alert-correlation
From the author
Find related Wazuh activity around a case by time window and entity pivots, detect kill-chain progression and campaigns across hosts; use after triage when a case needs its surrounding context.
Install
npx skills add gensecaihq/Wazuh-Autopilot --skill alert-correlation -a claude-code
Installs to .claude/skills/alert-correlation/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 80
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- wazuh-windows-sysmongensecaihq/Wazuh-AutopilotInterpret Wazuh Windows EventChannel and Sysmon alerts — logon, privilege, account and service events, Sysmon detection groups, field paths and logon types — mapping Windows Event IDs to Wazuh rules; use for any Windows or Sysmon alert and for Windows-focused hunts.Other★ 60
- entity-extractiongensecaihq/Wazuh-AutopilotExtract and normalize IPs, hosts, users, processes, files, hashes and domains from Wazuh alert JSON with attacker/victim/observed roles; use when opening or enriching a case from alerts.Other★ 60
- security-alert-triageelastic/agent-skillsTriage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge. Use when triaging alerts, performing SOC analysis, or investigating detections.OfficialSecurity★ 600
- threat-huntinggensecaihq/Wazuh-AutopilotRun hypothesis-driven threat hunts over Wazuh data using the PEAK framework (hypothesis, baseline, model-assisted), record outcomes, and hand confirmed patterns to detection engineering; use for scheduled hunts or when asked to look for undetected activity.Other★ 60
- wazuh-active-responsegensecaihq/Wazuh-AutopilotHow Wazuh active response actually works — commands, agent-side scripts, dispatch vs execution, permanence, blast radius, pre-checks and verification caveats — for planning and verifying containment; use before proposing or verifying any response action.Planning★ 60
- wazuh-platform-healthgensecaihq/Wazuh-AutopilotKeep the Wazuh platform trustworthy — agent connectivity and version drift, manager and cluster health, event queue flooding and dropped events, silent log sources, FIM capacity and rule/decoder errors — and raise detection blind spots as cases; use for the scheduled platform health check or whenever data looks missing.Other★ 60
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in