# Analyzing Windows Event Logs In Splunk

Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect...

- Repository: https://github.com/AgentFlocks/flocks (504 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add AgentFlocks/flocks --skill analyzing-windows-event-logs-in-splunk -g -a claude-code -y`
Codex: `npx skills add AgentFlocks/flocks --skill analyzing-windows-event-logs-in-splunk -g -a codex -y`
Cursor: `npx skills add AgentFlocks/flocks --skill analyzing-windows-event-logs-in-splunk -g -a cursor -y`
Gemini CLI: `npx skills add AgentFlocks/flocks --skill analyzing-windows-event-logs-in-splunk -g -a gemini-cli -y`

## Description

Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Analyzing Windows Event Logs in Splunk

## When to Use

Use this skill when:
- SOC analysts investigate alerts related to Windows authentication, process execution, or AD changes
- Detection engineers build SPL queries for Windows-based threat detection
- Incident responders need forensic timelines of Windows endpoint or domain controller activity
- Periodic threat hunting targets Windows-specific ATT&CK techniques

**Do not use** for Linux/macOS endpoint analysis or network-only investigations.

## Prerequisites

- Splunk with Windows Event Log data ingested (sourcetype `WinEventLog:Security`, `WinEventLog:System`, `XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`)
- Sysmon deployed on endpoints with SwiftOnSecurity or Olaf Hartong configuration
- CIM data model acceleration for Endpoint and Authentication data models
- Knowledge of Windows Security Event IDs and Sysmon event types

## Workflow

### Step 1: Authentication Attack Detection

**Brute Force Detection (EventCode 4625, Failed Logon):**
```spl
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4625
| stats count, dc(TargetUserName) AS unique_users, values(TargetUserName) AS targeted_users
  by src_ip, Logon_Type, Status
| where count > 20
| eval attack_type = case(
    Logon_Type=3, "Network Brute Force",
    Logon_Type=10, "RDP Brute Force",
    Logon_Type=2, "Interactive Brute Force",
    1=1, "Other"
  )
| eval status_meaning = case(
    Status="0xc000006d", "Bad Username or Password",
    Status="0xc000006a", "Incorrect Password (valid user)",
    Status="0xc0000234", "Account Locked Out",
    Status="0xc0000072", "Account Disabled",
    1=1, Status
  )
| sort - count
| table src_ip, attack_type, status_meaning, count, unique_users, targeted_users
```

The rest: https://github.com/AgentFlocks/flocks/blob/HEAD/.flocks/flockshub/plugins/skills/Anthropic-Cybersecurity-Skills/analyzing-windows-event-logs-in-splunk/SKILL.md