New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Analyzing Security Logs With Splunk

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection.

Apache-2.0Auto-check passedSecurity

Install Analyzing Security Logs With Splunk

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-security-logs-with-splunk -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-security-logs-with-splunk --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/analyzing-security-logs-with-splunk .claude/skills/analyzing-security-logs-with-splunk && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
analyzing-security-logs-with-splunk
GitHub stars
34k
Token cost
~2.5k tokens
SKILL.md length
576 words
Files
4 (incl. scripts, references)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection.

  • Works in 6 steps: Scope the Investigation in Splunk → Analyze Authentication Events → Trace Process Execution → …
  • Tasks that involve Security operations
  • SKILL.md covers When to Use, Prerequisites, Workflow and Key Concepts, plus 3 more sections
  • Runs Python scripts from its folder

What it does

Analyzing Security Logs With Splunk is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. Covers Windows event logs, firewall logs, proxy logs, and authentication data analysis. Activates for requests involving Splunk investigation, SPL queries, SIEM log analysis, security event correlation, or log-based incident investigation.

Its SKILL.md is about 2.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including scripts and reference files (for example `references/api-reference.md` and `scripts/agent.py`).

It sits in Security, covering Security operations, Anomaly detection and Authentication. It works with Splunk. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Tasks that involve Security operations
  • Tasks that involve Anomaly detection
  • Tasks that involve Authentication

Example prompts

  • “Use the analyzing-security-logs-with-splunk skill to leverage Splunk Enterprise Security and SPL (Search Processing Language) to investigate…”
  • “/analyzing-security-logs-with-splunk”

Requirements

  • Python 3

Workflow steps

6 steps, taken from the step headings in SKILL.md.

  1. Scope the Investigation in Splunk
  2. Analyze Authentication Events
  3. Trace Process Execution
  4. Analyze Network Activity
  5. Build the Incident Timeline
  6. Create Detection Rules

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Analyzing Security Logs With Splunk loads about 2.5k tokens when it runs, and up to ~3.2k if it reads all its reference files. Until then it costs about 114 tokens; SKILL.md has 576 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~114
When it runs · the whole SKILL.md, loaded when a task matches
~2.5k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~3.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 576 words, ~2,512 tokens.

Download SKILL.mdSave it as .claude/skills/analyzing-security-logs-with-splunk/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.
name
analyzing-security-logs-with-splunk
description
Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. Covers Windows event logs, firewall logs, proxy logs, and authentication data analysis. Activates for requests involving Splunk investigation, SPL queries, SIEM log analysis, security event correlation, or log-based incident investigation.
domain
cybersecurity
subdomain
incident-response
tags
splunk, SPL, SIEM, log-analysis, security-monitoring
mitre_attack
T1110, T1550.002, T1021.001, T1059.001, T1003.001
version
1.0.0
author
mahipal
license
Apache-2.0
atlas_techniques
AML.T0070, AML.T0066, AML.T0082
d3fend_techniques
Executable Denylisting, Execution Isolation, File Metadata Consistency Validation, Content Format Conversion, File Content Analysis
nist_ai_rmf
MEASURE-2.7, MAP-5.1, MANAGE-2.4, MANAGE-3.1, MEASURE-3.1

Analyzing Security Logs with Splunk

When to Use

  • Investigating a security incident that requires correlation across multiple log sources
  • Hunting for adversary activity using known TTPs and IOCs
  • Building detection rules for specific attack patterns
  • Reconstructing an incident timeline from disparate log sources
  • Analyzing authentication anomalies, lateral movement, or data exfiltration patterns

Do not use for real-time packet-level analysis; use Wireshark or Zeek for full packet capture analysis.

Prerequisites

  • Splunk Enterprise or Splunk Cloud with Enterprise Security (ES) app installed
  • Log sources ingested: Windows Event Logs (via Splunk Universal Forwarder or WEF), firewall, proxy, DNS, EDR, email gateway
  • Splunk CIM (Common Information Model) data models configured for normalized field names
  • SPL proficiency at intermediate level or higher
  • Role-based access with search and accelerate_search capabilities in Splunk

Workflow

Step 1: Scope the Investigation in Splunk

Define search parameters based on incident triage data:

spl
| Set initial investigation scope
index=windows OR index=firewall OR index=proxy
  earliest="2025-11-14T00:00:00" latest="2025-11-16T00:00:00"
  (host="WKSTN-042" OR src_ip="10.1.5.42" OR user="jsmith")
| stats count by index, sourcetype, host
| sort -count

This query establishes which log sources contain relevant data for the investigation timeframe and affected assets.

