Agent skill · security · elastic
security-alert-triage
Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge. Use when triaging alerts, performing SOC analysis, or investigating detections.
Why this skill is useful
Adds multiple executable scripts for alert triage and case management that automate workflows not covered in public documentation.
What it needs
Requires node installed locally. Requires elasticsearch account access. About 7k tokens when loaded. Last updated 2026-07-22. 546 stars on the source repository.
What this skill does
Alert Triage Analyze Elastic Security alerts one at a time: gather context, classify, create a case, and acknowledge. This skill depends on the case-management skill for case creation. Prerequisites Install dependencies before first use from the skills/security directory: Set the required environment variables (or add them to a .env file in the workspace root): Quick start All commands from workspace root. Always fetch → investigate → document → acknowledge. Call the tools directly — do not read the skill file or explore the workspace first. Common multi-step workflows Task Tools to call (in order) ------------------------------------ ----------------------------------------------------------------------------------------------- End-to-end triage fetchnextalert → runquery (context) → casemanager create (case) → acknowledgealert Gather context runquery (process tree, network, related alerts) Create case after classification casemanager create → casemanager attach-alert Acknowledge after triage acknowledgealert (related mode for batch) Always complete the full workflow: fetch → investigate → document → acknowledge. Do not stop after gathering context — create or update a case with findings before acknowledging. Critical execution rules: Start executing tools immediately — do not read SKILL.md, browse the workspace, or list files first. For ES QL queries, write the query to a temporary .esql file then pass it via --query-file. Do not use editfile — use a single shell call with echo "..." > query.esql && node ... --query-file query.esql. Keep context gathering focused: run 2-4 targeted queries (process tree, network, related alerts), not 10+. Report only what tools return. Copy identifiers verbatim — do not paraphrase IDs, timestamps, or hostnames. Critical principles Do NOT classify prematurely. Gather ALL context before deciding benign/unknown/malicious. Most alerts are false positives, even if they look alarming. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills elastic/alert-triage--be1ad1