siem-edr-connector
Collect, normalize and correlate security alerts from SIEM and EDR platforms (Splunk SPL and REST search jobs, Elastic Security KQL/EQL/ES|QL and detection rules API, Microsoft Sentinel and Defender for Endpoint KQL, Wazuh API and indexer, CrowdStrike Falcon FQL detects and alerts, SentinelOne Deep Visibility PowerQuery) into ECS or OCSF events, convert Sigma rules per backend, group alerts into incidents per host and user with MITRE ATT&CK tactics and a severity score, and produce a triage report.
When to use
Use when the user asks to "pull alerts from Splunk", "correlate EDR alerts", "convert this Sigma rule", "normalize Defender events to ECS", "hunt across SIEM and EDR", or shares exported alert JSON from a security console. In French "corréler les alertes SIEM", "récupérer les détections CrowdStrike", "convertir une règle Sigma".
Inputs and tools
The skill takes the request of the user in natural language: its frontmatter declares no argument. It declares no allowed-tools: the tools available are those of the agent that loads it, under the tool policy of the project.
Reference
| Field | Value |
|---|---|
| Name | siem-edr-connector |
| Category | Security |
| Version | Not declared |
| Licence | Not declared |
| Allowed tools | Not declared |
| Plugins | - |
| Source | catalog/navin/skills/siem-edr-connector/SKILL.md |
| Digest | sha256:017e272b74599905d6c50967cac80e49aa4e904eb2e50592664f4f719ebc73c5 |
skill_md_digest | sha256:229e9a7e985ad758ac3ea8f72e9641399dd01623c531358b358fb0c2052e7e3e |
| Emoji | 🛰️ |
Bundled files
| Path | Count |
|---|---|
catalog/navin/skills/siem-edr-connector/examples | 4 |
catalog/navin/skills/siem-edr-connector/references | 3 |
catalog/navin/skills/siem-edr-connector/scripts | 2 |
Frontmatter
Every field of the SKILL.md frontmatter, with the value of the source:
| Field | Value |
|---|---|
name | siem-edr-connector |
description | Collect, normalize and correlate security alerts from SIEM and EDR platforms (Splunk SPL and REST search jobs, Elastic Security KQL/EQL/ES|QL and detection rules API, Microsoft Sentinel and Defender for Endpoint KQL, Wazuh API and indexer, CrowdStrike Falcon FQL detects and alerts, SentinelOne Deep Visibility PowerQuery) into ECS or OCSF events, convert Sigma rules per backend, group alerts into incidents per host and user with MITRE ATT&CK tactics and a severity score, and produce a triage report. Use when the user asks to "pull alerts from Splunk", "correlate EDR alerts", "convert this Sigma rule", "normalize Defender events to ECS", "hunt across SIEM and EDR", or shares exported alert JSON from a security console. In French "corréler les alertes SIEM", "récupérer les détections CrowdStrike", "convertir une règle Sigma". |
metadata.navin.emoji | 🛰️ |
metadata.navin.category | security |