[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-cloud-network-security":3,"mdc-ws7fte-key":36,"related-repo-elastic-cloud-network-security":1917,"related-org-elastic-cloud-network-security":1998},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":31,"sourceUrl":34,"mdContent":35},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Networking","networking",{"name":20,"slug":21,"type":15},"Cloud","cloud",{"name":23,"slug":24,"type":15},"Elasticsearch","elasticsearch",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:43.675992",null,41,[],{"repoUrl":26,"stars":25,"forks":29,"topics":32,"description":33},[],"Official Elastic Skills","https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fcloud\u002Fnetwork-security","---\nname: cloud-network-security\ndescription: >\n  Manage Serverless network security (traffic filters): create, update, and delete\n  IP filters and AWS PrivateLink VPC filters. Use when restricting network access\n  or configuring private connectivity.\ncompatibility: >\n  Requires Python 3.8+, network access to the Elastic Cloud API (api.elastic-cloud.com).\n  Environment variables: EC_API_KEY (required, set by cloud-setup), EC_BASE_URL (optional,\n  defaults to https:\u002F\u002Fapi.elastic-cloud.com).\nmetadata:\n  author: elastic\n  version: 0.1.0\n---\n\n# Cloud Network Security\n\nManage network security policies for Elastic Cloud Serverless projects: IP filters to allowlist specific IPs or CIDRs,\nand VPC filters (AWS PrivateLink) to restrict traffic to specific VPC endpoints.\n\n> **Prerequisite:** This skill assumes the **cloud-setup** skill has already run — `EC_API_KEY` is set in the\n> environment and the organization context is established. If `EC_API_KEY` is missing, instruct the agent to invoke\n> **cloud-setup** first. Do NOT prompt the user for an API key directly.\n\nFor project creation and day-2 operations (including associating filters with projects), see **cloud-create-project**\nand **cloud-manage-project**. For identity and access management (users, roles, API keys), see\n**cloud-access-management**.\n\nFor detailed API endpoints and request schemas, see [references\u002Fapi-reference.md](references\u002Fapi-reference.md).\n\n## Terminology\n\nThis skill uses **network security** as the umbrella term, aligned with the Elastic Cloud UI direction. The underlying\nAPI uses **traffic filters** — you will see `traffic-filters` in endpoint paths and `traffic_filters` in JSON fields.\nWhen a user or agent says \"traffic filter,\" they mean the same thing as \"network security policy.\" The two filter types\nare **IP filters** (type `ip`) and **VPC filters** (type `vpce`).\n\n## Jobs to Be Done\n\n- Create an IP filter to restrict ingress to specific IPs or CIDR blocks\n- Create a VPC filter (AWS PrivateLink) to restrict traffic to specific VPC endpoint IDs\n- List, inspect, update, and delete network security policies\n- Look up PrivateLink region metadata (service names, domain names, availability zones)\n- Associate or disassociate filters with Serverless projects (delegates to **cloud-manage-project**)\n- Audit the current network security posture for an organization\n\n## Prerequisites and permissions\n\n| Item            | Description                                                                                 |\n| --------------- | ------------------------------------------------------------------------------------------- |\n| **EC_API_KEY**  | Cloud API key (set by **cloud-setup**). Required for all operations.                        |\n| **Region**      | Filters are region-scoped. The user must specify the target region when creating filters.   |\n| **Project IDs** | Required only when associating filters with projects (handled by **cloud-manage-project**). |\n\nRun `python3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py list-filters` to verify that `EC_API_KEY`\nis valid before proceeding with any operation.\n\n### Operation-level permissions\n\nThe following permissions are required for common network security operations in Elastic Cloud Serverless.\n\n| Operation                        | Required permission                       |\n| -------------------------------- | ----------------------------------------- |\n| List filters \u002F get metadata      | Any organization member                   |\n| Create \u002F update \u002F delete filters | Organization owner (`organization-admin`) |\n| Associate filters with projects  | Organization owner or project Admin       |\n\nThis skill does not perform a separate role pre-check. Attempt the requested operation and let the API enforce\nauthorization. If the API returns an authorization error (for example, `403 Forbidden`), stop and ask the user to verify\nthe provided API key permissions.\n\n### Manual setup fallback (when cloud-setup is unavailable)\n\nIf this skill is installed standalone and `cloud-setup` is not available, instruct the user to configure Cloud\nenvironment variables manually before running commands. Never ask the user to paste API keys in chat.\n\n| Variable      | Required | Description                                                                          |\n| ------------- | -------- | ------------------------------------------------------------------------------------ |\n| `EC_API_KEY`  | Yes      | Elastic Cloud API key (see permissions table above for required roles by operation). |\n| `EC_BASE_URL` | No       | Cloud API base URL (default: `https:\u002F\u002Fapi.elastic-cloud.com`).                       |\n\n> **Note:** If `EC_API_KEY` is missing, or the user does not have a Cloud API key yet, direct the user to generate one\n> at [Elastic Cloud API keys](https:\u002F\u002Fcloud.elastic.co\u002Faccount\u002Fkeys), then configure it locally using the steps below.\n\nPreferred method (agent-friendly): create a `.env` file in the project root:\n\n```bash\nEC_API_KEY=your-api-key\nEC_BASE_URL=https:\u002F\u002Fapi.elastic-cloud.com\n```\n\nAll `cloud\u002F*` scripts auto-load `.env` from the working directory.\n\nAlternative: export directly in the terminal:\n\n```bash\nexport EC_API_KEY=\"\u003Cyour-cloud-api-key>\"\nexport EC_BASE_URL=\"https:\u002F\u002Fapi.elastic-cloud.com\"\n```\n\nTerminal exports may not be visible to sandboxed agents running in separate shell sessions, so prefer `.env` when using\nan agent.