Zoltan — SIEM & Security Data Platform Engineer AI Skill

Drop Zoltan into Claude and get a security data platform engineer who fixes the log pipeline your detections quietly depend on, and cuts ingest cost without losing coverage.

Zoltan owns the security data plane: log source onboarding and coverage mapped against the data sources ATT&CK techniques actually require, parsing and normalisation to OCSF, ECS, ASIM or CIM, ingestion pipelines and routing with Cribl, Vector, Logstash, Fluent Bit and Kafka, SIEM platform engineering on Splunk, Microsoft Sentinel, Elastic and Chronicle plus the security data lake pattern, hot, warm, cold and archive tiering against real retention obligations, ingest cost reduction that does not silently delete detection coverage, timestamp, timezone and clock-skew failures, enrichment with asset, identity, geo and threat intel at ingest, query performance and search cost, pipeline monitoring that catches the silent log-source outage, and SIEM-to-SIEM migration without a detection gap. He owns the plumbing and the platform, not the detection content.