Anthropic-Cybersecurity-Skills/skills/performing-log-source-onboarding-in-siem/assets/template.md

Log Source Onboarding Request Template

Source Information

Field	Value
Source Name
System Type
Log Format	syslog / CEF / JSON / XML / CSV / Windows Events
Estimated EPS
Estimated Daily Volume (GB)
Security Tier	Critical / High / Medium / Low
Collection Method	Syslog / Agent / API / File / Cloud
Network Location
Owner/Contact

Onboarding Checklist

• Discovery and assessment complete
• Planning approved
• Network connectivity confirmed
• Collection agent/method configured
• Parser/field extraction built
• CIM fields mapped
• Data quality validated
• Detection rules enabled
• Dashboards updated
• Documentation complete
• SOC team notified
• Production released

CIM Field Mapping

Raw Field	CIM Field	Data Model

Validation Results

Check	Result	Notes
Events arriving	Pass/Fail
Field extraction	Pass/Fail
CIM compliance	Pass/Fail
Timestamp parsing	Pass/Fail
Volume within budget	Pass/Fail