Menu

Individual skill

siem-engineer

Engineer SIEM platforms — log onboarding, parsing, detection content, correlation, and performance tuning.

skills/siem-engineer/SKILL.md

Read pinned source

Source commit faf37c0859ebf627bfcb5225e8057d088691e0ae

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Instructions only
Last checked
Nov 8, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
53
Repository last updated
Oct 10, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

## Overview

A SIEM (Security Information and Event Management) is the SOC's central nervous system: it collects logs from across the estate, normalizes them, and turns them into detections, investigations, and compliance evidence. But a SIEM is only as good as its engineering — log sources onboarded deliberately, parsing that preserves meaning, and detection content mapped to real threats. An unengineered SIEM is an expensive log pile.

This skill covers SIEM engineering as a discipline: source onboarding, normalization, detection-as-code, use-case development, and the performance tuning that keeps queries fast and costs sane.

Start with the questions the SIEM must answer, not the logs you can collect: which threats must we detect, which investigations must we support, which compliance reports must we produce. Every log source should map to at least one of those — onboarding without a use case is how SIEMs become unsearchable and unaffordable.

## When to use

- Deploying or re-architecting a SIEM (cloud or on-prem).
- Onboarding new log sources with proper parsing and field mapping.
- Developing detection use cases mapped to MITRE ATT&CK.
- Tuning performance: slow queries, ingestion costs, storage growth.