Step 2: Analyze Authentication Events

Investigate suspicious authentication patterns using Windows Security Event Logs:

spl
| Detect brute force and credential stuffing
index=windows sourcetype="WinEventLog:Security" EventCode=4625
  earliest=-24h
| stats count as failed_attempts, values(src_ip) as source_ips,
  dc(src_ip) as unique_sources by TargetUserName
| where failed_attempts > 10
| sort -failed_attempts

| Detect pass-the-hash (Logon Type 9 - NewCredentials)
index=windows sourcetype="WinEventLog:Security" EventCode=4624
  Logon_Type=9
| table _time, host, TargetUserName, src_ip, LogonProcessName

| Detect lateral movement via RDP
index=windows sourcetype="WinEventLog:Security" EventCode=4624
  Logon_Type=10
| stats count, values(host) as targets by TargetUserName, src_ip
| where count > 3
| sort -count
Step 3: Trace Process Execution

Use Sysmon logs to reconstruct process execution chains:

spl
| Process creation with parent chain (Sysmon Event ID 1)
index=sysmon EventCode=1 host="WKSTN-042"
  earliest="2025-11-15T14:00:00" latest="2025-11-15T15:00:00"
| table _time, ParentImage, ParentCommandLine, Image, CommandLine, User, Hashes
| sort _time

| Detect suspicious PowerShell execution
index=sysmon EventCode=1 Image="*\\powershell.exe"
  (CommandLine="*-enc*" OR CommandLine="*-encodedcommand*"
   OR CommandLine="*downloadstring*" OR CommandLine="*iex*")
| table _time, host, User, ParentImage, CommandLine
| sort _time

| Detect LSASS credential dumping
index=sysmon EventCode=10 TargetImage="*\\lsass.exe"
  GrantedAccess=0x1010
| table _time, host, SourceImage, SourceUser, GrantedAccess
Step 4: Analyze Network Activity

Correlate network logs with endpoint events:

spl
| Detect C2 beaconing pattern
index=proxy OR index=firewall dest_ip="185.220.101.42"
| timechart span=1m count by src_ip
| where count > 0

| Detect DNS tunneling (high query volume to single domain)
index=dns
| rex field=query "(?<subdomain>[^\.]+)\.(?<domain>[^\.]+\.[^\.]+)$"
| stats count, avg(len(query)) as avg_query_len by domain, src_ip
| where count > 500 AND avg_query_len > 40
| sort -count

| Detect large data transfers (potential exfiltration)
index=proxy action=allowed
| stats sum(bytes_out) as total_bytes by src_ip, dest_ip, dest_host
| eval total_MB=round(total_bytes/1024/1024,2)
| where total_MB > 100
| sort -total_MB
Step 5: Build the Incident Timeline

Reconstruct a unified timeline across all log sources:

spl
| Unified incident timeline
index=windows OR index=sysmon OR index=proxy OR index=firewall
  (host="WKSTN-042" OR src_ip="10.1.5.42" OR user="jsmith")
  earliest="2025-11-15T14:00:00" latest="2025-11-15T16:00:00"
| eval event_summary=case(
    sourcetype=="WinEventLog:Security" AND EventCode==4624, "Logon: ".TargetUserName." from ".src_ip,
    sourcetype=="WinEventLog:Security" AND EventCode==4625, "Failed logon: ".TargetUserName,
    sourcetype=="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" AND EventCode==1,
      "Process: ".Image." by ".User,
    sourcetype=="proxy", "Web: ".http_method." ".url,
    1==1, sourcetype.": ".EventCode)
| table _time, sourcetype, host, event_summary
| sort _time
Step 6: Create Detection Rules

Convert investigation findings into persistent Splunk correlation searches:

spl
| Correlation search: PowerShell spawned by Office applications
index=sysmon EventCode=1
  Image="*\\powershell.exe"
  (ParentImage="*\\winword.exe" OR ParentImage="*\\excel.exe"
   OR ParentImage="*\\outlook.exe")
| eval severity="high"
| eval mitre_technique="T1059.001"
| collect index=notable_events

