MHaggis

Data Sources Reference — Data skill for Claude Code

Data community

Data Sources Quick Reference.

How to install Data Sources Reference

Installs to ~/.claude/skills/mhaggis-security-detections-mcp-data_sources_reference/SKILL.md

Terminal

mkdir -p ~/.claude/skills/mhaggis-security-detections-mcp-data_sources_reference && curl -fsSL https://raw.githubusercontent.com/MHaggis/Security-Detections-MCP/HEAD/.claude/skills/DATA_SOURCES_REFERENCE.md -o ~/.claude/skills/mhaggis-security-detections-mcp-data_sources_reference/SKILL.md

Restart Claude Code, or start a new session, for it to be picked up.

What Data Sources Reference does

Data Sources Quick Reference

This reference covers data sources across all 4 supported SIEM platforms. Use the field name mapping table below to translate between platforms when writing or converting detections.

Common Windows Data Sources

Data Source	Key Events	Use For
Sysmon EventID 1	Process Creation	Process monitoring, parent-child
Sysmon EventID 3	Network Connection	Outbound connections, C2
Sysmon EventID 7	Image Load

Alternatives in Data

Bitbucket Data Center 71.9k ★
Financial Services — Reference agents, skills, and data connectors for the financial-services workflows we see most — investment ba 34.5k ★
Data Contract — This document defines which files belong to the system (auto-updatable) and which belong to the user (never to 32.5k ★