More screenshots
Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentswindows event log security analyzer
Analyze exported Windows Security/System/PowerShell XML or CSV for sprays, break-ins, new services and ATT&CK-mapped findings. Not .evtx.
$20
windows event log security analyzer
Example session with this skill installed
I exported Security and System logs from DC01 after a weird weekend. Was there a spray? Did anyone get in? Anything persistence-y?
- Read your context and instructions
- Compiled the windows event log
Answer: yes — 2 CRITICAL, 6 HIGH.
- CRITICAL: Successful RDP logon by Administrator from 203.0.113.77 after 15 failures (T1078)
- CRITICAL: Security audit log cleared by Administrator (T1070.001)
- HIGH: Password spray from 203.0.113.50 — 10 users / 30 min (T1110.003)
- HIGH: Password guessing against Administrator (T1110.001)
- HIGH: Account
backupsvccreated and added to Administrators (T1136.001 / T1098) - HIGH: Service
WinUpdateHelper→C:\Users\Public\update.bat(T1543.003) - HIGH: PowerShell
IEX (New-Object Net.WebClient).DownloadString(...)(T1059.001)
Deliverables: summary, hunt.md, timeline CSV, JSON. Input: 34 events, span 20 minutes.
(Real run on bundled synthetic XML; IPs are RFC 5737 documentation addresses.)
Connects securely to your tools. The creator never sees your data.
About this skill
Hunt Windows logs you already exported — without a SIEM.
Reads wevtutil / Get-WinEvent XML or CSV (native .evtx is refused with a clear error). Detects password sprays (4625), interesting 4624 logon types, success-after-failures, account/group changes (4720/4732/…), audit log clears (1102), new services (7045/4697), suspicious PowerShell 4104, scheduled tasks (4698) and explicit credentials (4648). Every finding carries a MITRE ATT&CK ID.
What's included
SKILL.md (export commands + safety rules), scripts/winlog.py, synthetic incident XML, references.
How to use
Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scanned
Verified clean 5 days ago
- Passed all security checks, Safe to install