[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-attack-discovery-triage":3,"mdc--olwpph-key":39,"related-org-elastic-attack-discovery-triage":837,"related-repo-elastic-attack-discovery-triage":1009},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":22,"repoUrl":23,"updatedAt":24,"license":25,"forks":26,"topics":27,"repo":34,"sourceUrl":37,"mdContent":38},"attack-discovery-triage","triage Elastic Security attack findings","Triage Elastic Security Attack Discovery findings — fetch correlated attack narratives, assess confidence with entity risk and rule frequency signals, and present an interactive triage dashboard for approval, case creation, and acknowledgment. Use when triaging attack discoveries, reviewing correlated attacks, assessing EASE output, or when the user mentions \"attack discovery\", \"AD findings\", \"triage attacks\", \"correlated alerts\", or asks to process attack discovery results. Also trigger for \"what attacks were discovered\", \"triage my discoveries\", or \"any attack discoveries\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Observability","observability",{"name":20,"slug":21,"type":15},"Triage","triage",18,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fexample-mcp-app-security","2026-07-12T07:48:29.539756",null,10,[28,29,30,8,31,32,14,33],"ai","claude","cursor","mcp","model-context-protocol","soc",{"repoUrl":23,"stars":22,"forks":26,"topics":35,"description":36},[28,29,30,8,31,32,14,33],"Reference MCP App for Elastic Security — interactive SOC dashboards inside Claude, Cursor, and other MCP hosts.","https:\u002F\u002Fgithub.com\u002Felastic\u002Fexample-mcp-app-security\u002Ftree\u002FHEAD\u002Fskills\u002Fattack-discovery-triage","---\nname: attack-discovery-triage\ndescription: >\n  Triage Elastic Security Attack Discovery findings — fetch correlated attack narratives, assess confidence\n  with entity risk and rule frequency signals, and present an interactive triage dashboard for approval,\n  case creation, and acknowledgment. Use when triaging attack discoveries, reviewing correlated attacks,\n  assessing EASE output, or when the user mentions \"attack discovery\", \"AD findings\", \"triage attacks\",\n  \"correlated alerts\", or asks to process attack discovery results. Also trigger for \"what attacks were\n  discovered\", \"triage my discoveries\", or \"any attack discoveries\".\n---\n\n# Attack Discovery Triage\n\nYou are a senior SOC analyst triaging Attack Discovery findings. These are correlated attack narratives —\ngrouped alerts that Attack Discovery has clustered into attack stories with LLM-generated summaries and\nMITRE ATT&CK mappings. You assess each finding as a unit, not individual alerts.\n\n## When to use this vs alert-triage\n\n- **This skill** (`triage-attack-discoveries`): Correlated attack narratives from Attack Discovery. Each\n  finding groups multiple alerts into a single attack story. Use when the user asks about \"attack discoveries\",\n  \"correlated attacks\", \"AD findings\", or \"EASE\".\n- **Alert triage** (`triage-alerts`): Individual security alerts. Use when the user asks about specific alerts,\n  rule firings, or wants to filter by severity\u002Fhost\u002Fprocess.\n\n## Tools\n\n| Tool | Purpose |\n|------|---------|\n| `triage-attack-discoveries` | Fetch AD findings with interactive triage dashboard. Params: `days`, `limit`, `verdicts` |\n| `manage-cases` | Create\u002Fsearch cases for documenting approved findings |\n| `threat-hunt` | Run ES\\|QL queries for deep investigation of entities |\n\n## How to call triage-attack-discoveries\n\nCall `triage-attack-discoveries` ONCE. Include `verdicts` if you can classify based on what you already know.\nThe dashboard renders confidence badges, entity risk, and triage actions.\n\n**`verdicts`**: Include when you can classify. Each verdict has:\n- `title`: attack discovery title\n- `classification`: benign \u002F suspicious \u002F malicious\n- `confidence`: low \u002F medium \u002F high\n- `summary`: 1-2 sentence reasoning\n- `action`: recommended next step\n\nExample:\n```json\n{\n  \"days\": 1,\n  \"verdicts\": [\n    {\n      \"title\": \"Credential Theft Campaign Targeting Domain Controllers\",\n      \"classification\": \"malicious\",\n      \"confidence\": \"high\",\n      \"summary\": \"Multiple LSASS access alerts correlated with lateral movement to DC — confirmed credential harvesting chain\",\n      \"action\": \"Isolate affected hosts, create P1 case, rotate domain admin credentials\"\n    }\n  ]\n}\n```\n\nDo NOT call the tool twice. One call only.