{
  "$schema": "https://readbeforerun.ai/schema/entry.schema.json",
  "entry": {
    "id": "example-siem-query",
    "name": "Example SIEM Query",
    "summary": "Builds and explains SIEM queries for alert triage from a short description of the alert.",
    "draft": "demo",
    "type": "skill",
    "mission": [
      "defensive"
    ],
    "task": [
      "alert-triage",
      "detection-engineering"
    ],
    "domain": [
      "security-operations"
    ],
    "runtime": [
      "claude-code",
      "codex"
    ],
    "tier": "listed",
    "last_checked": "2026-10-12",
    "next_check": "2027-01-10",
    "freshness": "fresh",
    "superseded": false,
    "in_my_kit": null,
    "advice": null,
    "code_shows": "Secrets: unknown",
    "source": {
      "repo": "https://github.com/example/security-skills",
      "subpath": "skills/siem-query",
      "commit": "9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c",
      "version": "v1.2.0",
      "license": "Apache-2.0"
    },
    "install": {
      "skills_cli": "npx skills add example/security-skills --skill siem-query",
      "claude_code": "claude plugin install example-siem-query@field-guide",
      "upstream": null,
      "bundled": true
    },
    "scan": {
      "status": "static scan pending (not run)"
    },
    "reach": {
      "method": "reach-v0.1",
      "level": 1,
      "level_source": "static",
      "level_label": "scoped",
      "unknown_axes": 1,
      "verdict": "not-run",
      "badge": "reach ≥1 · not run yet",
      "long": "reach ≥1 from code (scoped, 1 right unknown); lab: not run yet",
      "declared": {
        "fs": 0,
        "hitl": 1
      },
      "static": {
        "level": 1,
        "fs": 0,
        "net": 0,
        "exec": 0,
        "cred": null,
        "persist": 0,
        "hitl": 1,
        "unknown": [
          "cred"
        ]
      },
      "observed": null,
      "surplus": null,
      "fit": null,
      "exports": {
        "aivss": {
          "fs": 0,
          "net": 0,
          "exec": 0,
          "cred": null,
          "persist": 0,
          "hitl": 0.5
        },
        "usf_risk_tier": "L1"
      }
    },
    "profile": {
      "read_at": "9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c",
      "read_on": "2026-10-25",
      "overview": "An agent skill that turns a short alert description into a SIEM query and explains each clause.",
      "purpose": [
        "Writes SIEM queries from an alert description and explains them."
      ],
      "use_cases": [
        {
          "text": "Draft a hunting query for a suspicious login alert",
          "task": "alert-triage"
        },
        {
          "text": "Turn a detection idea into a first query to test",
          "task": "detection-engineering"
        }
      ],
      "maturity": null,
      "capabilities": [
        {
          "name": "write-query",
          "effects": [
            "reads"
          ],
          "enabled": "default"
        }
      ],
      "effects": [
        "reads"
      ],
      "runs": "in-client",
      "listens": [],
      "sends_to": [],
      "model": "client",
      "needs": [
        {
          "kind": "other",
          "text": "Access to your SIEM to run the query yourself; the skill holds no connection settings."
        }
      ]
    },
    "urls": {
      "page": "/catalog/example-siem-query/",
      "json": "/entries/example-siem-query.json",
      "md": "/catalog/example-siem-query.md",
      "badge": "/badge/example-siem-query.svg"
    }
  },
  "data": {
    "schema_version": "0.5",
    "slug": "example-siem-query",
    "name": "Example SIEM Query",
    "summary": "Builds and explains SIEM queries for alert triage from a short description of the alert.",
    "draft": "demo",
    "in_my_kit": null,
    "type": "skill",
    "mission": [
      "defensive"
    ],
    "task": [
      "alert-triage",
      "detection-engineering"
    ],
    "domain": [
      "security-operations"
    ],
    "phase": [
      "def:detect",
      "def:respond"
    ],
    "role": [
      "soc"
    ],
    "runtime": [
      "claude-code",
      "codex"
    ],
    "auth": null,
    "autonomy": null,
    "addresses": [],
    "frameworks": {
      "owasp_ast": [],
      "owasp_asi": [],
      "attack_tactic": [],
      "atlas": []
    },
    "source": {
      "repo": "https://github.com/example/security-skills",
      "subpath": "skills/siem-query",
      "commit": "9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c",
      "version": "v1.2.0",
      "license": "Apache-2.0",
      "manifest": "SKILL.md",
      "also_listed": {}
    },
    "upstream": {
      "checked_at": "2026-10-17",
      "updated_at": "2026-10-02",
      "current_release": "v1.2.0",
      "archived": false,
      "stars": 1290,
