elastic-security

Plugin elastic-security from marketplace elastic-agent-skills in elastic/agent-skills. Commands read from the repo's manifest — 12 days ago.

Skills (6)

• security-alert-analysis

  Investigate a specific Elastic Security detection alert: gather context, assess entity risk, classify the threat, document findings, and optionally acknowledge. Use when triaging a single known alert, performing SOC investigation, or following up after the security-alert-triage skill identifies a gr

• security-alert-triage

  Prioritize and rank the Elastic Security alert queue by weighted risk — base risk score, MITRE tactic boost, entity risk, and asset criticality — then cluster alerts into entity groups. Use when an analyst asks what to focus on, which alerts are most urgent, or wants a ranked starting point across t

• security-case-management

  Create, search, update, and manage SOC cases via the Kibana Cases API. Use when tracking incidents, linking alerts to cases, adding investigation notes, or managing triage output. Requires Node.js 22+, network access to Kibana. Environment variables: KIBANA_URL, plus KIBANA_API_KEY or KIBANA_USERNAM

• security-detection-rule-management

  Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint). Use for false positives, exceptions, new coverage, noisy rules, or rule management via Kibana API. Requires Node.js 22+, network access to Kibana and Elasticsearch. Environment variables: KIBANA_URL plus KIBANA_API_KEY or

• security-generate-security-sample-data

  Generate sample security events, attack scenarios, and synthetic alerts for Elastic Security. Use when demoing, populating dashboards, testing detection rules, or setting up a POC. Requires Node.js 22+, network access to Kibana and Elasticsearch. Environment variables: KIBANA_URL plus KIBANA_API_KEY

• security-ml-integrations

  Install and manage Elastic security ML integration packages (beaconing, ded, dga, lmd, pad, problemchild). Handles the full lifecycle: pre-flight checks, Fleet package install, component templates, ingest pipelines, transforms, data views, ML anomaly detection jobs, and detection rules. Use when a u

Similar plugins