\n\n## After the tool returns\n\nYou receive attack discovery findings with confidence levels, entity risk, and MITRE mappings.\nProvide your analysis in text below the dashboard:\n\n1. **Group by confidence**: Start with HIGH confidence findings, then MODERATE, then LOW\n2. **For each finding**: State the attack narrative, your assessment, and recommended action\n3. **Classify each** as benign\u002Fsuspicious\u002Fmalicious with reasoning based on:\n   - Alert diversity (how many alerts, how many rules, which severities)\n   - Rule noise profile (are these high-signal or noisy rules?)\n   - Entity risk (are the involved hosts\u002Fusers already flagged as high-risk?)\n4. **Recommend actions**: Create case (for malicious\u002Fsuspicious), acknowledge (for benign), or investigate further\n\n## Confidence assessment criteria\n\nThe dashboard automatically runs three confidence signals:\n\n### Alert Diversity\n- 1 alert from 1 rule → LOW base confidence\n- 3+ alerts from 2+ distinct rules → MODERATE\n- 5+ alerts spanning multiple MITRE tactics → HIGH\n\n### Rule Frequency\n- High total (100+ alerts\u002F7d), many hosts → noisy rule, DISCOUNT confidence\n- Low total (\u003C10 alerts\u002F7d), single host → high-signal rule, INCREASE confidence\n\n### Entity Risk\n- Critical (>90) or High (70-90) entity risk → INCREASE confidence\n- Low (\u003C20) entity risk → DECREASE confidence\n\n## Key principles\n\n- **Attacks are pre-correlated.** Each finding groups related alerts into a narrative. Assess the attack as a\n  unit — do not re-triage individual alerts within an attack.\n- **Treat AD output as a hypothesis.** Attack Discovery uses LLM-generated analysis. The narrative may use\n  strong language (\"confirmed intrusion\") that reflects LLM framing, not evidence. Base confidence on the\n  structured signals, not the narrative language.\n- **Most findings need validation.** Only HIGH confidence findings with strong entity risk signals warrant\n  immediate case creation. MODERATE findings need enrichment. LOW findings may be acknowledged.\n- **Never create cases without user approval.** The dashboard has approve\u002Freject controls — always present\n  your analysis and let the user decide.\n\nFor detailed classification criteria, see [references\u002Fconfidence-scoring.md](references\u002Fconfidence-scoring.md).\n",{"data":40,"body":41},{"name":4,"description":6},{"type":42,"children":43},"root",[44,52,58,65,107,113,212,218,237,250,308,313,617,622,628,633,695,701,706,713,731,737,750,756,769,775,818,831],{"type":45,"tag":46,"props":47,"children":48},"element","h1",{"id":4},[49],{"type":50,"value":51},"text","Attack Discovery Triage",{"type":45,"tag":53,"props":54,"children":55},"p",{},[56],{"type":50,"value":57},"You are a senior SOC analyst triaging Attack Discovery findings. These are correlated attack narratives —\ngrouped alerts that Attack Discovery has clustered into attack stories with LLM-generated summaries and\nMITRE ATT&CK mappings. You assess each finding as a unit, not individual alerts.",{"type":45,"tag":59,"props":60,"children":62},"h2",{"id":61},"when-to-use-this-vs-alert-triage",[63],{"type":50,"value":64},"When to use this vs alert-triage",{"type":45,"tag":66,"props":67,"children":68},"ul",{},[69,90],{"type":45,"tag":70,"props":71,"children":72},"li",{},[73,79,81,88],{"type":45,"tag":74,"props":75,"children":76},"strong",{},[77],{"type":50,"value":78},"This skill",{"type":50,"value":80}," (",{"type":45,"tag":82,"props":83,"children":85},"code",{"className":84},[],[86],{"type":50,"value":87},"triage-attack-discoveries",{"type":50,"value":89},"): Correlated attack narratives from Attack Discovery. Each\nfinding groups multiple alerts into a single attack story. Use when the user asks about \"attack discoveries\",\n\"correlated attacks\", \"AD findings\", or \"EASE\".",{"type":45,"tag":70,"props":91,"children":92},{},[93,98,99,105],{"type":45,"tag":74,"props":94,"children":95},{},[96],{"type":50,"value":97},"Alert triage",{"type":50,"value":80},{"type":45,"tag":82,"props":100,"children":102},{"className":101},[],[103],{"type":50,"value":104},"triage-alerts",{"type":50,"value":106},"): Individual