# Example SIEM Query

> Demo data · fictional, for layout only.

> Builds and explains SIEM queries for alert triage from a short description of the alert.

- Badge: `reach ≥1 · not run yet`
- Type: Skill; tier: not run yet
- Tasks: Alert triage, Detection engineering; mission: Defensive; works with: Claude Code, Codex
- Source: https://github.com/example/security-skills (skills/siem-query), pinned to `9b8c7d6` (v1.2.0), licence Apache-2.0
- Last checked: 2026-10-12; next check: 2027-01-10; method v0.1, reach-v0.1

## At a glance

- **What it is:** An agent skill that turns a short alert description into a SIEM query and explains each clause. A skill is a set of instructions, and sometimes scripts, that your AI client loads when a task needs it.
- **Made for:** Writes SIEM queries from an alert description and explains them.
- **Runs:** Inside your AI client: its model follows the instructions and works with the client's own tools.
- **Sends data to:** No outside connection found in the files read. Other connections not ruled out: read in the documentation and the cited code, not searched in full.
- **Can change things:** No changing, deleting or command-running capability among the groups read.
- **Needs:** Access to your SIEM to run the query yourself; the skill holds no connection settings

Profile read at commit `9b8c7d6` on 2026-10-25; every fact cites a file and line at that commit.

## What it does

An agent skill that turns a short alert description into a SIEM query and explains each clause. (README.md#L3)

Made for (the author says):

- Writes SIEM queries from an alert description and explains them. (README.md#L5)

Documented uses:

- Draft a hunting query for a suspicious login alert [Alert triage] (README.md#L18)
- Turn a detection idea into a first query to test [Detection engineering] (README.md#L24)

## What it can do

| Group | What it covers | Effect | On by default |
|---|---|---|---|
| write-query | Writes a query in the dialect you name and explains each clause; it does not run it. (SKILL.md#L9) | reads | yes |

## How it runs

Instructions in SKILL.md that your AI client follows; the query goes back to you as text. (SKILL.md#L1-6)

- Starts: Inside your AI client: its model follows the instructions and works with the client's own tools. Your AI client loads SKILL.md when you ask for a query. (SKILL.md#L1-4)
- Your AI client: **SKILL.md**: The instructions and query patterns your AI client follows. (SKILL.md#L8)

## What you need

- Other: Access to your SIEM to run the query yourself; the skill holds no connection settings. (SKILL.md#L12)

## Rights in plain language

- Declared: files 0 (reads only files you give it), approval 1 (has narrow pre-approvals).
- Code: reach ≥1 (scoped): nothing above level 1; unknown: secrets.
- Lab: not run yet.

Why three columns? Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

## Privilege Reach

Reach level 1 (scoped), one right unknown.

| Right | Declared | Code | Lab |
|---|---|---|---|
| Files: where does it read and write? | 0 reads only files you give it | 0 reads only files you give it | not run yet |
| Network: whom does it talk to? | not declared | 0 uses no network | not run yet |
| Execution: what does it run? | not declared | 0 runs no programs | not run yet |
| Secrets: which credentials does it touch? | not declared | ? unknown | not run yet |
| Persistence: what survives the run? | not declared | 0 leaves results only | not run yet |
| Approval: does it ask before acting? | 1 has narrow pre-approvals | 1 has narrow pre-approvals | not run yet |

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe

## Install

### Claude Code

```
claude plugin marketplace add https://readbeforerun.ai/marketplace.json
claude plugin install example-siem-query@field-guide
```

- pinned to 9b8c7d6
- demo, not installable

### skills CLI

```
npx skills add example/security-skills --skill siem-query
```

- not pinned: installs the current upstream state, not 9b8c7d6
- demo, not installable

### Run it with least privilege

- claude code: `permissions.allow: [Read, Grep]; no network, no shell`
- codex: `sandbox_mode=read-only; network_access=false`

- derived, not tested: proposed from the code analysis

## Maintainer's notes

**Demo entry.** Fictional maintainer remark: in the demo, this is the skill I would hand to a new SOC analyst first.

## Lab runs

Not run yet.

## Questions and answers

**Why compare declared, code and lab?**

Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

**What rights does Example SIEM Query declare?**

files 0 (reads only files you give it), approval 1 (has narrow pre-approvals).

**What does its code suggest?**

reach ≥1 (scoped): nothing above level 1; unknown: secrets.

**What did it use when it ran in the lab?**

not run yet.

**Was it tried, and when?**

Not yet (tier listed).

**What changed since the last check?**

Upstream last pushed 2026-10-02; 0 release(s) since the pinned version.

**How do I run it with least privilege?**

Derived, not tested: claude_code: permissions.allow: [Read, Grep]; no network, no shell; codex: sandbox_mode=read-only; network_access=false

Method: https://readbeforerun.ai/method/