Security Alert Triage

If you're running Elastic Security and drowning in alerts, this handles the tedious part of triage. It analyzes alerts one by one, gathers context, classifies them, and can create cases or acknowledge them directly in your Elastic environment. Built by the Elastic team, so it knows the data structures and API quirks. The setup requires some environment variables and a dependency on their case-management skill, which is typical for the agent-skills repo approach. It's basically workflow automation for the repetitive investigation steps you'd otherwise do manually in Kibana. Saves time if you're already in the Elastic ecosystem and tired of clicking through the same alert patterns.

skills.sh installs: 4.2K
GitHub stars: 604
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add elastic/agent-skills --skill security-alert-triage --agent claude-code

Installs into .claude/skills of the current project.

Files

Alert Triage

Prioritize the Elastic Security alert queue by weighted risk and return ranked entity groups — a starting point before investigation begins, not an investigation itself.

Environment Configuration

This skill executes Elasticsearch operations through the elastic CLI. If the elastic CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., GET /, GET /_cat/indices, GET /{index}/_mapping, GET /{index}/_settings/index.mode, POST /_query). The Operations table at the end of this document maps each shorthand to the equivalent elastic CLI command — always use the CLI rather than calling the HTTP API directly.