security alerts. Use when the user asks about specific alerts,\nrule firings, or wants to filter by severity\u002Fhost\u002Fprocess.",{"type":45,"tag":59,"props":108,"children":110},{"id":109},"tools",[111],{"type":50,"value":112},"Tools",{"type":45,"tag":114,"props":115,"children":116},"table",{},[117,136],{"type":45,"tag":118,"props":119,"children":120},"thead",{},[121],{"type":45,"tag":122,"props":123,"children":124},"tr",{},[125,131],{"type":45,"tag":126,"props":127,"children":128},"th",{},[129],{"type":50,"value":130},"Tool",{"type":45,"tag":126,"props":132,"children":133},{},[134],{"type":50,"value":135},"Purpose",{"type":45,"tag":137,"props":138,"children":139},"tbody",{},[140,178,195],{"type":45,"tag":122,"props":141,"children":142},{},[143,152],{"type":45,"tag":144,"props":145,"children":146},"td",{},[147],{"type":45,"tag":82,"props":148,"children":150},{"className":149},[],[151],{"type":50,"value":87},{"type":45,"tag":144,"props":153,"children":154},{},[155,157,163,165,171,172],{"type":50,"value":156},"Fetch AD findings with interactive triage dashboard. Params: ",{"type":45,"tag":82,"props":158,"children":160},{"className":159},[],[161],{"type":50,"value":162},"days",{"type":50,"value":164},", ",{"type":45,"tag":82,"props":166,"children":168},{"className":167},[],[169],{"type":50,"value":170},"limit",{"type":50,"value":164},{"type":45,"tag":82,"props":173,"children":175},{"className":174},[],[176],{"type":50,"value":177},"verdicts",{"type":45,"tag":122,"props":179,"children":180},{},[181,190],{"type":45,"tag":144,"props":182,"children":183},{},[184],{"type":45,"tag":82,"props":185,"children":187},{"className":186},[],[188],{"type":50,"value":189},"manage-cases",{"type":45,"tag":144,"props":191,"children":192},{},[193],{"type":50,"value":194},"Create\u002Fsearch cases for documenting approved findings",{"type":45,"tag":122,"props":196,"children":197},{},[198,207],{"type":45,"tag":144,"props":199,"children":200},{},[201],{"type":45,"tag":82,"props":202,"children":204},{"className":203},[],[205],{"type":50,"value":206},"threat-hunt",{"type":45,"tag":144,"props":208,"children":209},{},[210],{"type":50,"value":211},"Run ES|QL queries for deep investigation of entities",{"type":45,"tag":59,"props":213,"children":215},{"id":214},"how-to-call-triage-attack-discoveries",[216],{"type":50,"value":217},"How to call triage-attack-discoveries",{"type":45,"tag":53,"props":219,"children":220},{},[221,223,228,230,235],{"type":50,"value":222},"Call ",{"type":45,"tag":82,"props":224,"children":226},{"className":225},[],[227],{"type":50,"value":87},{"type":50,"value":229}," ONCE. Include ",{"type":45,"tag":82,"props":231,"children":233},{"className":232},[],[234],{"type":50,"value":177},{"type":50,"value":236}," if you can classify based on what you already know.\nThe dashboard renders confidence badges, entity risk, and triage actions.",{"type":45,"tag":53,"props":238,"children":239},{},[240,248],{"type":45,"tag":74,"props":241,"children":242},{},[243],{"type":45,"tag":82,"props":244,"children":246},{"className":245},[],[247],{"type":50,"value":177},{"type":50,"value":249},": Include when you can classify. Each verdict has:",{"type":45,"tag":66,"props":251,"children":252},{},[253,264,275,286,297],{"type":45,"tag":70,"props":254,"children":255},{},[256,262],{"type":45,"tag":82,"props":257,"children":259},{"className":258},[],[260],{"type":50,"value":261},"title",{"type":50,"value":263},": attack discovery title",{"type":45,"tag":70,"props":265,"children":266},{},[267,273],{"type":45,"tag":82,"props":268,"children":270},{"className":269},[],[271],{"type":50,"value":272},"classification",{"type":50,"value":274},": benign \u002F suspicious \u002F malicious",{"type":45,"tag":70,"props":276,"children":277},{},[278,284],{"type":45,"tag":82,"props":279,"children":281},{"className":280},[],[282],{"type":50,"value":283},"confidence",{"type":50,"value":285},": low \u002F medium \u002F high",{"type":45,"tag":70,"props":287,"children":288},{},[289,295],{"type":45,"tag":82,"props":290,"children":292},{"className":291},[],[293],{"type":50,"value":294},"summary",{"type":50,"value":296},": 1-2 sentence reasoning",{"type":45,"tag":70,"props":298,"children":299},{},[300,306],{"type":45,"tag":82,"props":301,"children":303},{"className":302},[],[304],{"type":50,"value":305},"action",{"type":50,"value":307},": recommended next