Security Detection Rule Management

If you're managing Elastic Security detection rules and dealing with noisy alerts, this handles the entire tuning workflow through Kibana's Detection Engine API. You can identify the noisiest rules, investigate false positive patterns by querying the alerts index, then tune them by adding exceptions, tightening queries, or adjusting thresholds. It includes dedicated tooling for both SIEM and endpoint behavior rules, with the workflow pushing you to investigate alert patterns before making changes. The skill comes with clear multi-step workflows for common scenarios like tuning a specific noisy rule or adding exceptions scoped to endpoint behaviors. Requires your Elasticsearch and Kibana credentials, Node.js 22+, and follows a strict execution model that skips the usual file browsing in favor of immediate action.

GitHub stars: 503
last updated: Jun 1, 2026

View on GitHub

Install

$ npx -y skills add elastic/agent-skills --skill security-detection-rule-management --agent claude-code

Installs into .claude/skills of the current project.

Files

Detection Rule Management

Create new detection rules for emerging threats and coverage gaps, and tune existing rules to reduce false positives. All operations use the Kibana Detection Engine API via rule-manager.js.

Execution rules

Start executing tools immediately — do not read SKILL.md, browse the workspace, or list files first.
Report tool output faithfully. Copy rule IDs, names, alert counts, exception IDs, and error messages exactly as returned by the API. Do not abbreviate rule UUIDs, invent rule names, or round alert counts.
When a tool returns an error (rule not found, API failure), report the exact error — do not guess at alternatives.

Prerequisites

Install dependencies before first use from the skills/security directory:

cd skills/security && npm install

Set the required environment variables (or add them to a .env file in the workspace root):

export ELASTICSEARCH_URL="https://your-cluster.es.cloud.example.com:443"
export ELASTICSEARCH_API_KEY="your-api-key"
export KIBANA_URL="https://your-cluster.kb.cloud.example.com:443"
export KIBANA_API_KEY="your-kibana-api-key"