\n\n## Decomposing Network Security Requests\n\nWhen the user describes a network security need in natural language (for example, \"restrict my search project to our\noffice IP\"), break the request into discrete tasks before executing.\n\n### Step 1 — Identify the components\n\n| Component       | Question to answer                                                     |\n| --------------- | ---------------------------------------------------------------------- |\n| **Filter type** | IP filter (public IPs\u002FCIDRs) or VPC filter (AWS PrivateLink endpoint)? |\n| **Region**      | Which AWS region are the target projects in?                           |\n| **Rules**       | What source IPs, CIDRs, or VPC endpoint IDs should be allowed?         |\n| **Scope**       | Apply to all new projects by default, or specific projects only?       |\n| **Projects**    | Which existing projects should this filter be associated with?         |\n\n### Step 2 — Check existing state\n\nBefore creating a new filter, check what already exists:\n\n```bash\npython3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py list-filters --region us-east-1\n```\n\n**Filter hygiene:** If an existing filter already covers the same source rules **for the same purpose**, reuse it\ninstead of creating a duplicate. Filters are region-scoped and can be associated with multiple projects, so a single\nfilter with the right rules serves many projects. Two filters with identical source rules are fine when they serve\ndifferent purposes (for example, different teams managing their own policies), but creating a second filter for the same\npurpose is unnecessary.\n\n### Step 3 — Create the filter\n\nRun the appropriate command from `skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py`.\n\n### Step 4 — Associate with projects\n\nFilter association is managed using the project PATCH endpoint. Use **cloud-manage-project** to associate or\ndisassociate filters:\n\n```text\nPATCH \u002Fapi\u002Fv1\u002Fserverless\u002Fprojects\u002F{type}\u002F{id}\nBody: { \"traffic_filters\": [{ \"id\": \"filter-id-1\" }, { \"id\": \"filter-id-2\" }] }\n```\n\nWhen updating associations, provide the **complete list** of filter IDs. Any filter not included in the list is\ndisassociated from the project.\n\n### Step 5 — Verify\n\nAfter execution, list filters again or GET the project to confirm the change took effect.\n\n## IP Filters versus VPC Filters\n\n| Aspect            | IP Filter (`ip`)                                   | VPC Filter (`vpce`)                                      |\n| ----------------- | -------------------------------------------------- | -------------------------------------------------------- |\n| **Purpose**       | Allowlist public IP addresses or CIDR blocks       | Restrict traffic to specific AWS VPC endpoint IDs        |\n| **Use case**      | Office IPs, CI\u002FCD runners, partner access          | Private connectivity without public internet exposure    |\n| **Source format** | IP address or CIDR (for example, `203.0.113.0\u002F24`) | AWS VPC endpoint ID (for example, `vpce-0abc123def456`)  |\n| **Network path**  | Public internet                                    | AWS PrivateLink (private, never leaves AWS network)      |\n| **Prerequisite**  | None                                               | VPC endpoint and DNS record created in AWS console first |\n\n> **Key concept:** Private connectivity in AWS is accepted by default in Elastic Cloud. Creating a VPC filter is only\n> needed to **restrict** traffic to specific VPC endpoint IDs. If you only need private connectivity (without\n> filtering), create the VPC endpoint and DNS record in AWS — no filter is needed on the Elastic Cloud side.\n\n## Examples\n\n### Allowlist an office IP range\n\n**Prompt:** \"Only allow traffic from our office network 203.0.113.0\u002F24 to projects in us-east-1.\"\n\n```bash\npython3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py create-filter \\\n  --name \"Office IP allowlist\" \\\n  --type ip \\\n  --region us-east-1 \\\n  --rules '[{\"source\": \"203.0.113.0\u002F24\", \"description\": \"Office network\"}]'\n```\n\nThen associate the filter with specific projects using **cloud-manage-project**.\n\n### Restrict traffic to a VPC endpoint\n\n**Prompt:** \"Lock down my observability project to only accept traffic from our VPC endpoint.\"\n\n```bash\npython3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py create-filter \\\n  --name \"Production VPC\" \\\n  --type vpce \\\n  --region us-east-1 \\\n  --rules '[{\"source\": \"vpce-0abc123def456\", \"description\": \"Production VPC endpoint\"}]'\n```\n\n### List all filters in a region\n\n**Prompt:** \"Show me all network security policies in eu-west-1.\"\n\n```bash\npython3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py list-filters --region eu-west-1\n```\n\n### Update a filter to add a new IP\n\n**Prompt:** \"Add the VPN IP 198.51.100.5 to our existing office filter.\"\n\n```bash\npython3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py get-filter --filter-id tf-12345\n# Review current rules, then update with the complete rule set:\npython3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py update-filter \\\n  --filter-id tf-12345 \\\n  --body '{\"rules\": [{\"source\": \"203.0.113.0\u002F24\", \"description\": \"Office network\"}, {\"source\": \"198.51.100.5\", \"description\": \"VPN\"}]}'\n```\n\n### Look up PrivateLink metadata for a region\n\n**Prompt:** \"What PrivateLink service name do I need for us-east-1?\"\n\n```bash\npython3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py get-metadata --region us-east-1\n```\n\n### Delete an unused filter\n\n**Prompt:** \"Remove the old staging IP filter.\"\n\n```bash\npython3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py delete-filter --filter-id tf-67890 --dry-run\n# Review what would be deleted, then confirm:\npython3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py delete-filter --filter-id tf-67890\n```\n\n## Guidelines\n\n- If `EC_API_KEY` is not set, do not prompt the user — instruct the agent to invoke **cloud-setup** first.\n- Always confirm destructive actions (delete filter) with the user before executing.\n- Filters are **region-scoped**: a filter created in `us-east-1` can only be associated with projects in that region.