step",{"type":45,"tag":53,"props":309,"children":310},{},[311],{"type":50,"value":312},"Example:",{"type":45,"tag":314,"props":315,"children":320},"pre",{"className":316,"code":317,"language":318,"meta":319,"style":319},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"days\": 1,\n  \"verdicts\": [\n    {\n      \"title\": \"Credential Theft Campaign Targeting Domain Controllers\",\n      \"classification\": \"malicious\",\n      \"confidence\": \"high\",\n      \"summary\": \"Multiple LSASS access alerts correlated with lateral movement to DC — confirmed credential harvesting chain\",\n      \"action\": \"Isolate affected hosts, create P1 case, rotate domain admin credentials\"\n    }\n  ]\n}\n","json","",[321],{"type":45,"tag":82,"props":322,"children":323},{"__ignoreMap":319},[324,336,371,396,405,446,483,520,557,591,599,608],{"type":45,"tag":325,"props":326,"children":329},"span",{"class":327,"line":328},"line",1,[330],{"type":45,"tag":325,"props":331,"children":333},{"style":332},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[334],{"type":50,"value":335},"{\n",{"type":45,"tag":325,"props":337,"children":339},{"class":327,"line":338},2,[340,345,350,355,360,366],{"type":45,"tag":325,"props":341,"children":342},{"style":332},[343],{"type":50,"value":344},"  \"",{"type":45,"tag":325,"props":346,"children":348},{"style":347},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[349],{"type":50,"value":162},{"type":45,"tag":325,"props":351,"children":352},{"style":332},[353],{"type":50,"value":354},"\"",{"type":45,"tag":325,"props":356,"children":357},{"style":332},[358],{"type":50,"value":359},":",{"type":45,"tag":325,"props":361,"children":363},{"style":362},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[364],{"type":50,"value":365}," 1",{"type":45,"tag":325,"props":367,"children":368},{"style":332},[369],{"type":50,"value":370},",\n",{"type":45,"tag":325,"props":372,"children":374},{"class":327,"line":373},3,[375,379,383,387,391],{"type":45,"tag":325,"props":376,"children":377},{"style":332},[378],{"type":50,"value":344},{"type":45,"tag":325,"props":380,"children":381},{"style":347},[382],{"type":50,"value":177},{"type":45,"tag":325,"props":384,"children":385},{"style":332},[386],{"type":50,"value":354},{"type":45,"tag":325,"props":388,"children":389},{"style":332},[390],{"type":50,"value":359},{"type":45,"tag":325,"props":392,"children":393},{"style":332},[394],{"type":50,"value":395}," [\n",{"type":45,"tag":325,"props":397,"children":399},{"class":327,"line":398},4,[400],{"type":45,"tag":325,"props":401,"children":402},{"style":332},[403],{"type":50,"value":404},"    {\n",{"type":45,"tag":325,"props":406,"children":408},{"class":327,"line":407},5,[409,414,419,423,427,432,438,442],{"type":45,"tag":325,"props":410,"children":411},{"style":332},[412],{"type":50,"value":413},"      \"",{"type":45,"tag":325,"props":415,"children":417},{"style":416},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[418],{"type":50,"value":261},{"type":45,"tag":325,"props":420,"children":421},{"style":332},[422],{"type":50,"value":354},{"type":45,"tag":325,"props":424,"children":425},{"style":332},[426],{"type":50,"value":359},{"type":45,"tag":325,"props":428,"children":429},{"style":332},[430],{"type":50,"value":431}," \"",{"type":45,"tag":325,"props":433,"children":435},{"style":434},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[436],{"type":50,"value":437},"Credential Theft Campaign Targeting Domain Controllers",{"type":45,"tag":325,"props":439,"children":440},{"style":332},[441],{"type":50,"value":354},{"type":45,"tag":325,"props":443,"children":444},{"style":332},[445],{"type":50,"value":370},{"type":45,"tag":325,"props":447,"children":449},{"class":327,"line":448},6,[450,454,458,462,466,470,475,479],{"type":45,"tag":325,"props":451,"children":452},{"style":332},[453],{"type":50,"value":413},{"type":45,"tag":325,"props":455,"children":456},{"style":416},[457],{"type":50,"value":272},{"type":45,"tag":325,"props":459,"children":460},{"style":332},[461],{"type":50,"value":354},{"type":45,"tag":325,"props":463,"children":464},{"style":332},[465],{"type":50,"value":359},{"type":45,"tag":325,"props":467,"children":468},{"style":332},[469],{"type":50,"value":431},{"type":45,"tag":325,"props":471,"children":472},{"style":434},[473],{"type":50,"value":474},"malicious",{"type":45,"tag":325,"props