record of everything that happened in the project. Use whenever something notable happens that the project should remember — work items created/transitioned, decisions recorded, bindings changed, incidents occurred, releases shipped.

Create comprehensive event plans with logistics. TRIGGERS - Use when user needs help with event-plan related tasks.

Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.

Create comprehensive event plans with logistics. TRIGGERS - Use when user needs help with event-plan related tasks.

Use when analyzing patterns across multiple incidents, bugs, failures, or successes to extract organizational learning. This skill provides procedures for synthesizing individual experiences into actionable lessons that improve team-wide practices.

Migrates OSGi EventAdmin handlers and JCR EventListeners to AEM Cloud Service-compliant patterns, including EventHandler+JobConsumer split, routing rules, and leader-only execution.

Generates detailed, technology-agnostic implementation blueprints by analyzing project architecture, technology stacks, and data flow patterns.

Search and analyze your own session logs (older/parent conversations) using jq.

Diagnose your own behavior by reading the structured logs you leave behind — turns.jsonl, events.jsonl, chat_history.jsonl, scheduler.yaml. Use when something has gone wrong (a message didn't land, a scheduled job isn't firing, a communication pattern feels off), when you need to understand a pattern over many turns, or when cost / token usage needs auditing. Covers jq query recipes and points at the debugging-jobs / debugging-communication / debugging-drift companion guides for specific failure modes.

Investigate a problem, log it to the debug changelog, cross-check past issues, and suggest a non-duplicate fix.

Query and filter Datadog logs from the shell using the Composio CLI. Run scoped log searches, pivot across services/environments, and export structured JSON for incident investigation and diagnostics.

Configures monitoring systems, implements structured logging pipelines, creates Prometheus/Grafana dashboards, defines alerting rules, and instruments distributed tracing.

Investigate Active Directory compromise by analyzing authentication logs, replication metadata, Group Policy changes, and Kerberos ticket anomalies to identify attacker persistence and lateral movement paths.

Runbook skill for failures: cron error, PA failure, cascade, gateway disconnect, semantic DB stale. Walks: detect → classify → diagnose → notify → log. Replaces ad-hoc failure handling. Triggers: "cron failed", "X is broken", "cascade", "incident", "gateway down", "PA failure".

Reads and analyzes application logs for debugging and monitoring.

Search and analyze your own session logs (older/parent conversations) using jq.

Search and analyze your own session logs (older/parent conversations) using jq.

Analyze conversion funnel drop-offs and identify biggest leak points with impact-ranked recommendations

Identify, collect, and analyze ransomware attack artifacts to determine the variant, initial access vector, encryption scope, and recovery options.

Detect abuse of legitimate Windows binaries (LOLBins) like certutil, regsvr32, mshta, and rundll32 using process telemetry, Sigma rules, and parent-child process analysis.

Parse and analyze Windows forensic artifacts including MFT, registry hives, prefetch files, event logs, LNK files, and jump lists using Eric Zimmerman's EZ Tools suite and KAPE.

Post-execution skill crystallization and learning engine updates for WinDAGs. Runs after successful execution to update Thompson sampling parameters, track method quality, detect monster-barring, log near-miss events, and signal Kuhnian crises. Activate on "curator", "learning update", "skill crystallization", "Thompson sampling", "monster-barring", "near-miss", "Kuhnian crisis", "post-execution learning". NOT for pre-execution risk scanning (use windags-premortem), retrospective analysis (use windags-looking-back), or DAG construction (use windags-architect).