\n- **Filter hygiene — reuse, scope, and clean up:**\n  - Before creating a filter, always run `list-filters` and check whether an existing filter **for the same purpose**\n    already has the required source rules. Filters can be associated with multiple projects, so one filter with the\n    right rules is better than duplicates.\n  - Duplicate filters means filters for the same purpose with identical source rules — not merely overlapping IPs. Two\n    filters covering different project groups with the same CIDR are legitimate.\n  - Review unused filters periodically. If a filter is no longer associated with any project, prompt the user to delete\n    it to reduce clutter.\n- **Updating rules replaces the entire rule set.** When adding a rule using PATCH, include all existing rules plus the\n  new one. Omitting an existing rule removes it.\n- **Deleting a filter fails if it is still associated with a project.** Disassociate first using\n  **cloud-manage-project** (PATCH the project with the filter removed from the `traffic_filters` list), then delete.\n- `include_by_default` automatically associates the filter with all new projects in the region. Use with caution — it\n  affects every future project.\n- For project association and disassociation, delegate to the **cloud-manage-project** skill. This skill manages filter\n  definitions only.\n- For identity and access management (users, roles, API keys), see **cloud-access-management**.\n- For Elasticsearch-level security (native users, role mappings, DLS\u002FFLS), see **elasticsearch-authz**.\n",{"data":37,"body":41},{"name":4,"description":6,"compatibility":38,"metadata":39},"Requires Python 3.8+, network access to the Elastic Cloud API (api.elastic-cloud.com). Environment variables: EC_API_KEY (required, set by cloud-setup), EC_BASE_URL (optional, defaults to https:\u002F\u002Fapi.elastic-cloud.com).\n",{"author":8,"version":40},"0.1.0",{"type":42,"children":43},"root",[44,52,58,102,128,140,147,211,217,258,264,350,370,377,382,450,463,469,481,557,587,600,651,671,676,744,756,762,767,773,874,880,885,921,938,944,956,962,973,983,995,1001,1006,1012,1170,1190,1196,1202,1212,1326,1336,1342,1351,1452,1458,1467,1498,1504,1513,1613,1619,1628,1659,1665,1674,1743,1749,1911],{"type":45,"tag":46,"props":47,"children":48},"element","h1",{"id":4},[49],{"type":50,"value":51},"text","Cloud Network Security",{"type":45,"tag":53,"props":54,"children":55},"p",{},[56],{"type":50,"value":57},"Manage network security policies for Elastic Cloud Serverless projects: IP filters to allowlist specific IPs or CIDRs,\nand VPC filters (AWS PrivateLink) to restrict traffic to specific VPC endpoints.",{"type":45,"tag":59,"props":60,"children":61},"blockquote",{},[62],{"type":45,"tag":53,"props":63,"children":64},{},[65,71,73,78,80,87,89,94,96,100],{"type":45,"tag":66,"props":67,"children":68},"strong",{},[69],{"type":50,"value":70},"Prerequisite:",{"type":50,"value":72}," This skill assumes the ",{"type":45,"tag":66,"props":74,"children":75},{},[76],{"type":50,"value":77},"cloud-setup",{"type":50,"value":79}," skill has already run — ",{"type":45,"tag":81,"props":82,"children":84},"code",{"className":83},[],[85],{"type":50,"value":86},"EC_API_KEY",{"type":50,"value":88}," is set in the\nenvironment and the organization context is established. If ",{"type":45,"tag":81,"props":90,"children":92},{"className":91},[],[93],{"type":50,"value":86},{"type":50,"value":95}," is missing, instruct the agent to invoke\n",{"type":45,"tag":66,"props":97,"children":98},{},[99],{"type":50,"value":77},{"type":50,"value":101}," first. Do NOT prompt the user for an API key directly.",{"type":45,"tag":53,"props":103,"children":104},{},[105,107,112,114,119,121,126],{"type":50,"value":106},"For project creation and day-2 operations (including associating filters with projects), see ",{"type":45,"tag":66,"props":108,"children":109},{},[110],{"type":50,"value":111},"cloud-create-project",{"type":50,"value":113},"\nand ",{"type":45,"tag":66,"props":115,"children":116},{},[117],{"type":50,"value":118},"cloud-manage-project",{"type":50,"value":120},". For identity and access management (users, roles, API keys), see\n",{"type":45,"tag":66,"props":122,"children":123},{},[124],{"type":50,"value":125},"cloud-access-management",{"type":50,"value":127},".",{"type":45,"tag":53,"props":129,"children":130},{},[131,133,139],{"type":50,"value":132},"For detailed API endpoints and request schemas, see ",{"type":45,"tag":134,"props":135,"children":137},"a",{"href":136},"references\u002Fapi-reference.md",[138],{"type":50,"value":136},{"type":50,"value":127},{"type":45,"tag":141,"props":142,"children":144},"h2",{"id":143},"terminology",[145],{"type":50,"value":146},"Terminology",{"type":45,"tag":53,"props":148,"children":149},{},[150,152,157,159,164,166,172,174,180,182,187,189,195,197,202,203,209],{"type":50,"value":151},"This skill uses ",{"type":45,"tag":66,"props":153,"children":154},{},[155],{"type":50,"value":156},"network security",{"type":50,"value":158}," as the umbrella term, aligned with the Elastic Cloud UI direction. The underlying\nAPI uses ",{"type":45,"tag":66,"props":160,"children":161},{},[162],{"type":50,"value":163},"traffic filters",{"type":50,"value":165}," — you will see ",{"type":45,"tag":81,"props":167,"children":169},{"className":168},[],[170],{"type":50,"value":171},"traffic-filters",{"type":50,"value":173}," in endpoint paths and ",{"type":45,"tag":81,"props":175,"children":177},{"className":176},[],[178],{"type":50,"value":179},"traffic_filters",{"type":50,"value":181}," in JSON fields.\nWhen a user or agent says \"traffic filter,\" they mean the same thing as \"network security policy.