":476,"children":477},{"style":332},[478],{"type":50,"value":354},{"type":45,"tag":325,"props":480,"children":481},{"style":332},[482],{"type":50,"value":370},{"type":45,"tag":325,"props":484,"children":486},{"class":327,"line":485},7,[487,491,495,499,503,507,512,516],{"type":45,"tag":325,"props":488,"children":489},{"style":332},[490],{"type":50,"value":413},{"type":45,"tag":325,"props":492,"children":493},{"style":416},[494],{"type":50,"value":283},{"type":45,"tag":325,"props":496,"children":497},{"style":332},[498],{"type":50,"value":354},{"type":45,"tag":325,"props":500,"children":501},{"style":332},[502],{"type":50,"value":359},{"type":45,"tag":325,"props":504,"children":505},{"style":332},[506],{"type":50,"value":431},{"type":45,"tag":325,"props":508,"children":509},{"style":434},[510],{"type":50,"value":511},"high",{"type":45,"tag":325,"props":513,"children":514},{"style":332},[515],{"type":50,"value":354},{"type":45,"tag":325,"props":517,"children":518},{"style":332},[519],{"type":50,"value":370},{"type":45,"tag":325,"props":521,"children":523},{"class":327,"line":522},8,[524,528,532,536,540,544,549,553],{"type":45,"tag":325,"props":525,"children":526},{"style":332},[527],{"type":50,"value":413},{"type":45,"tag":325,"props":529,"children":530},{"style":416},[531],{"type":50,"value":294},{"type":45,"tag":325,"props":533,"children":534},{"style":332},[535],{"type":50,"value":354},{"type":45,"tag":325,"props":537,"children":538},{"style":332},[539],{"type":50,"value":359},{"type":45,"tag":325,"props":541,"children":542},{"style":332},[543],{"type":50,"value":431},{"type":45,"tag":325,"props":545,"children":546},{"style":434},[547],{"type":50,"value":548},"Multiple LSASS access alerts correlated with lateral movement to DC — confirmed credential harvesting chain",{"type":45,"tag":325,"props":550,"children":551},{"style":332},[552],{"type":50,"value":354},{"type":45,"tag":325,"props":554,"children":555},{"style":332},[556],{"type":50,"value":370},{"type":45,"tag":325,"props":558,"children":560},{"class":327,"line":559},9,[561,565,569,573,577,581,586],{"type":45,"tag":325,"props":562,"children":563},{"style":332},[564],{"type":50,"value":413},{"type":45,"tag":325,"props":566,"children":567},{"style":416},[568],{"type":50,"value":305},{"type":45,"tag":325,"props":570,"children":571},{"style":332},[572],{"type":50,"value":354},{"type":45,"tag":325,"props":574,"children":575},{"style":332},[576],{"type":50,"value":359},{"type":45,"tag":325,"props":578,"children":579},{"style":332},[580],{"type":50,"value":431},{"type":45,"tag":325,"props":582,"children":583},{"style":434},[584],{"type":50,"value":585},"Isolate affected hosts, create P1 case, rotate domain admin credentials",{"type":45,"tag":325,"props":587,"children":588},{"style":332},[589],{"type":50,"value":590},"\"\n",{"type":45,"tag":325,"props":592,"children":593},{"class":327,"line":26},[594],{"type":45,"tag":325,"props":595,"children":596},{"style":332},[597],{"type":50,"value":598},"    }\n",{"type":45,"tag":325,"props":600,"children":602},{"class":327,"line":601},11,[603],{"type":45,"tag":325,"props":604,"children":605},{"style":332},[606],{"type":50,"value":607},"  ]\n",{"type":45,"tag":325,"props":609,"children":611},{"class":327,"line":610},12,[612],{"type":45,"tag":325,"props":613,"children":614},{"style":332},[615],{"type":50,"value":616},"}\n",{"type":45,"tag":53,"props":618,"children":619},{},[620],{"type":50,"value":621},"Do NOT call the tool twice. One call only.",{"type":45,"tag":59,"props":623,"children":625},{"id":624},"after-the-tool-returns",[626],{"type":50,"value":627},"After the tool returns",{"type":45,"tag":53,"props":629,"children":630},{},[631],{"type":50,"value":632},"You receive attack discovery findings with confidence levels, entity risk, and MITRE mappings.