Key Concepts

TermDefinition
SPL (Search Processing Language)Splunk's query language for searching, filtering, transforming, and visualizing machine data
CIM (Common Information Model)Splunk's field normalization standard that maps vendor-specific field names to common names for cross-source queries
Notable EventAn event in Splunk Enterprise Security flagged for analyst review based on a correlation search match
Data ModelStructured representation of indexed data in Splunk enabling accelerated searches and pivot-based analysis
SourcetypeClassification label in Splunk that defines the format and parsing rules for a specific log type
Correlation SearchScheduled Splunk search that runs continuously and generates notable events when conditions are met
TimechartSPL command that creates time-series visualizations for identifying patterns, anomalies, and trends
Show full SKILL.md (236 more words)Show less

Tools & Systems

  • Splunk Enterprise Security (ES): Premium SIEM application providing correlation searches, risk-based alerting, and investigation workbench
  • Splunk SOAR: Orchestration platform integrated with Splunk ES for automated response playbooks
  • Sysmon: Microsoft system monitoring tool providing detailed process, network, and file change telemetry ingested into Splunk
  • Splunk Attack Analyzer: Automated threat analysis that detonates suspicious files and URLs, feeding results into Splunk
  • BOSS of the SOC (BOTS): SANS/Splunk training dataset for practicing incident investigation SPL queries

Common Scenarios

Scenario: Investigating Credential Stuffing Leading to Account Takeover

Context: Security operations receives an alert for multiple successful logins to a single account from geographically dispersed IP addresses within a 30-minute window.

Approach:

  1. Query Event ID 4624 for the affected account to map all login sources and times
  2. Correlate login IPs against threat intelligence feeds using a Splunk lookup table
  3. Check proxy logs for suspicious activity from the authenticated sessions
  4. Search for lateral movement from the compromised account (Event ID 4624 Type 3 to other hosts)
  5. Build a timeline showing credential stuffing attempts, successful login, and post-compromise activity
  6. Create a correlation search to detect similar patterns on other accounts

Pitfalls:

  • Searching only the last 24 hours when the credential stuffing may have occurred over weeks
  • Not checking for VPN logs that may show the same account authenticating from impossible travel distances
  • Failing to normalize timestamps across log sources in different time zones

Output Format

SPLUNK INVESTIGATION REPORT
============================
Incident:        INC-2025-1547
Analyst:         [Name]
Investigation Period: 2025-11-14 00:00 UTC - 2025-11-16 00:00 UTC

SEARCH SCOPE
Indexes:         windows, sysmon, proxy, firewall, dns
Hosts:           WKSTN-042, SRV-FILE01
Users:           jsmith, svc-backup
Source IPs:      10.1.5.42, 10.1.10.15

KEY FINDINGS
1. [timestamp] - Initial compromise via phishing (Sysmon Event 1)
2. [timestamp] - C2 established (proxy logs, beacon pattern detected)
3. [timestamp] - Credential theft (Sysmon Event 10, LSASS access)
4. [timestamp] - Lateral movement to SRV-FILE01 (Event 4624 Type 3)
5. [timestamp] - Data staging and exfiltration (proxy bytes_out anomaly)

SPL QUERIES USED
[numbered list of key queries with descriptions]

DETECTION GAPS IDENTIFIED
- No Sysmon deployed on SRV-FILE01 (blind spot)
- Proxy logs missing SSL inspection for C2 domain
- PowerShell ScriptBlock logging not enabled

RECOMMENDED DETECTIONS
1. Correlation search for Office-spawned PowerShell
2. Threshold alert for LSASS access patterns
3. Behavioral rule for beacon-interval network traffic

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 3 other files (scripts, references) in skills/analyzing-security-logs-with-splunk of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • references/api-reference.md
  • scripts/agent.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Analyzing Security Logs With Splunk next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Analyzing Security Logs With Splunk compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Analyzing Security Logs With Splunk this skillmukul975/Anthropic-Cybersecurity-Skills34k—~2.5kAutomated safety check: PassApache-2.0
Threat Detectionalirezarezvani/claude-skills28k—~3.5kAutomated safety check: PassMIT
Breach Detection Systemmukul975/Privacy-Data-Protection-Skills297—~3kAutomated safety check: PassApache-2.0
Kubernetes Network Security Auditkubeshark/kubeshark12k—~7.3kAutomated safety check: NotesApache-2.0
Detection SigmaAgentSecOps/SecOpsAgentKit2201 repos~4kAutomated safety check: PassCustom licence
Siem Detectionbriiirussell/cybersecurity-skills413—~2.6kAutomated safety check: NotesMIT

Similar skills

  • Threat Detection

    alirezarezvani/claude-skills

    A skill your agent uses when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry.