\" The two filter types\nare ",{"type":45,"tag":66,"props":183,"children":184},{},[185],{"type":50,"value":186},"IP filters",{"type":50,"value":188}," (type ",{"type":45,"tag":81,"props":190,"children":192},{"className":191},[],[193],{"type":50,"value":194},"ip",{"type":50,"value":196},") and ",{"type":45,"tag":66,"props":198,"children":199},{},[200],{"type":50,"value":201},"VPC filters",{"type":50,"value":188},{"type":45,"tag":81,"props":204,"children":206},{"className":205},[],[207],{"type":50,"value":208},"vpce",{"type":50,"value":210},").",{"type":45,"tag":141,"props":212,"children":214},{"id":213},"jobs-to-be-done",[215],{"type":50,"value":216},"Jobs to Be Done",{"type":45,"tag":218,"props":219,"children":220},"ul",{},[221,227,232,237,242,253],{"type":45,"tag":222,"props":223,"children":224},"li",{},[225],{"type":50,"value":226},"Create an IP filter to restrict ingress to specific IPs or CIDR blocks",{"type":45,"tag":222,"props":228,"children":229},{},[230],{"type":50,"value":231},"Create a VPC filter (AWS PrivateLink) to restrict traffic to specific VPC endpoint IDs",{"type":45,"tag":222,"props":233,"children":234},{},[235],{"type":50,"value":236},"List, inspect, update, and delete network security policies",{"type":45,"tag":222,"props":238,"children":239},{},[240],{"type":50,"value":241},"Look up PrivateLink region metadata (service names, domain names, availability zones)",{"type":45,"tag":222,"props":243,"children":244},{},[245,247,251],{"type":50,"value":246},"Associate or disassociate filters with Serverless projects (delegates to ",{"type":45,"tag":66,"props":248,"children":249},{},[250],{"type":50,"value":118},{"type":50,"value":252},")",{"type":45,"tag":222,"props":254,"children":255},{},[256],{"type":50,"value":257},"Audit the current network security posture for an organization",{"type":45,"tag":141,"props":259,"children":261},{"id":260},"prerequisites-and-permissions",[262],{"type":50,"value":263},"Prerequisites and permissions",{"type":45,"tag":265,"props":266,"children":267},"table",{},[268,287],{"type":45,"tag":269,"props":270,"children":271},"thead",{},[272],{"type":45,"tag":273,"props":274,"children":275},"tr",{},[276,282],{"type":45,"tag":277,"props":278,"children":279},"th",{},[280],{"type":50,"value":281},"Item",{"type":45,"tag":277,"props":283,"children":284},{},[285],{"type":50,"value":286},"Description",{"type":45,"tag":288,"props":289,"children":290},"tbody",{},[291,313,329],{"type":45,"tag":273,"props":292,"children":293},{},[294,302],{"type":45,"tag":295,"props":296,"children":297},"td",{},[298],{"type":45,"tag":66,"props":299,"children":300},{},[301],{"type":50,"value":86},{"type":45,"tag":295,"props":303,"children":304},{},[305,307,311],{"type":50,"value":306},"Cloud API key (set by ",{"type":45,"tag":66,"props":308,"children":309},{},[310],{"type":50,"value":77},{"type":50,"value":312},"). Required for all operations.",{"type":45,"tag":273,"props":314,"children":315},{},[316,324],{"type":45,"tag":295,"props":317,"children":318},{},[319],{"type":45,"tag":66,"props":320,"children":321},{},[322],{"type":50,"value":323},"Region",{"type":45,"tag":295,"props":325,"children":326},{},[327],{"type":50,"value":328},"Filters are region-scoped. The user must specify the target region when creating filters.",{"type":45,"tag":273,"props":330,"children":331},{},[332,340],{"type":45,"tag":295,"props":333,"children":334},{},[335],{"type":45,"tag":66,"props":336,"children":337},{},[338],{"type":50,"value":339},"Project IDs",{"type":45,"tag":295,"props":341,"children":342},{},[343,345,349],{"type":50,"value":344},"Required only when associating filters with projects (handled by ",{"type":45,"tag":66,"props":346,"children":347},{},[348],{"type":50,"value":118},{"type":50,"value":210},{"type":45,"tag":53,"props":351,"children":352},{},[353,355,361,363,368],{"type":50,"value":354},"Run ",{"type":45,"tag":81,"props":356,"children":358},{"className":357},[],[359],{"type":50,"value":360},"python3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py list-filters",{"type":50,"value":362}," to verify that ",{"type":45,"tag":81,"props":364,"children":366},{"className":365},[],[367],{"type":50,"value":86},{"type":50,"value":369},"\nis valid before proceeding with any operation.",{"type":45,"tag":371,"props":372,"children":374},"h3",{"id":373},"operation-level-permissions",[375],{"type":50,"value":376},"Operation-level permissions",{"type":45,"tag":53,"props":378,"children":379},{},[380],{"type":50,"value":381},"The following permissions are required for common network security operations in Elastic Cloud Serverless.",{"type":45,"tag":265,"props":383,"children":384},{},[385,401],{"type":45,"tag":269,"props":386,"children":387},{},[388],{"type":45,"tag":273,"props":389,"children":390},{},[391,396],{"type":45,"tag":277,"props":392,"children":393},{},[394],{"type":50,"value":395},"Operation",{"type":45,"tag":277,"props":397,"children":398},{},[399],{"type":50,"value":400},"Required permission",{"type":45,"tag":288,"props":402,"children":403},{},[404,417,437],{"type":45,"tag":273,"props":405,"children":406},{},[407,412],{"type":45,"tag":295,"props":408,"children":409},{},[410],{"type":50,"value":411},"List filters \u002F get metadata",{"type":45,"tag":295,"props":413,"children":414},{},[415],{"type":50,"value":416},"Any organization member",{"type":45,"tag":273,"props":418,"children":419},{},[420,425],{"type":45,"tag":295,"props":421,"children":422},{},[423],{"type":50,"value":424},"Create \u002F update \u002F delete filters",{"type":45,"tag":295,"props":426,"children":427},{},[428,430,436],{"type":50,"value":429},"Organization owner (",{"type":45,"tag":81,"props":431,"children":433},{"className":432},[],[434],{"type":50,"value":435},"organization-admin",{"type":50,"value":252},{"type":45,"tag":273,"props":438,"children":439},{},[440,445],{"type":45,"tag":295,"props":441,"children":442},{},[443],{"type":50,"value":444},"Associate filters with projects",{"type":45,"tag":295,"props":446,"children":447},{},[448],{"type":50,"value":449},"Organization owner or project Admin",{"type":45,"tag":53,"props":451,"children":452},{},[453,455,461],{"type":50,"value":454},"This skill does not perform a separate role pre-check. Attempt the requested operation and let the API enforce\nauthorization. If the API returns an authorization error (for example, ",{"type":45,"tag":81,"props":456,"children":458},{"className":457},[],[459],{"type":50,"value":460},"403 Forbidden",{"type":50,"value":462},"), stop and ask the user to verify\nthe provided API key permissions.",{"type":45,"tag":371,"props":464,"children":466},{"id":465},"manual-setup-fallback-when-cloud-setup-is-unavailable",[467],{"type":50,"value":468},"Manual setup fallback (when cloud-setup is unavailable)",{"type":45,"tag":53,"props":470,"children":471},{},[472,474,479],{"type":50,"value":473},"If this skill is installed standalone and ",{"type":45,"tag":81,"props":475,"children":477},{"className":476},[],[478],{"type":50,"value":77},{"type":50,"value":480}," is not available, instruct the user to configure Cloud\nenvironment variables manually before running commands. Never ask the user