\nProvide your analysis in text below the dashboard:",{"type":45,"tag":634,"props":635,"children":636},"ol",{},[637,647,657,685],{"type":45,"tag":70,"props":638,"children":639},{},[640,645],{"type":45,"tag":74,"props":641,"children":642},{},[643],{"type":50,"value":644},"Group by confidence",{"type":50,"value":646},": Start with HIGH confidence findings, then MODERATE, then LOW",{"type":45,"tag":70,"props":648,"children":649},{},[650,655],{"type":45,"tag":74,"props":651,"children":652},{},[653],{"type":50,"value":654},"For each finding",{"type":50,"value":656},": State the attack narrative, your assessment, and recommended action",{"type":45,"tag":70,"props":658,"children":659},{},[660,665,667],{"type":45,"tag":74,"props":661,"children":662},{},[663],{"type":50,"value":664},"Classify each",{"type":50,"value":666}," as benign\u002Fsuspicious\u002Fmalicious with reasoning based on:\n",{"type":45,"tag":66,"props":668,"children":669},{},[670,675,680],{"type":45,"tag":70,"props":671,"children":672},{},[673],{"type":50,"value":674},"Alert diversity (how many alerts, how many rules, which severities)",{"type":45,"tag":70,"props":676,"children":677},{},[678],{"type":50,"value":679},"Rule noise profile (are these high-signal or noisy rules?)",{"type":45,"tag":70,"props":681,"children":682},{},[683],{"type":50,"value":684},"Entity risk (are the involved hosts\u002Fusers already flagged as high-risk?)",{"type":45,"tag":70,"props":686,"children":687},{},[688,693],{"type":45,"tag":74,"props":689,"children":690},{},[691],{"type":50,"value":692},"Recommend actions",{"type":50,"value":694},": Create case (for malicious\u002Fsuspicious), acknowledge (for benign), or investigate further",{"type":45,"tag":59,"props":696,"children":698},{"id":697},"confidence-assessment-criteria",[699],{"type":50,"value":700},"Confidence assessment criteria",{"type":45,"tag":53,"props":702,"children":703},{},[704],{"type":50,"value":705},"The dashboard automatically runs three confidence signals:",{"type":45,"tag":707,"props":708,"children":710},"h3",{"id":709},"alert-diversity",[711],{"type":50,"value":712},"Alert Diversity",{"type":45,"tag":66,"props":714,"children":715},{},[716,721,726],{"type":45,"tag":70,"props":717,"children":718},{},[719],{"type":50,"value":720},"1 alert from 1 rule → LOW base confidence",{"type":45,"tag":70,"props":722,"children":723},{},[724],{"type":50,"value":725},"3+ alerts from 2+ distinct rules → MODERATE",{"type":45,"tag":70,"props":727,"children":728},{},[729],{"type":50,"value":730},"5+ alerts spanning multiple MITRE tactics → HIGH",{"type":45,"tag":707,"props":732,"children":734},{"id":733},"rule-frequency",[735],{"type":50,"value":736},"Rule Frequency",{"type":45,"tag":66,"props":738,"children":739},{},[740,745],{"type":45,"tag":70,"props":741,"children":742},{},[743],{"type":50,"value":744},"High total (100+ alerts\u002F7d), many hosts → noisy rule, DISCOUNT confidence",{"type":45,"tag":70,"props":746,"children":747},{},[748],{"type":50,"value":749},"Low total (\u003C10 alerts\u002F7d), single host → high-signal rule, INCREASE confidence",{"type":45,"tag":707,"props":751,"children":753},{"id":752},"entity-risk",[754],{"type":50,"value":755},"Entity Risk",{"type":45,"tag":66,"props":757,"children":758},{},[759,764],{"type":45,"tag":70,"props":760,"children":761},{},[762],{"type":50,"value":763},"Critical (>90) or High (70-90) entity risk → INCREASE confidence",{"type":45,"tag":70,"props":765,"children":766},{},[767],{"type":50,"value":768},"Low (\u003C20) entity risk → DECREASE confidence",{"type":45,"tag":59,"props":770,"children":772},{"id":771},"key-principles",[773],{"type":50,"value":774},"Key principles",{"type":45,"tag":66,"props":776,"children":777},{},[778,788,798,808],{"type":45,"tag":70,"props":779,"children":780},{},[781,786],{"type":45,"tag":74,"props":782,"children":783},{},[784],{"type":50,"value":785},"Attacks are pre-correlated.",{"type":50,"value":787}," Each finding groups related alerts into a narrative. Assess the attack as a\nunit — do not re-triage individual alerts within an attack.",{"type":45,"tag":70,"props":789,"children":790},{},[791,796],{"type":45,"tag":74,"props":792,"children":793},{},[794],{"type":50,"value":795},"Treat AD output as a hypothesis.",{"type":50,"value":797}," Attack Discovery uses LLM-generated analysis. The narrative may use\nstrong language (\"confirmed intrusion\") that reflects LLM framing, not evidence. Base confidence on the\nstructured signals, not the narrative language.",{"type":45,"tag":70,"props":799,"children":800},{},[801,806],{"type":45,"tag":74,"props":802,"children":803},{},[804],{"type":50,"value":805},"Most findings need validation.",{"type":50,"value":807}," Only HIGH confidence findings with strong entity risk signals warrant\nimmediate case creation. MODERATE findings need enrichment. LOW findings may be acknowledged.",{"type":45,"tag":70,"props":809,"children":810},{},[811,816],{"type":45,"tag":74,"props":812,"children":813},{},[814],{"type":50,"value":815},"Never