skills

Plugin skills from marketplace tenzir in tenzir/agent-plugins. Commands read from the repo's manifest — 1 month ago.

Skills (9)

• tenzir-asim

  Answer questions about Microsoft Sentinel ASIM (Advanced Security Information Model). Use whenever the user asks about ASIM schemas, normalized Microsoft Sentinel fields, field classes, aliases, schema mapping, or mapping events and entities into ASIM.

• tenzir-cef

  Answer questions and produce mappings for ArcSight CEF (Common Event Format), the OpenText/Micro Focus SIEM interchange format, and the ArcSight ESM event schema behind it: CEF headers, severity, escaping rules, the predefined extension dictionary, custom and flex fields (cs1-cs6, cn1-cn3, cfp1-cfp4

• tenzir-cim

  Answer questions and produce mappings for the Splunk Common Information Model (CIM), including CIM Add-on aliases such as SA-CIM, CommonInformationModel, and SA-CommonInformationModel. Use when the user mentions CIM data models/datamodels/DMs, datasets/data model objects, fields, field aliases, calc

• tenzir-ecs

  Answer questions and produce mappings for Elastic Common Schema (ECS): Elastic/Elasticsearch fields, fieldsets, data types, allowed values, categorization (`event.kind`, `event.category`, `event.type`, `event.outcome`), custom fields, field reuse, normalization, and OpenTelemetry/OTel/OTLP/SemConv a

• tenzir-edm

  Answer questions about the FortiSIEM Event Data Model (EDM), Fortinet's normalized event attribute model. Use when the user asks about the FortiSIEM EDM, FortiSIEM event attributes, attribute types or display names, FortiSIEM data models or event categories, FortiSIEM parser attribute mapping, or ma

• tenzir-leef

  Answer questions and produce mappings for IBM LEEF (Log Event Extended Format), the QRadar event format: LEEF 1.0/2.0 headers, delimiters, predefined event attributes, custom event keys, devTime/devTimeFormat timestamps, and syslog transport. Use when generating, parsing, validating, or mapping logs

• tenzir-ocsf

  Answer questions about OCSF (Open Cybersecurity Schema Framework). Use when the user asks about OCSF classes, objects, attributes, profiles, extensions, or event normalization.

• tenzir-udm

  Answer questions about Google SecOps / Chronicle UDM (Unified Data Model) message/record schemas, event and entity modeling, field paths, enums, normalization guidance, and ingestion payloads. Use when the user maps logs to UDM, asks about UDM field names or field-name forms, chooses event_type or e

• tenzir

  Answer questions using the Tenzir documentation. Use whenever the user asks about TQL syntax, pipeline operators, functions, data parsing or transformation, normalization, OCSF mapping, enrichment, lookup tables, contexts, packages, nodes, platform setup, deployment, configuration, integrations with

Similar plugins