to paste API keys in chat.",{"type":45,"tag":265,"props":482,"children":483},{},[484,504],{"type":45,"tag":269,"props":485,"children":486},{},[487],{"type":45,"tag":273,"props":488,"children":489},{},[490,495,500],{"type":45,"tag":277,"props":491,"children":492},{},[493],{"type":50,"value":494},"Variable",{"type":45,"tag":277,"props":496,"children":497},{},[498],{"type":50,"value":499},"Required",{"type":45,"tag":277,"props":501,"children":502},{},[503],{"type":50,"value":286},{"type":45,"tag":288,"props":505,"children":506},{},[507,528],{"type":45,"tag":273,"props":508,"children":509},{},[510,518,523],{"type":45,"tag":295,"props":511,"children":512},{},[513],{"type":45,"tag":81,"props":514,"children":516},{"className":515},[],[517],{"type":50,"value":86},{"type":45,"tag":295,"props":519,"children":520},{},[521],{"type":50,"value":522},"Yes",{"type":45,"tag":295,"props":524,"children":525},{},[526],{"type":50,"value":527},"Elastic Cloud API key (see permissions table above for required roles by operation).",{"type":45,"tag":273,"props":529,"children":530},{},[531,540,545],{"type":45,"tag":295,"props":532,"children":533},{},[534],{"type":45,"tag":81,"props":535,"children":537},{"className":536},[],[538],{"type":50,"value":539},"EC_BASE_URL",{"type":45,"tag":295,"props":541,"children":542},{},[543],{"type":50,"value":544},"No",{"type":45,"tag":295,"props":546,"children":547},{},[548,550,556],{"type":50,"value":549},"Cloud API base URL (default: ",{"type":45,"tag":81,"props":551,"children":553},{"className":552},[],[554],{"type":50,"value":555},"https:\u002F\u002Fapi.elastic-cloud.com",{"type":50,"value":210},{"type":45,"tag":59,"props":558,"children":559},{},[560],{"type":45,"tag":53,"props":561,"children":562},{},[563,568,570,575,577,585],{"type":45,"tag":66,"props":564,"children":565},{},[566],{"type":50,"value":567},"Note:",{"type":50,"value":569}," If ",{"type":45,"tag":81,"props":571,"children":573},{"className":572},[],[574],{"type":50,"value":86},{"type":50,"value":576}," is missing, or the user does not have a Cloud API key yet, direct the user to generate one\nat ",{"type":45,"tag":134,"props":578,"children":582},{"href":579,"rel":580},"https:\u002F\u002Fcloud.elastic.co\u002Faccount\u002Fkeys",[581],"nofollow",[583],{"type":50,"value":584},"Elastic Cloud API keys",{"type":50,"value":586},", then configure it locally using the steps below.",{"type":45,"tag":53,"props":588,"children":589},{},[590,592,598],{"type":50,"value":591},"Preferred method (agent-friendly): create a ",{"type":45,"tag":81,"props":593,"children":595},{"className":594},[],[596],{"type":50,"value":597},".env",{"type":50,"value":599}," file in the project root:",{"type":45,"tag":601,"props":602,"children":607},"pre",{"className":603,"code":604,"language":605,"meta":606,"style":606},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","EC_API_KEY=your-api-key\nEC_BASE_URL=https:\u002F\u002Fapi.elastic-cloud.com\n","bash","",[608],{"type":45,"tag":81,"props":609,"children":610},{"__ignoreMap":606},[611,634],{"type":45,"tag":612,"props":613,"children":616},"span",{"class":614,"line":615},"line",1,[617,622,628],{"type":45,"tag":612,"props":618,"children":620},{"style":619},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[621],{"type":50,"value":86},{"type":45,"tag":612,"props":623,"children":625},{"style":624},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[626],{"type":50,"value":627},"=",{"type":45,"tag":612,"props":629,"children":631},{"style":630},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[632],{"type":50,"value":633},"your-api-key\n",{"type":45,"tag":612,"props":635,"children":637},{"class":614,"line":636},2,[638,642,646],{"type":45,"tag":612,"props":639,"children":640},{"style":619},[641],{"type":50,"value":539},{"type":45,"tag":612,"props":643,"children":644},{"style":624},[645],{"type":50,"value":627},{"type":45,"tag":612,"props":647,"children":648},{"style":630},[649],{"type":50,"value":650},"https:\u002F\u002Fapi.elastic-cloud.com\n",{"type":45,"tag":53,"props":652,"children":653},{},[654,656,662,664,669],{"type":50,"value":655},"All ",{"type":45,"tag":81,"props":657,"children":659},{"className":658},[],[660],{"type":50,"value":661},"cloud\u002F*",{"type":50,"value":663}," scripts auto-load ",{"type":45,"tag":81,"props":665,"children":667},{"className":666},[],[668],{"type":50,"value":597},{"type":50,"value":670}," from the working directory.",{"type":45,"tag":53,"props":672,"children":673},{},[674],{"type":50,"value":675},"Alternative: export directly in the terminal:",{"type":45,"tag":601,"props":677,"children":679},{"className":603,"code":678,"language":605,"meta":606,"style":606},"export EC_API_KEY=\"\u003Cyour-cloud-api-key>\"\nexport EC_BASE_URL=\"https:\u002F\u002Fapi.elastic-cloud.com\"\n",[680],{"type":45,"tag":81,"props":681,"children":682},{"__ignoreMap":606},[683,716],{"type":45,"tag":612,"props":684,"children":685},{"class":614,"line":615},[686,692,697,701,706,711],{"type":45,"tag":612,"props":687,"children":689},{"style":688},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[690],{"type":50,"value":691},"export",{"type":45,"tag":612,"props":693,"children":694},{"style":619},[695],{"type":50,"value":696}," EC_API_KEY",{"type":45,"tag":612,"props":698,"children":699},{"style":624},[700],{"type":50,"value":627},{"type":45,"tag":612,"props":702,"children":703},{"style":624},[704],{"type":50,"value":705},"\"",{"type":45,"tag":612,"props":707,"children":708},{"style":630},[709],{"type":50,"value":710},"\u003Cyour-cloud-api-key>",{"type":45,"tag":612,"props":712,"children":713},{"style":624},[714],{"type":50,"value":715},"\"\n",{"type":45,"tag":612,"props":717,"children":718},{"class":614,"line":636},[719,723,728,732,736,740],{"type":45,"tag":612,"props":720,"children":721},{"style":688},[722],{"type":50,"value":691},{"type":45,"tag":612,"props":724,"children":725},{"style":619},[726],{"type":50,"value":727}," EC_BASE_URL",{"type":45,"tag":612,"props":729,"children":730},{"style":624},[731],{"type":50,"value":627},{"type":45,"tag":612,"props":733,"children":734},{"style":624},[735],{"type":50,"value":705},{"type":45,"tag":612,"props":737,"children":738},{"style":630},[739],{"type":50,"value":555},{"type":45,"tag":612,"props":741,"children":742},{"style":624},[743],{"type":50,"value":715},{"type":45,"tag":53,"props":745,"children":746},{},[747,749,754],{"type":50,"value":748},"Terminal