Example SIEM Query

Demo · fictional

Builds and explains SIEM queries for alert triage from a short description of the alert.

For Alert triage, Detection engineeringWorks with Claude Code, CodexMaintained example, last push 2026-10-02

SkillA skill is a set of instructions, and sometimes scripts, that your AI client loads when a task needs it. by example · read from the code at 9b8c7d6 (v1.2.0) on 2026-10-12The date we last read the tool’s files. The code after “at” names the exact version (the git commit) we read; a newer version may differ. · Not run yet.Whether we have run the tool in our lab. “Did more than it said” means the run used rights its description does not name; “did no more than it said” means it stayed within them.

Code showsWhat a reading of the code found the tool can do, at the checked version, in the words of the rights table in the record. It is a ceiling, not what the tool did. A right marked unknown has no evidence either way, and that never counts as harmless.

What the code shows, worst first. No run advice yet: the one word needs a read under the full rule.

No evidence. Secrets. Unknown: query templates refer to SIEM connection settings that live outside the repository. That never counts as zero.

Before first useSettings for your AI client that limit the tool to the rights its task needs; derived from the code unless marked tested. derived from the code, not tested

Claude Code: permissions.allow: [Read, Grep]; no network, no shell.
Codex: sandbox_mode=read-only; network_access=false.

What we checked, and what we found Disagree?

Skill · code showsreach ≥1 · scoped

What the code can reach, 0 to 3 per right; a dashed point means no evidence, never zero. The three readings

Is it for you?

Made for: Writes SIEM queries from an alert description and explains them.
Use it when: Draft a hunting query for a suspicious login alert Alert triage
Turn a detection idea into a first query to test Detection engineering
Not for: Nothing excluded by the author in the files read
You need: Access to your SIEM to run the query yourself; the skill holds no connection settings
Details: You need

Install

linked, not distributed: the Field Guide does not bundle agents or MCP servers

Claude Code

claude plugin marketplace add https://readbeforerun.ai/marketplace.json

claude plugin install example-siem-query@field-guide

pinned to 9b8c7d6 · demo, not installable

skills CLI

npx skills add example/security-skills --skill siem-query

not pinned: installs the current upstream state, not 9b8c7d6 · demo, not installable

Run it with least privilege

claude code: permissions.allow: [Read, Grep]; no network, no shell
codex: sandbox_mode=read-only; network_access=false

derived, not tested: proposed from the code analysis

End of the card. Below: what we checked, and what we found.Markdown JSON

The record · every value with its evidence

What we checked, and what we found.

Profile read at commit 9b8c7d6 on 2026-10-25: 9 facts, each with its quoted line confirmed by script; not installed, not run in the lab.Each fact was read from the tool's files at the checked version and links to the line it comes from. Where nothing was found, the page says so instead of assuming “none”.

Selected by criteria v0.1, approved by Ilja Schlak: awaiting approval. Each section opens with the answer; the file and line of every fact follow it.

What it can change the capability groups as upstream groups them, worst first

No changing, deleting or command-running capability among the groups read.

What it can do, by group
Group	What it covers	Effect	On by default
write-query	Writes a query in the dialect you name and explains each clause; it does not run it. `SKILL.md L9`	reads	yes

Where it sends data and who can connect to it

No outside connection found in the files read.

Listens for no connections in the files read.

Other connections not ruled out: read in the documentation and the cited code, not searched in full.

How it runs generated from the files read, never drawn by hand

Instructions in SKILL.md that your AI client follows; the query goes back to you as text. SKILL.md L1-6

Your AI client

Parts that live inside the AI client: skill instructions, client configuration.

SKILL.md The instructions and query patterns your AI client follows. SKILL.md L8

The six rights, read three waysThe six rights a tool can take (files, network, execution, secrets, persistence, approval), each read three ways and rated 0 to 3. 0 never means safe; “?” means no evidence. what the author says, what the code shows, what one lab run showed

Level 1 (scoped), one right unknown, read from the code. Not run in our lab yet.

