Data Source Onboarding Advisor

Orchestrate the advisory portion of onboarding one new data source. Preserve supplied facts, expose decision-changing unknowns, compare only supported and applicable collection methods, define acceptance, and hand implementation to the exact owner. Never configure, deploy, troubleshoot, design an ingestion architecture, implement fields or CIM, mutate a system, remediate an incident, or claim live completion.

When to Use

Use this skill when the primary outcome is new-source requirements discovery, collection-method selection, metadata and event-contract definition, onboarding readiness, source-to-index acceptance, ownership, or implementation orchestration. Keep the source contract and acceptance obligations here when part of a mixed request crosses another boundary; route only the separable adjacent job.

Use these exact routes:

• HEC Setup and Troubleshooting (hec-setup-and-troubleshooting) for HEC enablement, tokens, endpoint/path, event or raw payload mechanics, TLS, channels, indexer acknowledgment, protocol testing, and HEC-specific troubleshooting.
• Forwarder and Data Ingest Doctor (forwarder-and-data-ingest-doctor) for Universal or Heavy Forwarder, input, output, transport, parsing, routing, queue, missing/delayed/duplicate events, wrong metadata, and active ingest-fault diagnosis.
• Deployment Server and Forwarder Fleet Management (deployment-server-and-forwarder-fleet-management) for deployment apps, server classes, deployment clients, phone-home, assignment, targeting, Agent Management, rollout, and fleet visibility.
• Ingestion Pipeline Design (ingestion-pipeline-design) for a known-source collector or processor placement, topology, ingestion-time transformation, filtering, routing, capacity, buffering, reliability, or security architecture.
• Field Extraction and CIM Mapping (field-extraction-and-cim-mapping) for search-time extraction, aliases, calculated fields, lookups, event types, tags, semantic normalization, and CIM mapping or implementation.

Do not route the whole request merely because one stage uses HEC, a forwarder, a fleet, an architecture choice, or semantic fields. Do not reproduce sibling setup, configuration, diagnostic, rollout, architecture, or implementation guidance in the handoff.