exports may not be visible to sandboxed agents running in separate shell sessions, so prefer ",{"type":45,"tag":81,"props":750,"children":752},{"className":751},[],[753],{"type":50,"value":597},{"type":50,"value":755}," when using\nan agent.",{"type":45,"tag":141,"props":757,"children":759},{"id":758},"decomposing-network-security-requests",[760],{"type":50,"value":761},"Decomposing Network Security Requests",{"type":45,"tag":53,"props":763,"children":764},{},[765],{"type":50,"value":766},"When the user describes a network security need in natural language (for example, \"restrict my search project to our\noffice IP\"), break the request into discrete tasks before executing.",{"type":45,"tag":371,"props":768,"children":770},{"id":769},"step-1-identify-the-components",[771],{"type":50,"value":772},"Step 1 — Identify the components",{"type":45,"tag":265,"props":774,"children":775},{},[776,792],{"type":45,"tag":269,"props":777,"children":778},{},[779],{"type":45,"tag":273,"props":780,"children":781},{},[782,787],{"type":45,"tag":277,"props":783,"children":784},{},[785],{"type":50,"value":786},"Component",{"type":45,"tag":277,"props":788,"children":789},{},[790],{"type":50,"value":791},"Question to answer",{"type":45,"tag":288,"props":793,"children":794},{},[795,811,826,842,858],{"type":45,"tag":273,"props":796,"children":797},{},[798,806],{"type":45,"tag":295,"props":799,"children":800},{},[801],{"type":45,"tag":66,"props":802,"children":803},{},[804],{"type":50,"value":805},"Filter type",{"type":45,"tag":295,"props":807,"children":808},{},[809],{"type":50,"value":810},"IP filter (public IPs\u002FCIDRs) or VPC filter (AWS PrivateLink endpoint)?",{"type":45,"tag":273,"props":812,"children":813},{},[814,821],{"type":45,"tag":295,"props":815,"children":816},{},[817],{"type":45,"tag":66,"props":818,"children":819},{},[820],{"type":50,"value":323},{"type":45,"tag":295,"props":822,"children":823},{},[824],{"type":50,"value":825},"Which AWS region are the target projects in?",{"type":45,"tag":273,"props":827,"children":828},{},[829,837],{"type":45,"tag":295,"props":830,"children":831},{},[832],{"type":45,"tag":66,"props":833,"children":834},{},[835],{"type":50,"value":836},"Rules",{"type":45,"tag":295,"props":838,"children":839},{},[840],{"type":50,"value":841},"What source IPs, CIDRs, or VPC endpoint IDs should be allowed?",{"type":45,"tag":273,"props":843,"children":844},{},[845,853],{"type":45,"tag":295,"props":846,"children":847},{},[848],{"type":45,"tag":66,"props":849,"children":850},{},[851],{"type":50,"value":852},"Scope",{"type":45,"tag":295,"props":854,"children":855},{},[856],{"type":50,"value":857},"Apply to all new projects by default, or specific projects only?",{"type":45,"tag":273,"props":859,"children":860},{},[861,869],{"type":45,"tag":295,"props":862,"children":863},{},[864],{"type":45,"tag":66,"props":865,"children":866},{},[867],{"type":50,"value":868},"Projects",{"type":45,"tag":295,"props":870,"children":871},{},[872],{"type":50,"value":873},"Which existing projects should this filter be associated with?",{"type":45,"tag":371,"props":875,"children":877},{"id":876},"step-2-check-existing-state",[878],{"type":50,"value":879},"Step 2 — Check existing state",{"type":45,"tag":53,"props":881,"children":882},{},[883],{"type":50,"value":884},"Before creating a new filter, check what already exists:",{"type":45,"tag":601,"props":886,"children":888},{"className":603,"code":887,"language":605,"meta":606,"style":606},"python3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py list-filters --region us-east-1\n",[889],{"type":45,"tag":81,"props":890,"children":891},{"__ignoreMap":606},[892],{"type":45,"tag":612,"props":893,"children":894},{"class":614,"line":615},[895,901,906,911,916],{"type":45,"tag":612,"props":896,"children":898},{"style":897},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[899],{"type":50,"value":900},"python3",{"type":45,"tag":612,"props":902,"children":903},{"style":630},[904],{"type":50,"value":905}," skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py",{"type":45,"tag":612,"props":907,"children":908},{"style":630},[909],{"type":50,"value":910}," list-filters",{"type":45,"tag":612,"props":912,"children":913},{"style":630},[914],{"type":50,"value":915}," --region",{"type":45,"tag":612,"props":917,"children":918},{"style":630},[919],{"type":50,"value":920}," us-east-1\n",{"type":45,"tag":53,"props":922,"children":923},{},[924,929,931,936],{"type":45,"tag":66,"props":925,"children":926},{},[927],{"type":50,"value":928},"Filter hygiene:",{"type":50,"value":930}," If an existing filter already covers the same source rules ",{"type":45,"tag":66,"props":932,"children":933},{},[934],{"type":50,"value":935},"for the same purpose",{"type":50,"value":937},", reuse it\ninstead of creating a duplicate. Filters are region-scoped and can be associated with multiple projects, so a single\nfilter with the right rules serves many projects. Two filters with identical source rules are fine when they serve\ndifferent purposes (for example, different teams managing their own policies), but creating a second filter for the same\npurpose is unnecessary.",{"type":45,"tag":371,"props":939,"children":941},{"id":940},"step-3-create-the-filter",[942],{"type":50,"value":943},"Step 3 — Create the filter",{"type":45,"tag":53,"props":945,"children":946},{},[947,949,955],{"type":50,"value":948},"Run the appropriate command from ",{"type":45,"tag":81,"props":950,"children":952},{"className":951},[],[953],{"type":50,"value":954},"skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py",{"type":50,"value":127},{"type":45,"tag":371,"props":957,"children":959},{"id":958},"step-4-associate-with-projects",[960],{"type":50,"value":961},"Step 4 — Associate with projects",{"type":45,"tag":53,"props":963,"children":964},{},[965,967,971],{"type":50,"value":966},"Filter association is managed using the project PATCH endpoint. Use ",{"type":45,"tag":66,"props":968,"children":969},{},[970],{"type":50,"value":118},{"type":50,"value":972}," to associate or\ndisassociate filters:",{"type":45,"tag":601,"props":974,"children":978},{"className":975,"code":977,"language":50,"meta":606},[976],"language-text","PATCH \u002Fapi\u002Fv1\u002Fserverless\u002Fprojects\u002F{type}\u002F{id}\nBody: { \"traffic_filters\": [{ \"id\": \"filter-id-1\" }, { \"id\": \"filter-id-2\" }] }\n",[979],{"type":45,"tag":81,"props":980,"children":981},{"__ignoreMap":606},[982],{"type":50,"value":977},{"type":45,"tag":53,"props":984,"children":985},{},[986,988,993],{"type":50,"value":987},"When updating associations, provide the ",{"type":45,"tag":66,"props":989,"children":990},{},[991],{"type":50,"value":992},"complete list",{"type":50,"value":994}," of filter IDs. Any filter not included in the list is\ndisassociated from the project.",{"type":45,"tag":371,"props":996,"children":998},{"id":997},"step-5-verify",[999],{"type":50,"value":1000},"Step 5 — Verify",{"type":45,"tag":53,"props":1002,"children":1003},{},[1004],{"type":50,"value":1005},"After execution, list filters again or GET the project to confirm the change took effect.",{"type":45,"tag":141,"props":1007,"children":1009},{"id":1008},"ip-filters-versus-vpc-filters",[1010],{"type":50,"value":1011},"IP Filters versus VPC Filters",{"type":45,"tag":265,"props":1013,"children":1014},{},[1015,1048],{"type":45,"tag":269,"props":1016,"children":1017},{},[1018],{"type":45,"tag":273,"props":1019,"children":1020},{},[1021,1026,1037],{"type":45,"tag":277,"props":1022,"children":1023},{},[1024],{"type":50,"value":1025},"Aspect",{"type":45,"tag":277,"props":1027,"children":1028},{},[1029,1031,1036],{"type":50,"value":1030},"IP Filter (",{"type":45,"tag":81,"props":1032,"children":1034},{"className":1033},[],[1035],{"type":50,"value":194},{"type":50,"value":252},{"type":45,"tag":277,"props":1038,"children":1039},{},[1040,1042,1047],{"type":50,"value":1041},"VPC Filter (",{"type":45,"tag":81,"props":1043,"children":1045},{"className":1044},[],[1046],{"type":50,"value":208},{"type":50,"value":252},{"type":45,"tag":288,"props":1049,"children":1050},{},[1051,1072,1093,1128,1149],{"type":45,"tag":273,"props":1052,"children":1053},{},[1054,1062,1067],{"type":45,"tag":295,"props":1055,"children":1056},{},[1057],{"type":45,"tag":66,"props":1058,"children":1059},{},[1060],{"type":50,"value":1061},"Purpose",{"type":45,"tag":295,"props":1063,"children":1064},{},[1065],{"type":50,"value":1066},"Allowlist public IP addresses or CIDR blocks",{"type":45,"tag":295,"props":1068,"children":1069},{},[1070],{"type":50,"value":1071},"Restrict traffic to specific AWS VPC endpoint IDs",{"type":45,"tag":273,"props":1073,"children":1074},{},[1075,1083,1088],{"type":45,"tag":295,"props":1076,"children":1077},{},[1078],{"type":45,"tag":66,"props":1079,"children":1080},{},[1081],{"type":50,"value":1082},"Use case",{"type":45,"tag":295,"props":1084,"children":1085},{},[1086],{"type":50,"value":1087},"Office IPs, CI\u002FCD runners, partner access",{"type":45,"tag":295,"props":1089,"children":1090},{},[1091],{"type":50,"value":1092},"Private connectivity without public internet exposure",{"type":45,"tag":273,"props":1094,"children":1095},{},[1096,1104,1116],{"type":45,"tag":295,"props":1097,"children":1098},{},[1099],{"type":45,"tag":66,"props":1100,"children":1101},{},[1102],{"type":50,"value":1103},"Source format",{"type":45,"tag":295,"props":1105,"children":1106},{},[1107,1109,1115],{"type":50,"value":1108},"IP address or CIDR (for example, ",{"type":45,"tag":81,"props":1110,"children":1112},{"className":1111},[],[1113],{"type":50,"value":1114},"203.0.113.0\u002F24",{"type":50,"value":252},{"type":45,"tag":295,"props":1117,"children":1118},{},[1119,1121,1127],{"type":50,"value":1120},"AWS VPC endpoint ID (for example, ",{"type":45,"tag":81,"props":1122,"children":1124},{"className":1123},[],[1125],{"type":50,"value":1126},"vpce-0abc123def456",{"type":50,"value":252},{"type":45,"tag":273,"props":1129,"children":1130},{},[1131,1139,1144],{"type":45,"tag":295,"props":1132,"children":1133},{},[1134],{"type":45,"tag":66,"props":1135,"children":1136},{},[1137],{"type":50,"value":1138},"Network path",{"type":45,"tag":295,"props":1140,"children":1141},{},[1142],{"type":50,"value":1143},"Public internet",{"type":45,"tag":295,"props":1145,"children":1146},{},[1147],{"type":50,"value":1148},"AWS PrivateLink (private, never leaves AWS network)",{"type":45,"tag":273,"props":1150,"children":1151},{},[1152,1160,1165],{"type":45,"tag":295,"props":1153,"children":1154},{},[1155],{"type":45,"tag":66,"props":1156,"children":1157},{},[1158],{"type":50,"value":1159},"Prerequisite",{"type":45,"tag":295,"props":1161,"children":1162},{},[1163],{"type":50,"value":1164},"None",{"type":45,"tag":295,"props":1166,"children":1167},{},[1168],{"type":50,"value":1169},"VPC endpoint and DNS record created in AWS console first",{"type":45,"tag":59,"props":1171,"children":1172},{},[1173],{"type":45,"tag":53,"props":1174,"children":1175},{},[1176,1181,1183,1188],{"type":45,"tag":66,"props":1177,"children":1178},{},[1179],{"type":50,"value":1180},"Key concept:",{"type":50,"value":1182}," Private connectivity in AWS is accepted by default in Elastic Cloud. Creating a VPC filter is only\nneeded to ",{"type":45,"tag":66,"props":1184,"children":1185},{},[1186],{"type":50,"value":1187},"restrict",{"type":50,"value":1189}," traffic to specific VPC endpoint IDs. If you only need private connectivity (without\nfiltering), create the VPC endpoint and DNS record in AWS — no filter is needed on the Elastic Cloud side.",{"type":45,"tag":141,"props":1191,"children":1193},{"id":1192},"examples",[1194],{"type":50,"value":1195},"Examples",{"type":45,"tag":371,"props":1197,"children":1199},{"id":1198},"allowlist-an-office-ip-range",[1200],{"type":50,"value":1201},"Allowlist an office IP range",{"type":45,"tag":53,"props":1203,"children":1204},{},[1205,1210],{"type":45,"tag":66,"props":1206,"children":1207},{},[1208],{"type":50,"value":1209},"Prompt:",{"type":50,"value":1211}," \"Only allow traffic from our office network 203.0.113.0\u002F24 to projects in us-east-1.