create cases without user approval.",{"type":50,"value":817}," The dashboard has approve\u002Freject controls — always present\nyour analysis and let the user decide.",{"type":45,"tag":53,"props":819,"children":820},{},[821,823,829],{"type":50,"value":822},"For detailed classification criteria, see ",{"type":45,"tag":824,"props":825,"children":827},"a",{"href":826},"references\u002Fconfidence-scoring.md",[828],{"type":50,"value":826},{"type":50,"value":830},".",{"type":45,"tag":832,"props":833,"children":834},"style",{},[835],{"type":50,"value":836},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":838,"total":1008},[839,858,875,890,909,921,931,944,956,971,982,995],{"slug":840,"name":840,"fn":841,"description":842,"org":843,"tags":844,"stars":855,"repoUrl":856,"updatedAt":857},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[845,848,851,852],{"name":846,"slug":847,"type":15},"Analytics","analytics",{"name":849,"slug":850,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":853,"slug":854,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":859,"name":859,"fn":860,"description":861,"org":862,"tags":863,"stars":855,"repoUrl":856,"updatedAt":874},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[864,867,868,871],{"name":865,"slug":866,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":869,"slug":870,"type":15},"Engineering","engineering",{"name":872,"slug":873,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":876,"name":876,"fn":877,"description":878,"org":879,"tags":880,"stars":855,"repoUrl":856,"updatedAt":889},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[881,882,885,886],{"name":9,"slug":8,"type":15},{"name":883,"slug":884,"type":15},"Elasticsearch","elasticsearch",{"name":853,"slug":854,"type":15},{"name":887,"slug":888,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":891,"name":891,"fn":892,"description":893,"org":894,"tags":895,"stars":906,"repoUrl":907,"updatedAt":908},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[896,899,900,903],{"name":897,"slug":898,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":901,"slug":902,"type":15},"Operations","operations",{"name":904,"slug":905,"type":15},"Permissions","permissions",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:44.946285",{"slug":910,"name":910,"fn":911,"description":912,"org":913,"tags":914,"stars":906,"repoUrl":907,"updatedAt":920},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[915,916,919],{"name":897,"slug":898,"type":15},{"name":917,"slug":918,"type":15},"Deployment","deployment",{"name":883,"slug":884,"type":15},"2026-07-12T07:46:42.353362",{"slug":922,"name":922,"fn":923,"description":924,"org":925,"tags":926,"stars":906,"repoUrl":907,"updatedAt":930},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[927,928,929],{"name":897,"slug":898,"type":15},{"name":883,"slug":884,"type":15},{"name":901,"slug":902,"type":15},"2026-07-12T07:46:41.097412",{"slug":932,"name":932,"fn":933,"description":934,"org":935,"tags":936,"stars":906,"repoUrl":907,"updatedAt":943},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[937,938,939,942],{"name":897,"slug":898,"type":15},{"name":883,"slug":884,"type":15},{"name":940,"slug":941,"type":15},"Networking","networking",{"name":13,"slug":14,"type":15},"2026-07-12T07:46:43.675992",{"slug":945,"name":945,"fn":946,"description":947,"org":948,"tags":949,"stars":906,"repoUrl":907,"updatedAt":955},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[950,953,954],{"name":951,"slug":952,"type":15},"Authentication","authentication",{"name":897,"slug":898,"type":15},{"name":883,"slug":884,"type":15},"2026-07-12T07:46:39.783105",{"slug":957,"name":957,"fn":958,"description":959,"org":960,"tags":961,"stars":906,"repoUrl":907,"updatedAt":970},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[962,965,966,969],{"name":963,"slug":964,"type":15},"Audit","audit",{"name":883,"slug":884,"type":15},{"name":967,"slug":968,"type":15},"Logs","logs",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:35.092599",{"slug":972,"name":972,"fn":973,"description":974,"org":975,"tags":976,"stars":906,"repoUrl":907,"updatedAt":981},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[977,978,979,980],{"name":951,"slug":952,"type":15},{"name":9,"slug":8,"type":15},{"name":883,"slug":884,