Configuring Windows Event Logging For Detection
mukul975/Anthropic-Cybersecurity-Skills
Configures Windows Event Logging with advanced audit policies to generate high-fidelity security events for threat detection and forensic investigation.
You have just completed a task, started a session, dispatched work to another agent, finished a research cycle, or taken any significant action — and you need to record it so the dashboard activity…
$ npx skills add grandamenium/cortextos --skill event-logging -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install grandamenium/cortextos event-logging --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/grandamenium/cortextos.git skills-src && mkdir -p .claude/skills && cp -r skills-src/community/skills/event-logging .claude/skills/event-logging && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "event-logging" agent skill from https://github.com/grandamenium/cortextos/tree/main/community/skills/event-logging into .claude/skills/event-logging/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "event-logging", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/grandamenium/cortextos/tree/main/community/skills/event-loggingType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add grandamenium/cortextos --skill event-logging -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install grandamenium/cortextos event-logging --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/grandamenium/cortextos.git skills-src && mkdir -p .agents/skills && cp -r skills-src/community/skills/event-logging .agents/skills/event-logging && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "event-logging" agent skill from https://github.com/grandamenium/cortextos/tree/main/community/skills/event-logging into .agents/skills/event-logging/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "event-logging", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add grandamenium/cortextos --skill event-logging -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install grandamenium/cortextos event-logging --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/grandamenium/cortextos.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/community/skills/event-logging .cursor/skills/event-logging && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "event-logging" agent skill from https://github.com/grandamenium/cortextos/tree/main/community/skills/event-logging into .cursor/skills/event-logging/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "event-logging", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/grandamenium/cortextos.git --path community/skills/event-logging--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add grandamenium/cortextos --skill event-logging -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install grandamenium/cortextos event-logging --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/grandamenium/cortextos.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/community/skills/event-logging .gemini/skills/event-logging && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "event-logging" agent skill from https://github.com/grandamenium/cortextos/tree/main/community/skills/event-logging into .gemini/skills/event-logging/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "event-logging", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install grandamenium/cortextos event-loggingInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add grandamenium/cortextos --skill event-logging -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/grandamenium/cortextos.git skills-src && mkdir -p .github/skills && cp -r skills-src/community/skills/event-logging .github/skills/event-logging && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "event-logging" agent skill from https://github.com/grandamenium/cortextos/tree/main/community/skills/event-logging into .github/skills/event-logging/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "event-logging", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add grandamenium/cortextos --skill event-logging -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install grandamenium/cortextos event-logging --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/grandamenium/cortextos.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/community/skills/event-logging .opencode/skills/event-logging && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "event-logging" agent skill from https://github.com/grandamenium/cortextos/tree/main/community/skills/event-logging into .opencode/skills/event-logging/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "event-logging", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
event-loggingYou have just completed a task, started a session, dispatched work to another agent, finished a research cycle, or taken any significant action — and you need to record it so the dashboard activity…
Event Logging is an agent skill from grandamenium/cortextos. You have just completed a task, started a session, dispatched work to another agent, finished a research cycle, or taken any significant action — and you need to record it so the dashboard activity feed shows your work. Without logging, you are invisible. Every session start, task completion, and major coordination action must produce at least one event. If you have been active but see no events in the dashboard, you have been logging nothing.
Its SKILL.md is about 810 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
The licence is MIT.
Read from SKILL.md and the folder at commit 6f93838. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).
From the folder's file list and the shell code blocks in SKILL.md.
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Event Logging loads about 805 tokens when it runs. Until then it costs about 115 tokens; SKILL.md has 88 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from grandamenium/cortextos at commit 6f93838, republished under its MIT licence (© grandamenium). 88 words, ~805 tokens.
.claude/skills/event-logging/SKILL.md (or your agent's skills folder).Events are how the dashboard activity feed knows what you're doing. No events = you look dead. Log aggressively.
cortextos bus log-event <category> <event_name> <severity> [--meta '<json>']| Parameter | Options |
|---|---|
| category | action task heartbeat message approval error metric milestone |
| severity | info warning error critical |
cortextos bus log-event action session_start info \
--meta "{\"agent\":\"$CTX_AGENT_NAME\"}"cortextos bus log-event action session_end info \
--meta "{\"agent\":\"$CTX_AGENT_NAME\"}"cortextos bus log-event task task_completed info \
--meta "{\"task_id\":\"$TASK_ID\",\"agent\":\"$CTX_AGENT_NAME\",\"summary\":\"<what was done>\"}"cortextos bus log-event heartbeat agent_heartbeat info \
--meta "{\"agent\":\"$CTX_AGENT_NAME\",\"status\":\"active\"}"cortextos bus log-event action research_complete info \
--meta "{\"topic\":\"<topic>\",\"findings\":3,\"agent\":\"$CTX_AGENT_NAME\"}"cortextos bus log-event message message_sent info \
--meta "{\"to\":\"<agent>\",\"priority\":\"normal\",\"agent\":\"$CTX_AGENT_NAME\"}"cortextos bus log-event error <operation>_failed error \
--meta "{\"operation\":\"<what failed>\",\"error\":\"<message>\",\"agent\":\"$CTX_AGENT_NAME\"}"cortextos bus log-event action approval_created info \
--meta "{\"approval_id\":\"$APPR_ID\",\"category\":\"<cat>\",\"agent\":\"$CTX_AGENT_NAME\"}"# Task dispatched to specialist
cortextos bus log-event action task_dispatched info \
--meta "{\"to\":\"<agent>\",\"task\":\"<title>\",\"agent\":\"$CTX_AGENT_NAME\"}"
# Status briefing sent to user
cortextos bus log-event action briefing_sent info \
--meta "{\"type\":\"status_update\",\"agent\":\"$CTX_AGENT_NAME\"}"© grandamenium, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Just SKILL.md in community/skills/event-logging of grandamenium/cortextos.