Privilege Reach: six rights, each read three ways. Levels 0 to 3; ? means no evidence.
Right	Author sayswhat the author says	Code showswhat static analysis finds	Run showedwhat one lab run showed
Fileswhere does it read and write?
Networkwhom does it talk to?
Executionwhat does it run?
Secretswhich credentials does it touch?
Persistencewhat survives the run?
Approvaldoes it ask before acting?

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe · zero means: none declared (Declared), none found (Code), none observed (Lab)

Author says: the evidence

Files · 0README.md L18 states that the skill only reads the files you pass to it (demo, no upstream file)
Approval · 1SKILL.md L5 allowed-tools: Read, Grep (narrow pre-approvals) (demo, no upstream file)

Code shows: the evidence

Files · 0none found: patterns fs-v0.1 in 5 files at 9b8c7d6
Network · 0none found: patterns net-v0.1 in 5 files at 9b8c7d6
Execution · 0none found: patterns exec-v0.1 in 5 files at 9b8c7d6
Secrets · ?no evidence: query templates refer to SIEM connection settings that live outside the repository
Persistence · 0none found: patterns persist-v0.1 in 5 files at 9b8c7d6
Approval · 1SKILL.md L5 allowed-tools: Read, Grep (demo, no upstream file)

Valid for commit 9b8c7d6 (v1.2.0) · checked 2026-10-12 · method reach-v0.1The published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.

Limits and risks what the files say that fits nowhere else, and what this reading does not cover

Not covered: what it does at runtime. Other connections not ruled out: read in the documentation and the cited code, not searched in full.

What you need and what the documented installer does

What you need
Kind	What
AI client	Claude Code, Codex
Other	Access to your SIEM to run the query yourself; the skill holds no connection settings. `SKILL.md L12`

Lab runs one run is an observation, not a benchmark

No lab run yet. Once we run it, this section shows what it did and whether it did more than it said.

Our notes where we have used it; marked as ours, they change no value

Demo entry. Fictional maintainer remark: in the demo, this is the skill I would hand to a new SOC analyst first.

About this entry

Type: Skill · Defensive · works with Claude Code, Codex
Source: github.com/example/security-skills · skills/siem-query · Apache-2.0 · manifest SKILL.md
Version readThe install command installs exactly the version we checked (the pinned git commit), so what you get is what the card describes.: 9b8c7d6 · v1.2.0 · last upstream push 2026-10-02 · no release since the pinned commit (current v1.2.0)
In the catalog: listed · added 2026-10-01 · last checked 2026-10-12 · next check 2027-01-10 · fresh
ScannersA scan of the tool's files with a scanner for malicious patterns. “Pending” means it has not run yet.: cisco-skill-scanner: not run, pending
Changes: none since the entry was added on 2026-10-01
MethodThe published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.: v0.1 · reach-v0.1 · badge · the rules

Disagree?

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

This entry as Markdown as JSON

How this entry was checked, and how to cite it

Selected by the published criteria (method v0.1). What the author says comes only from author statements; what the code shows comes from the code and manifests at commit 9b8c7d6, each with one evidence line. A “?” means no evidence, never zero; zero never means safe.

The descriptive profile (what it does, can do, how it runs, what it needs) was read through the same isolated pipeline at commit 9b8c7d6 on 2026-10-25: one reader proposed every fact with a quoted line, a script confirmed each quoted line (9 of 9), and a second reader checked each sentence against its lines. Where nothing was found, the page says so instead of assuming “none”.

Known issues and limits: remote server-side behaviour stays “?”; the lab is not your production; static analysis can miss runtime behaviour.

Placement, badges or fast tracks are not for sale. The author is employed by an IT consultancy; the company has no influence on selection, execution or result.

Cite this:

Ilja Schlak. "Example SIEM Query". Agentic Security Field Guide, checked 2026-10-12, method reach-v0.1. https://readbeforerun.ai/catalog/example-siem-query/

The method · the rules

For maintainers

Badge for your README (reach ≥1 · not run yet):

[![reach ≥1 · not run yet](https://readbeforerun.ai/badge/example-siem-query.svg)](https://readbeforerun.ai/catalog/example-siem-query/)