MHaggis

DATA SOURCES REFERENCE

Name: DATA SOURCES REFERENCE
Author: MHaggis

Data community

SOURCE https://github.com/MHaggis/Security-Detections-MCP/blob/main/.claude/skills/DATA_SOURCES_REFERENCE.md

Description

# Data Sources Quick Reference This reference covers data sources across all 4 supported SIEM platforms. Use the field name mapping table below to translate between platforms when writing or converting detections. ## Common Windows Data Sources | Data Source | Key Events | Use For | |-------------|-----------|---------| | Sysmon EventID 1 | Process Creation | Process monitoring, parent-child | | Sysmon EventID 3 | Network Connection | Outbound connections, C2 | | Sysmon EventID 7 | Image Load

Installation

Installs to ~/.claude/skills/mhaggis-security-detections-mcp-data_sources_reference/SKILL.md

Terminal

mkdir -p ~/.claude/skills/mhaggis-security-detections-mcp-data_sources_reference && curl -fsSL https://raw.githubusercontent.com/MHaggis/Security-Detections-MCP/HEAD/.claude/skills/DATA_SOURCES_REFERENCE.md -o ~/.claude/skills/mhaggis-security-detections-mcp-data_sources_reference/SKILL.md

Restart Claude Code, or start a new session, for it to be picked up.