Security Alert Triage

If you're running Elastic Security, this handles the tedious part of alert triage: it fetches the next open alert, runs targeted ES|QL queries to gather context (process trees, network activity, related alerts), creates or updates a case with your findings, and acknowledges the alert along with related ones in the same time window. The workflow is opinionated in a good way. It forces you to gather full context before classifying anything, explicitly calls out that most alerts are false positives, and won't let you mark something malicious without real evidence like persistence mechanisms or lateral movement. Built for SOC analysts who want Claude to automate the mechanical parts while keeping the judgment calls human.

GitHub stars: 503
last updated: Jun 1, 2026

View on GitHub

Install

$ npx -y skills add elastic/agent-skills --skill security-alert-triage --agent claude-code

Installs into .claude/skills of the current project.

Files

Alert Triage

Prioritize the Elastic Security alert queue by weighted risk and return ranked entity groups — a starting point before investigation begins, not an investigation itself.

Environment Configuration

This skill executes Elasticsearch operations through the elastic CLI. If the elastic CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., GET /, GET /_cat/indices, GET /{index}/_mapping, GET /{index}/_settings/index.mode, POST /_query). The Operations table at the end of this document maps each shorthand to the equivalent elastic CLI command — always use the CLI rather than calling the HTTP API directly.