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:47:41.474547",{"slug":983,"name":983,"fn":984,"description":985,"org":986,"tags":987,"stars":906,"repoUrl":907,"updatedAt":994},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[988,989,990,993],{"name":9,"slug":8,"type":15},{"name":883,"slug":884,"type":15},{"name":991,"slug":992,"type":15},"RBAC","rbac",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:36.394177",{"slug":996,"name":996,"fn":997,"description":998,"org":999,"tags":1000,"stars":906,"repoUrl":907,"updatedAt":1007},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1001,1002,1003,1004],{"name":846,"slug":847,"type":15},{"name":849,"slug":850,"type":15},{"name":883,"slug":884,"type":15},{"name":1005,"slug":1006,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86,{"items":1010,"total":407},[1011,1024,1030,1043,1054],{"slug":1012,"name":1012,"fn":1013,"description":1014,"org":1015,"tags":1016,"stars":22,"repoUrl":23,"updatedAt":1023},"alert-triage","triage Elastic Security alerts","Triage Elastic Security alerts — fetch, investigate, classify threats, create cases, and acknowledge. Use when triaging alerts, performing SOC analysis, investigating detections, reviewing security incidents, or when the user mentions ransomware, malware, lateral movement, credential theft, DLL injection, suspicious processes, or any specific threat. Also trigger for \"show me alerts\", \"what's happening on host X\", \"any critical alerts\", or any security operations question.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1017,1018,1021,1022],{"name":9,"slug":8,"type":15},{"name":1019,"slug":1020,"type":15},"Monitoring","monitoring",{"name":13,"slug":14,"type":15},{"name":20,"slug":21,"type":15},"2026-07-12T07:48:26.972827",{"slug":4,"name":4,"fn":5,"description":6,"org":1025,"tags":1026,"stars":22,"repoUrl":23,"updatedAt":24},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1027,1028,1029],{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"name":20,"slug":21,"type":15},{"slug":1031,"name":1031,"fn":1032,"description":1033,"org":1034,"tags":1035,"stars":22,"repoUrl":23,"updatedAt":1042},"case-management","manage Elastic Security SOC cases","Create, search, update, and manage SOC cases for Elastic Security. ALWAYS use this skill when the user mentions cases, incidents, investigations, or asks to see, show, list, open, create, update, or search cases. Trigger for: \"show me my cases\", \"open cases\", \"list cases\", \"any open cases\", \"create a case\", \"case for this alert\", \"show me case 42\", \"incident tracking\", \"investigation status\", or any case-related question.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1036,1037,1040,1041],{"name":9,"slug":8,"type":15},{"name":1038,"slug":1039,"type":15},"Incident Response","incident-response",{"name":13,"slug":14,"type":15},{"name":20,"slug":21,"type":15},"2026-07-12T07:48:24.262486",{"slug":1044,"name":1044,"fn":1045,"description":1046,"org":1047,"tags":1048,"stars":22,"repoUrl":23,"updatedAt":1053},"detection-rule-management","manage Elastic Security detection rules","Create, tune, and manage Elastic Security detection rules. Use for false positive tuning, adding exceptions, creating new detection coverage, finding noisy rules, enabling\u002Fdisabling rules, or any detection engineering task. Also trigger for \"detection rules\", \"noisy rules\", \"false positives\", \"add exception\", \"create rule\", or \"tune rule\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1049,1050,1051,1052],{"name":9,"slug":8,"type":15},{"name":1019,"slug":1020,"type":15},{"name":13,"slug":14,"type":15},{"name":20,"slug":21,"type":15},"2026-07-12T07:48:28.211728",{"slug":1055,"name":1055,"fn":1056,"description":1057,"org":1058,"tags":1059,"stars":22,"repoUrl":23,"updatedAt":1066},"generate-sample-data","generate sample Elastic Security data","Generate sample security events, attack scenarios, and synthetic alerts for Elastic Security. Use when demoing, populating dashboards, testing detection rules, setting up a POC, or when the user asks for test data, demo data, or sample alerts.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1060,1063,1064,1065],{"name":1061,"slug":1062,"type":15},"Dashboards","dashboards",{"name":9,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"name":887,"slug":888,"type":15},"2026-07-12T07:48:25.510646"]