Results for “event-correlation”

Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules.

Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns and attribute them to common threat actors.

Monitor and react to content distribution lifecycle events using the Sling Distribution API, covering event handling, queue monitoring, and distribution tracking.

Migrates OSGi EventAdmin handlers and JCR EventListeners to AEM Cloud Service-compliant patterns, including EventHandler+JobConsumer split, routing rules, and leader-only execution.

Takes a conference or event speakers URL, extracts the people, filters their companies against the user's ICP, and deep-researches only the speakers at ICP-fit companies. Outputs a person-first HTML report with a 'why reach out' rationale per person.

Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques.

Append-only event log — the probabilistic record of everything that happened in the project. Use whenever something notable happens that the project should remember — work items created/transitioned, decisions recorded, bindings changed, incidents occurred, releases shipped.

Manage and monitor Heap product analytics by querying the Heap API for account info, defined events, user properties, segments, event volume, active users, and data health.

Create comprehensive event plans with logistics. TRIGGERS - Use when user needs help with event-plan related tasks.

Build event budgets with categories and contingency. TRIGGERS - Use when user needs help with event-budget related tasks.

飞书事件订阅：通过 WebSocket 长连接实时监听飞书事件（消息、通讯录变更、日历变更等），输出 NDJSON 到 stdout，支持 compact Agent 友好格式、正则路由、文件输出。当用户需要实时监听飞书事件、构建事件驱动管道时使用。

Create comprehensive event plans with logistics. TRIGGERS - Use when user needs help with event-plan related tasks.

Build event budgets with categories and contingency. TRIGGERS - Use when user needs help with event-budget related tasks.

Write React hooks with clean effect boundaries and measured memoization. Use when working with `useEffect`, custom hooks, refs, transitions, or hook dependency problems in React.

Use for writing, reviewing, debugging, testing, or analyzing Python SimPy discrete-event simulations. Trigger on Environment, Event, Process, timeout, Resource, PriorityResource, PreemptiveResource, Container, Store, queues, interrupts, simulation clocks, replications, or SimPy monitoring. Do not use for asyncio services, wall-clock schedulers, continuous ODE solvers, or Monte Carlo code without an event-process model.

Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.

Manages and analyzes incidents, post-incident reviews, and collaboration workflows in Allma via its REST API, covering incident discovery, timeline tracking, stakeholder communication, and retrospective analysis.

Use this skill whenever the user wants to conduct an event study, create event study plots, test for parallel trends, implement difference-in-differences designs, or work with any panel data estimation that involves pre/post treatment comparisons. Trigger on phrases like "event study", "parallel trends", "pre-trends", "dynamic treatment effects", "leads and lags", "TWFE", "two-way fixed effects", "staggered adoption", "staggered treatment", "difference-in-differences", "DiD", "Sun and Abraham", "Callaway and Sant'Anna", "de Chaisemartin", "Borusyak", "did_multiplegt", "fixest", "did2s", "bacon decomposition", or any reference to plotting coefficients around a treatment event. Also trigger when the user uploads panel data and wants to estimate treatment effects with variation in treatment timing. All code is in R.

Matches events with venues based on capacity, amenities, budget, and location requirements

Plan a field event, dinner, or conference presence that actually produces pipeline, not just badges scanned. It builds the right guest list, designs a draw worth showing up for, plans the on-site motion so conversations happen, and writes the follow-up that converts, because the pipeline is made after the event, not at it. Built for B2B field marketing and sales teams, customizable to your CRM and your event motion. Trigger on "plan a field event", "customer dinner plan", "conference presence", "how do I get pipeline from this event", "event guest list", "event follow-up plan", or any field-event or in-person pipeline request.

Queries video analytics incidents, alerts, metrics, and sensor data from Elasticsearch via the VA-MCP server.

AL event-driven architecture for Business Central. Use when creating EventSubscribers, IntegrationEvents, BusinessEvents, or implementing publisher/subscriber patterns in extensions.

Apache Kafka event streaming platform. Covers producers, consumers, topics, partitions, Kafka Streams, and Connect. Use for high-throughput event-driven architectures and real-time data pipelines. USE WHEN: user mentions "kafka", "event streaming", "kafka streams", "consumer groups", "topic partitions", asks about "high throughput messaging", "event sourcing", "log aggregation", "real-time pipelines" DO NOT USE FOR: simple queues - use `rabbitmq` or `activemq`; cloud-native lightweight - use `nats`; AWS-native - use `sqs`; Azure-native - use `azure-service-bus`; GCP-native - use `google-pubsub`

Clerk webhooks for real-time events and data syncing. Verify with verifyWebhook from the framework-specific package. Handle user, session, organization, billing, and payment events. Build event-driven features like database sync, notifications, and integrations.

Correlate findings across OSINT sources—username enumeration, email lookups, social media profiles, domain records, breach databases, and dark-web mentions—into unified intelligence profiles with confidence scoring and link analysis.

Lark/Feishu real-time event listening / subscribing / consuming: stream events as NDJSON via `lark-cli event consume <EventKey>` (covers IM messages/reactions/chat changes, Approval status changes, Task updates, VC meeting started/joined/ended, Minutes generated, Whiteboard updated, etc.). Use for Lark bots, real-time message processing, long-running subscribers, streaming webhook/push handlers. Supports `--max-events` / `--timeout` bounded runs and a stderr ready-marker contract — designed for AI agents running as subprocesses.

Investigate security incidents by correlating Windows event logs, firewall, proxy, and authentication data using Splunk SPL queries and Enterprise Security.

Automates incident ticketing by connecting SIEM alerts to ServiceNow, Jira, or TheHive for structured tracking, SLA management, escalation workflows, and compliance documentation.

Advanced Tauri event patterns for bidirectional communication, streaming data, window-to-window messaging, and custom event handling

输入活动目标和预算，输出完整可落地的活动方案，含线上数字营销campaign、线下执行方案、O2O联动设计、传播计划、预算表和应急预案。 支持线上裂变、线下发布会、节日促销、行业峰会、数字营销campaign等多种活动类型。 内置渠道策略矩阵、转化路径设计、A/B测试计划和ROI预估框架。 当用户要求"活动策划"、"活动方案"、"市场活动"、"策划方案"、"发布会策划"、 "线下活动"、"促销活动"、"品牌活动"、"快闪店"、"裂变活动"、"周年庆方案"、 "campaign策划"、"数字营销"、"线上活动"、"活动预算"时触发此技能。

Generate an event ticket image with QR code, event name, date, venue, and seat information.

DeepEval — LLM evaluation framework, RAG metrics, hallucination detection, red-teaming, CI/CD integration

Runbook skill for failures: cron error, PA failure, cascade, gateway disconnect, semantic DB stale. Walks: detect → classify → diagnose → notify → log. Replaces ad-hoc failure handling. Triggers: "cron failed", "X is broken", "cascade", "incident", "gateway down", "PA failure".