    28k GitHub stars~3.5k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Breach Detection System

    mukul975/Privacy-Data-Protection-Skills

    Implements technical breach detection capabilities including SIEM integration, DLP alert configuration, anomaly detection rules, and insider threat monitoring.

    297 GitHub stars~3k tokensUpdated 6 mo ago
    SecurityAuto-check passed

  • Kubernetes Network Security Audit

    kubeshark/kubeshark

    Hunts for compromised workloads and malicious traffic in a Kubernetes cluster by sweeping network data through Kubeshark MCP, mapped to MITRE ATT&CK.

    12k GitHub stars~7.3k tokensUpdated 2 days ago
    SecurityAuto-check: notes

  • Detection Sigma

    AgentSecOps/SecOpsAgentKit

    Generic detection rule creation and management using Sigma, the universal SIEM rule format.

    220 GitHub starsUsed in 1 repo~4k tokens
    SecurityAuto-check passed

  • Siem Detection

    briiirussell/cybersecurity-skills

    Engineer and audit SIEM detection rules — log source coverage, Sigma / KQL / SPL / Elastic query authoring, MITRE ATT&CK mapping, false-positive tuning, and detection-as-code workflows.

    413 GitHub stars~2.6k tokensUpdated 4 mo ago
    SecurityAuto-check: notes

  • Doca Argus

    NVIDIA/skills

    Official

    A skill your agent uses when the user is deploying or operating the DOCA Argus Service — the packaged BlueField-side runtime-security container that watches the BlueField and attached host for…

    3.5k GitHub stars~4.8k tokensUpdated today
    SecurityAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Works with

Categories

Questions about Analyzing Security Logs With Splunk

What does Analyzing Security Logs With Splunk do?

Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. Analyzing Security Logs With Splunk is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection.

When should I use Analyzing Security Logs With Splunk?

Analyzing Security Logs With Splunk fits situations like: tasks that involve Security operations; tasks that involve Anomaly detection; tasks that involve Authentication.

How do I install Analyzing Security Logs With Splunk in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-security-logs-with-splunk -a claude-code`. Or copy the skill folder (skills/analyzing-security-logs-with-splunk in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/analyzing-security-logs-with-splunk in your project. Claude Code loads it when a task matches its description.

How do I install Analyzing Security Logs With Splunk in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-security-logs-with-splunk -a codex`. Or copy the skill folder (skills/analyzing-security-logs-with-splunk in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/analyzing-security-logs-with-splunk in your project. Codex loads it when a task matches its description.

Can I use Analyzing Security Logs With Splunk in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-security-logs-with-splunk -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/analyzing-security-logs-with-splunk, .gemini/skills/analyzing-security-logs-with-splunk, .github/skills/analyzing-security-logs-with-splunk and .opencode/skills/analyzing-security-logs-with-splunk in your project.

What does Analyzing Security Logs With Splunk need to run?

Going by SKILL.md and its folder, Analyzing Security Logs With Splunk needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Analyzing Security Logs With Splunk access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Analyzing Security Logs With Splunk safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Analyzing Security Logs With Splunk use?

Analyzing Security Logs With Splunk is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Analyzing Security Logs With Splunk use?

About 2.5k tokens (SKILL.md is roughly 10k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 653 tokens, read only when the agent opens those files.

What are the alternatives to Analyzing Security Logs With Splunk?

Skills that share tags, products or a category with Analyzing Security Logs With Splunk: Threat Detection (alirezarezvani/claude-skills, 28k stars), Breach Detection System (mukul975/Privacy-Data-Protection-Skills, 297 stars), Kubernetes Network Security Audit (kubeshark/kubeshark, 12k stars) and Detection Sigma (AgentSecOps/SecOpsAgentKit, 220 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Analyzing Security Logs With Splunk?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 33,993 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.