      "commit_history": {
        "2026-08": 21,
        "2026-09": 17,
        "2026-10": 3
      },
      "releases_since_pin": 0
    },
    "install": {
      "skills_cli": "npx skills add example/security-skills --skill siem-query",
      "claude_code": "claude plugin install example-siem-query@field-guide",
      "bundled": true
    },
    "scan": [
      {
        "tool": "cisco-skill-scanner",
        "version": "not-run",
        "llm_judge": false,
        "date": "2026-10-12",
        "result": "pending"
      }
    ],
    "privileges": {
      "method": "reach-v0.1",
      "declared": {
        "axes": {
          "fs": 0,
          "hitl": 1
        },
        "evidence": {
          "fs": "README.md#L18 states that the skill only reads the files you pass to it",
          "hitl": "SKILL.md#L5 allowed-tools: Read, Grep (narrow pre-approvals)"
        }
      },
      "static": {
        "level": 1,
        "axes": {
          "fs": 0,
          "net": 0,
          "exec": 0,
          "cred": null,
          "persist": 0,
          "hitl": 1
        },
        "evidence": {
          "fs": "none found: patterns fs-v0.1 in 5 files at 9b8c7d6",
          "net": "none found: patterns net-v0.1 in 5 files at 9b8c7d6",
          "exec": "none found: patterns exec-v0.1 in 5 files at 9b8c7d6",
          "cred": "no evidence: query templates refer to SIEM connection settings that live outside the repository",
          "persist": "none found: patterns persist-v0.1 in 5 files at 9b8c7d6",
          "hitl": "SKILL.md#L5 allowed-tools: Read, Grep"
        },
        "unknown": [
          "cred"
        ]
      },
      "min_config": {
        "status": "derived",
        "claude_code": "permissions.allow: [Read, Grep]; no network, no shell",
        "codex": "sandbox_mode=read-only; network_access=false"
      },
      "override": null,
      "reviews": []
    },
    "status": {
      "tier": "listed",
      "last_checked": "2026-10-12",
      "next_check": "2027-01-10",
      "freshness": "fresh",
      "superseded": false,
      "superseded_by": null,
      "added": "2026-10-01",
      "added_by": "scout"
    },
    "evidence": {
      "runs": [],
      "badge": "/badge/example-siem-query.svg"
    },
    "changes": []
  },
  "profile": {
    "schema_version": "0.1",
    "entry": "example-siem-query",
    "draft": "demo",
    "commit": "9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c",
    "read_on": "2026-10-25",
    "check": {
      "date": "2026-10-25",
      "facts": 9,
      "confirmed": 9,
      "verified": 9
    },
    "overview": {
      "text": "An agent skill that turns a short alert description into a SIEM query and explains each clause.",
      "ev": "README.md#L3 the author's description"
    },
    "purpose": [
      {
        "text": "Writes SIEM queries from an alert description and explains them.",
        "ev": "README.md#L5 purpose"
      }
    ],
    "use_cases": [
      {
        "text": "Draft a hunting query for a suspicious login alert",
        "task": "alert-triage",
        "ev": "README.md#L18 example"
      },
      {
        "text": "Turn a detection idea into a first query to test",
        "task": "detection-engineering",
        "ev": "README.md#L24 example"
      }
    ],
    "not_for": [],
    "capabilities": {
      "coverage": "complete",
      "groups": [
        {
          "name": "write-query",
          "does": "Writes a query in the dialect you name and explains each clause; it does not run it.",
          "effects": [
            "reads"
          ],
          "enabled": "default",
          "ev": "SKILL.md#L9 the skill writes, the user runs"
        }
      ]
    },
    "architecture": {
      "summary": {
        "text": "Instructions in SKILL.md that your AI client follows; the query goes back to you as text.",
        "ev": "SKILL.md#L1-6 frontmatter and overview"
      },
      "runs": {
        "where": "in-client",
        "text": "Your AI client loads SKILL.md when you ask for a query.",
        "ev": "SKILL.md#L1-4 skill frontmatter"
      },
      "modes": [],
      "parts": [
        {
          "name": "SKILL.md",
          "zone": "client",
          "does": "The instructions and query patterns your AI client follows.",
          "ev": "SKILL.md#L8 the instructions"
        }
      ],
      "listens": [],
      "connections": [],
      "model": {
        "who": "client",
        "derived": "skill"
      }
    },
    "needs": [
      {
        "kind": "other",
        "text": "Access to your SIEM to run the query yourself; the skill holds no connection settings.",
        "ev": "SKILL.md#L12 connection stays with the user"
      }
    ],
    "installer": [],
    "limits": [],
    "not_found": []
  },
  "verdict": null,
  "runs": []
}