sparklogs-investigate
Cited SparkLogs investigation: gather logs and device health/state into a structured system-condition summary with query URLs, confidence, and what was not checked. Use when the engineer needs a thorough ticket write-up or a full investigation report.
Pinned to revision 70c494dd1dab, so it is the text this page describes rather than whatever the author pushed since.
Files
- skills/sparklogs-investigate/SKILL.md
- skills/sparklogs-investigate/references/feeds/sparklogs.agent.log/README.md
- skills/sparklogs-investigate/references/feeds/sparklogs.agent.log/enums.md
- skills/sparklogs-investigate/references/feeds/sparklogs.agent.log/fields.md
- skills/sparklogs-investigate/references/feeds/sparklogs.agent.log/reasons.md
- skills/sparklogs-investigate/references/feeds/sparklogs.agent.state/README.md
- skills/sparklogs-investigate/references/feeds/sparklogs.agent.state/enums.md
- skills/sparklogs-investigate/references/feeds/sparklogs.agent.state/fields.md
- skills/sparklogs-investigate/references/feeds/sparklogs.agent.state/reasons.md
- skills/sparklogs-investigate/references/feeds/sparklogs.agent.vector/README.md
- skills/sparklogs-investigate/references/feeds/sparklogs.agent.vector/enums.md
- skills/sparklogs-investigate/references/feeds/sparklogs.agent.vector/fields.md
- skills/sparklogs-investigate/references/feeds/sparklogs.agent.vector/reasons.md
- skills/sparklogs-investigate/references/feeds/win.defender.eventlog/README.md
- skills/sparklogs-investigate/references/feeds/win.defender.eventlog/enums.md
- skills/sparklogs-investigate/references/feeds/win.defender.eventlog/fields.md
- skills/sparklogs-investigate/references/feeds/win.defender.eventlog/reasons.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.application/README.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.application/enums.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.application/fields.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.application/reasons.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.security/README.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.security/enums.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.security/fields.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.security/mapping-ecs.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.security/mapping-ocsf.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.security/patterns.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.security/reasons.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.security/recipes.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.setup/README.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.setup/enums.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.setup/fields.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.setup/reasons.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.system/README.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.system/enums.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.system/fields.md
- skills/sparklogs-investigate/references/feeds/win.eventlog.system/reasons.md
- skills/sparklogs-investigate/references/feeds/win.servicing.cbs/README.md
- skills/sparklogs-investigate/references/feeds/win.servicing.cbs/enums.md
- skills/sparklogs-investigate/references/feeds/win.servicing.cbs/fields.md
- skills/sparklogs-investigate/references/feeds/win.servicing.cbs/reasons.md
- skills/sparklogs-investigate/references/feeds/win.servicing.dism/README.md
- skills/sparklogs-investigate/references/feeds/win.servicing.dism/enums.md
- skills/sparklogs-investigate/references/feeds/win.servicing.dism/fields.md
- skills/sparklogs-investigate/references/feeds/win.servicing.dism/reasons.md
- skills/sparklogs-investigate/references/guides/category-classes.md
- skills/sparklogs-investigate/references/guides/common-mistakes.md
- skills/sparklogs-investigate/references/guides/device-state-fields.md
- skills/sparklogs-investigate/references/guides/generated-reference-router.md
- skills/sparklogs-investigate/references/guides/lql-reference.md
- skills/sparklogs-investigate/references/guides/mcp-tool-decision-tree.md
- skills/sparklogs-investigate/references/guides/msp-tool-registry.md
- skills/sparklogs-investigate/references/guides/off-endpoint-causes.md
- skills/sparklogs-investigate/references/guides/pattern-catalog.md
- skills/sparklogs-investigate/references/guides/scope-ladder.md
- skills/sparklogs-investigate/references/guides/scope-resolution.md
- skills/sparklogs-investigate/references/guides/service-taxonomy.md
- skills/sparklogs-investigate/references/guides/subagent-definitions.md
- skills/sparklogs-investigate/references/guides/writing-voice.md
- skills/sparklogs-investigate/references/output-template.md
- skills/sparklogs-investigate/references/playbooks/backup-failure.md
- skills/sparklogs-investigate/references/playbooks/bitlocker-recovery.md
- skills/sparklogs-investigate/references/playbooks/certificate-expiry.md
- skills/sparklogs-investigate/references/playbooks/directory-replication-failure.md
- skills/sparklogs-investigate/references/playbooks/disk-full-or-filling.md
- skills/sparklogs-investigate/references/playbooks/memory-or-handle-leak.md
- skills/sparklogs-investigate/references/playbooks/playbooks.md
- skills/sparklogs-investigate/references/playbooks/raid-or-storage-degraded.md
- skills/sparklogs-investigate/references/playbooks/rmm-connectivity.md
- skills/sparklogs-investigate/references/playbooks/slow-logon.md
- skills/sparklogs-investigate/references/playbooks/windows-update-failure.md
- skills/sparklogs-investigate/references/themes/device-health-and-state.md
- skills/sparklogs-investigate/references/themes/endpoint-protection.md
- skills/sparklogs-investigate/references/themes/windows-operational-events.md
- skills/sparklogs-investigate/references/themes/windows-security-and-audit.md
- skills/sparklogs-investigate/references/themes/windows-updates-and-patching.md
Every link opens the file at its source, pinned to the revision this page describes.