This skill should be used when the user asks to "create a script", "write an XSIAM script", "build a script", "write an automation", "XSOAR script", "demisto script", "generate script YAML", or needs to develop a standalone Python script with its YAML metadata file for Cortex XSIAM or XSOAR. For connecting to external APIs with multiple commands, use the xsiam-integrations skill instead. For multi-step incident response or automation workflows that orchestrate tasks across integrations, use the xsiam-playbooks skill instead.
This skill should be used when the user asks to "create a playbook", "build a playbook", "design a playbook", "XSIAM playbook", "XSOAR playbook", "incident response workflow", "automation workflow", "playbook YAML", or needs to generate playbook definitions for Cortex XSIAM or XSOAR.
This skill should be used when the user asks to "write an XQL query", "create an XQL query", "threat hunting query", "XQL", "query dataset", "search XSIAM data", "hunt for", "investigate in XSIAM", or needs to build standalone XQL queries for threat hunting, investigation, analytics, or data enrichment.
This skill should be used when the user asks to "create a correlation rule", "build a detection rule", "write a detection", "XSIAM alert rule", "correlation JSON", "detection engineering", "build a detection for", or needs to generate correlation rule JSON files with embedded XQL detection logic.
This skill should be used when the user asks to "create an event collector", "build an event collector", "write an event collector", "ingest events into XSIAM", "fetch events", "send_events_to_xsiam", "isfetchevents", "XSIAM event ingestion", or needs to build a specialized integration that ingests vendor events into the XSIAM data lake. For standard API integrations that create incidents, use the xsiam-integrations skill instead. For standalone data-processing scripts, use xsiam-scripts.
This skill should be used when the user asks to "build an integration", "create an integration", "write an XSIAM integration", "XSOAR integration", "demisto integration", "generate integration YAML", "connect to an API", "write an integration for", or needs to develop a Python integration with authentication, multiple commands, and a corresponding YAML metadata file for Cortex XSIAM or XSOAR. For standalone data-processing scripts, use the xsiam-scripts skill instead.
This skill should be used when the user asks to "translate SPL", "convert Splunk to XQL", "Splunk to XQL", "SPL to XQL", "migrate Splunk query", "translate this Splunk query", or needs to convert existing Splunk SPL queries into equivalent XQL.
This skill should be used when the user asks to "create a widget", "build a widget", "dashboard widget", "XSIAM widget", "visualize", "chart", "graph", "view graph", "pie chart", "line chart", "column chart", "show me a chart of", "build a dashboard visualization", or needs to generate XQL widget queries with `| view graph` visualization for Cortex XSIAM dashboards.