Results for “event-log-analysis”

Analyze Linux system logs including auth.log, syslog, systemd journal, and auditd to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised systems.

**Server Logs:**

Append-only event log — the probabilistic record of everything that happened in the project. Use whenever something notable happens that the project should remember — work items created/transitioned, decisions recorded, bindings changed, incidents occurred, releases shipped.

Detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement by analyzing Windows Security, System, and Sysmon event logs in Splunk using SPL queries mapped to MITRE ATT&CK techniques.

Create comprehensive event plans with logistics. TRIGGERS - Use when user needs help with event-plan related tasks.

Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.

Create comprehensive event plans with logistics. TRIGGERS - Use when user needs help with event-plan related tasks.

Routes runtime-log requests into an evidence packet to isolate the first actionable blocker, repeated signature, blast radius, or safest next read-only check.

Detects DNS-based data exfiltration, tunneling, and DGA communication by analyzing query logs with entropy analysis, volume anomalies, and subdomain length detection in SIEM platforms.

Lark/Feishu real-time event listening / subscribing / consuming: stream events as NDJSON via `lark-cli event consume <EventKey>` (covers IM messages/reactions/chat changes, Approval status changes, Task updates, VC meeting started/joined/ended, Minutes generated, Whiteboard updated, etc.). Use for Lark bots, real-time message processing, long-running subscribers, streaming webhook/push handlers. Supports `--max-events` / `--timeout` bounded runs and a stderr ready-marker contract — designed for AI agents running as subprocesses.

Analyzes application logs to identify errors, performance issues, and security incidents

Use when analyzing patterns across multiple incidents, bugs, failures, or successes to extract organizational learning. This skill provides procedures for synthesizing individual experiences into actionable lessons that improve team-wide practices.

Migrates OSGi EventAdmin handlers and JCR EventListeners to AEM Cloud Service-compliant patterns, including EventHandler+JobConsumer split, routing rules, and leader-only execution.

Generates detailed, technology-agnostic implementation blueprints by analyzing project architecture, technology stacks, and data flow patterns.

Debug agent execution by querying trace and metric tables, analyzing tool calls, durations, errors, and performance trends.

Incident Report (Blameless RCA)

Manage and monitor Heap product analytics by querying the Heap API for account info, defined events, user properties, segments, event volume, active users, and data health.

Investigates slow responses, tool failures, and guardrail rejections by querying agent trace logs and performance metrics.

Use this skill for on-chain data, explorers, Dune-style queries, wallets, transfers, contract events. Trigger when the task involves crypto work related to Onchain Data Analytics, production implementation, audits, debugging, strategy, or validation.

Search and analyze your own session logs (older/parent conversations) using jq.

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules from audit event patterns.

Analyze AWS CloudTrail logs for security monitoring, threat detection, and forensic investigation using Athena, CloudWatch Logs Insights, and SIEM integration.

Diagnose your own behavior by reading the structured logs you leave behind — turns.jsonl, events.jsonl, chat_history.jsonl, scheduler.yaml. Use when something has gone wrong (a message didn't land, a scheduled job isn't firing, a communication pattern feels off), when you need to understand a pattern over many turns, or when cost / token usage needs auditing. Covers jq query recipes and points at the debugging-jobs / debugging-communication / debugging-drift companion guides for specific failure modes.

Investigate a problem, log it to the debug changelog, cross-check past issues, and suggest a non-duplicate fix.

Read-only audit of product-analytics instrumentation: event taxonomy, funnel completeness, consent-gated firing, dead/duplicate/phantom events. Use when "audit our analytics", "are we tracking the right events", "funnel instrumentation", or before iterate-post-launch. PostHog/Amplitude/Mixpanel/GA4.

Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.

Build comprehensive forensic super-timelines using Plaso (log2timeline) to correlate events across file systems, logs, and artifacts into a unified chronological view.

Analyze Windows Security Event Logs to detect RDP brute force attacks by parsing Event ID 4625 and 4624 entries, identifying source IP frequency, and generating detection reports.

Query and filter Datadog logs from the shell using the Composio CLI. Run scoped log searches, pivot across services/environments, and export structured JSON for incident investigation and diagnostics.

Search and analyze conversation history stored in session JSONL files using jq and shell commands.

Capture delivery evidence, commands, changed files, blockers, and standards feedback after a work session.