Open the folder on GitHubat commit 6f93838
Event Logging next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Event Logging this skillgrandamenium/cortextos | 101 | — | ~805 | Automated safety check: Pass | MIT | |
| Configuring Windows Event Logging For Detectionmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~1.6k | Automated safety check: Pass | Apache-2.0 | |
| Extracting Windows Event Logs Artifactsmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~3.3k | Automated safety check: Pass | Apache-2.0 | |
| Analyzing Windows Event Logs In Splunkmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.8k | Automated safety check: Pass | Apache-2.0 | |
| Growth Logaffaan-m/ECC | 276k | 1 repos | ~1.7k | Automated safety check: Pass | MIT | |
| Eventscoreyhaines31/marketingskills | 54k | — | ~3k | Automated safety check: Pass | MIT |
mukul975/Anthropic-Cybersecurity-Skills
Configures Windows Event Logging with advanced audit policies to generate high-fidelity security events for threat detection and forensic investigation.
mukul975/Anthropic-Cybersecurity-Skills
Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.
mukul975/Anthropic-Cybersecurity-Skills
Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to…
affaan-m/ECC
Write growth log entries that extract reusable patterns from completed work — root cause, transferable rule, and a recognizable signal — instead of diary-style event narration, with a 4-8 sentence…
coreyhaines31/marketingskills
When the user wants to plan, run, sponsor, speak at, or get pipeline from events — webinars, conferences, trade shows, meetups, dinners, workshops, virtual summits, or user conferences.
sickn33/agentic-awesome-skills
Delegate tasks to OpenAI Codex CLI and Google Antigravity CLI from Claude Code with topic-aware sessions
grandamenium/cortextos
Diagnose cortextOS itself when the framework misbehaves — an agent has gone silent or wedged, agents are crash-looping, Telegram or agent-to-agent messages are not arriving, crons did not fire, an…
grandamenium/cortextos
You have completed something significant and want the whole org — all agents and the user — to know about it.
grandamenium/cortextos
You need to make a purchase on behalf of the user — buy a SaaS subscription, pay for an API, purchase a domain, or any transaction requiring a credit card.
grandamenium/cortextos
Migrate ANY cortextOS agent from the claude-code runtime to the live codex-app-server runtime.
grandamenium/cortextos
Complete cortextos bus CLI reference - all available commands with examples.
grandamenium/cortextos
Daily cron-driven scan of news/forums/social in a domain to surface market shifts, new competitors, regulatory changes, and net-new opportunities.
You have just completed a task, started a session, dispatched work to another agent, finished a research cycle, or taken any significant action — and you need to record it so the dashboard activity…. Event Logging is an agent skill from grandamenium/cortextos. You have just completed a task, started a session, dispatched work to another agent, finished a research cycle, or taken any significant action — and you need to record it so the dashboard activity feed shows your work.
Run `npx skills add grandamenium/cortextos --skill event-logging -a claude-code`. Or copy the skill folder (community/skills/event-logging in grandamenium/cortextos) into .claude/skills/event-logging in your project. Claude Code loads it when a task matches its description.
Run `npx skills add grandamenium/cortextos --skill event-logging -a codex`. Or copy the skill folder (community/skills/event-logging in grandamenium/cortextos) into .agents/skills/event-logging in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add grandamenium/cortextos --skill event-logging -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/event-logging, .gemini/skills/event-logging, .github/skills/event-logging and .opencode/skills/event-logging in your project.
SKILL.md names no scripts, command-line tools or credentials: Event Logging is instructions for the agent only.
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
Event Logging is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
About 805 tokens (SKILL.md is roughly 3.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Event Logging: Configuring Windows Event Logging For Detection (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Extracting Windows Event Logs Artifacts (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Analyzing Windows Event Logs In Splunk (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Growth Log (affaan-m/ECC, 276k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
grandamenium (a GitHub user) maintains it in grandamenium/cortextos, which has 101 GitHub stars. The repository holds 55 skills in this directory. The repository was last updated on September 23, 2026.
Source: grandamenium/cortextos on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.