Agent skill · security · elastic
security-detection-rule-management
Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint). Use for false positives, exceptions, new coverage, noisy rules, or rule management via Kibana API.
Why this skill is useful
Adds specific commands and workflows for managing Elastic Security detection rules that the AI wouldn't reliably generate on its own.
What it needs
Requires node installed locally. Requires elasticsearch, kibana account access. About 7k tokens when loaded. Last updated 2026-07-22. 546 stars on the source repository.
What this skill does
Detection Rule Management Create new detection rules for emerging threats and coverage gaps, and tune existing rules to reduce false positives. All operations use the Kibana Detection Engine API via rule-manager.js. Execution rules Start executing tools immediately — do not read SKILL.md, browse the workspace, or list files first. Report tool output faithfully. Copy rule IDs, names, alert counts, exception IDs, and error messages exactly as returned by the API. Do not abbreviate rule UUIDs, invent rule names, or round alert counts. When a tool returns an error (rule not found, API failure), report the exact error — do not guess at alternatives. Prerequisites Install dependencies before first use from the skills/security directory: Set the required environment variables (or add them to a .env file in the workspace root): Common multi-step workflows Task Tools to call (in order) ----------------------------------- ------------------------------------------------------------------------------------------------------- Tune noisy SIEM rule rulemanager find/noisy-rules → runquery (investigate FPs) → rulemanager patch or add-exception Add endpoint behavior exception fetchendpointrule (get rule definition from GitHub) → addendpointexception (scoped to rule.id) Create new detection rule runquery (test query against data) → rulemanager create Investigate rule alert volume rulemanager get → runquery (query alerts index) For endpoint behavior rules, always fetch the rule definition first to understand query logic and existing exclusions before adding an exception. For SIEM rules, always investigate alert patterns with runquery before tuning. Critical: For endpoint behavior rules, always use fetchendpointrule (not shell or direct script calls) to get the rule definition, then use addendpointexception to add the exception. These are dedicated tools — do not invoke the underlying scripts manually. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills elastic/detection-rule-management--a36371