\"",{"type":45,"tag":601,"props":1213,"children":1215},{"className":603,"code":1214,"language":605,"meta":606,"style":606},"python3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py create-filter \\\n  --name \"Office IP allowlist\" \\\n  --type ip \\\n  --region us-east-1 \\\n  --rules '[{\"source\": \"203.0.113.0\u002F24\", \"description\": \"Office network\"}]'\n",[1216],{"type":45,"tag":81,"props":1217,"children":1218},{"__ignoreMap":606},[1219,1240,1266,1284,1302],{"type":45,"tag":612,"props":1220,"children":1221},{"class":614,"line":615},[1222,1226,1230,1235],{"type":45,"tag":612,"props":1223,"children":1224},{"style":897},[1225],{"type":50,"value":900},{"type":45,"tag":612,"props":1227,"children":1228},{"style":630},[1229],{"type":50,"value":905},{"type":45,"tag":612,"props":1231,"children":1232},{"style":630},[1233],{"type":50,"value":1234}," create-filter",{"type":45,"tag":612,"props":1236,"children":1237},{"style":619},[1238],{"type":50,"value":1239}," \\\n",{"type":45,"tag":612,"props":1241,"children":1242},{"class":614,"line":636},[1243,1248,1253,1258,1262],{"type":45,"tag":612,"props":1244,"children":1245},{"style":630},[1246],{"type":50,"value":1247},"  --name",{"type":45,"tag":612,"props":1249,"children":1250},{"style":624},[1251],{"type":50,"value":1252}," \"",{"type":45,"tag":612,"props":1254,"children":1255},{"style":630},[1256],{"type":50,"value":1257},"Office IP allowlist",{"type":45,"tag":612,"props":1259,"children":1260},{"style":624},[1261],{"type":50,"value":705},{"type":45,"tag":612,"props":1263,"children":1264},{"style":619},[1265],{"type":50,"value":1239},{"type":45,"tag":612,"props":1267,"children":1269},{"class":614,"line":1268},3,[1270,1275,1280],{"type":45,"tag":612,"props":1271,"children":1272},{"style":630},[1273],{"type":50,"value":1274},"  --type",{"type":45,"tag":612,"props":1276,"children":1277},{"style":630},[1278],{"type":50,"value":1279}," ip",{"type":45,"tag":612,"props":1281,"children":1282},{"style":619},[1283],{"type":50,"value":1239},{"type":45,"tag":612,"props":1285,"children":1287},{"class":614,"line":1286},4,[1288,1293,1298],{"type":45,"tag":612,"props":1289,"children":1290},{"style":630},[1291],{"type":50,"value":1292},"  --region",{"type":45,"tag":612,"props":1294,"children":1295},{"style":630},[1296],{"type":50,"value":1297}," us-east-1",{"type":45,"tag":612,"props":1299,"children":1300},{"style":619},[1301],{"type":50,"value":1239},{"type":45,"tag":612,"props":1303,"children":1305},{"class":614,"line":1304},5,[1306,1311,1316,1321],{"type":45,"tag":612,"props":1307,"children":1308},{"style":630},[1309],{"type":50,"value":1310},"  --rules",{"type":45,"tag":612,"props":1312,"children":1313},{"style":624},[1314],{"type":50,"value":1315}," '",{"type":45,"tag":612,"props":1317,"children":1318},{"style":630},[1319],{"type":50,"value":1320},"[{\"source\": \"203.0.113.0\u002F24\", \"description\": \"Office network\"}]",{"type":45,"tag":612,"props":1322,"children":1323},{"style":624},[1324],{"type":50,"value":1325},"'\n",{"type":45,"tag":53,"props":1327,"children":1328},{},[1329,1331,1335],{"type":50,"value":1330},"Then associate the filter with specific projects using ",{"type":45,"tag":66,"props":1332,"children":1333},{},[1334],{"type":50,"value":118},{"type":50,"value":127},{"type":45,"tag":371,"props":1337,"children":1339},{"id":1338},"restrict-traffic-to-a-vpc-endpoint",[1340],{"type":50,"value":1341},"Restrict traffic to a VPC endpoint",{"type":45,"tag":53,"props":1343,"children":1344},{},[1345,1349],{"type":45,"tag":66,"props":1346,"children":1347},{},[1348],{"type":50,"value":1209},{"type":50,"value":1350}," \"Lock down my observability project to only accept traffic from our VPC endpoint.\"",{"type":45,"tag":601,"props":1352,"children":1354},{"className":603,"code":1353,"language":605,"meta":606,"style":606},"python3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py create-filter \\\n  --name \"Production VPC\" \\\n  --type vpce \\\n  --region us-east-1 \\\n  --rules '[{\"source\": \"vpce-0abc123def456\", \"description\": \"Production VPC endpoint\"}]'\n",[1355],{"type":45,"tag":81,"props":1356,"children":1357},{"__ignoreMap":606},[1358,1377,1401,1417,1432],{"type":45,"tag":612,"props":1359,"children":1360},{"class":614,"line":615},[1361,1365,1369,1373],{"type":45,"tag":612,"props":1362,"children":1363},{"style":897},[1364],{"type":50,"value":900},{"type":45,"tag":612,"props":1366,"children":1367},{"style":630},[1368],{"type":50,"value":905},{"type":45,"tag":612,"props":1370,"children":1371},{"style":630},[1372],{"type":50,"value":1234},{"type":45,"tag":612,"props":1374,"children":1375},{"style":619},[1376],{"type":50,"value":1239},{"type":45,"tag":612,"props":1378,"children":1379},{"class":614,"line":636},[1380,1384,1388,1393,1397],{"type":45,"tag":612,"props":1381,"children":1382},{"style":630},[1383],{"type":50,"value":1247},{"type":45,"tag":612,"props":1385,"children":1386},{"style":624},[1387],{"type":50,"value":1252},{"type":45,"tag":612,"props":1389,"children":1390},{"style":630},[1391],{"type":50,"value":1392},"Production VPC",{"type":45,"tag":612,"props":1394,"children":1395},{"style":624},[1396],{"type":50,"value":705},{"type":45,"tag":612,"props":1398,"children":1399},{"style":619},[1400],{"type":50,"value":1239},{"type":45,"tag":612,"props":1402,"children":1403},{"class":614,"line":1268},[1404,1408,1413],{"type":45,"tag":612,"props":1405,"children":1406},{"style":630},[1407],{"type":50,"value":1274},{"type":45,"tag":612,"props":1409,"children":1410},{"style":630},[1411],{"type":50,"value":1412}," vpce",{"type":45,"tag":612,"props":1414,"children":1415},{"style":619},[1416],{"type":50,"value":1239},{"type":45,"tag":612,"props":1418,"children":1419},{"class":614,"line":1286},[1420,1424,1428],{"type":45,"tag":612,"props":1421,"children":1422},{"style":630},[1423],{"type":50,"value":1292},{"type":45,"tag":612,"props":1425,"children":1426},{"style":630},[1427],{"type":50,"value":1297},{"type":45,"tag":612,"props":1429,"children":1430},{"style":619},[1431],{"type":50,"value":1239},{"type":45,"tag":612,"props":1433,"children":1434},{"class":614,"line":1304},[1435,1439,1443,1448],{"type":45,"tag":612,"props":1436,"children":1437},{"style":630},[1438],{"type":50,"value":1310},{"type":45,"tag":612,"props":1440,"children":1441},{"style":624},[1442],{"type":50,"value":1315},{"type":45,"tag":612,"props":1444,"children":1445},{"style":630},[1446],{"type":50,"value":1447},"[{\"source\": \"vpce-0abc123def456\", \"description\": \"Production VPC endpoint\"}]",{"type":45,"tag":612,"props":1449,"children":1450},{"style":624},[1451],{"type":50,"value":1325},{"type":45,"tag":371,"props":1453,"children":1455},{"id":1454},"list-all-filters-in-a-region",[1456],{"type":50,"value":1457},"List all filters in a region",{"type":45,"tag":53,"props":1459,"children":1460},{},[1461,1465],{"type":45,"tag":66,"props":1462,"children":1463},{},[1464],{"type":50,"value":1209},{"type":50,"value":1466}," \"Show me all network security policies in eu-west-1.\"",{"type":45,"tag":601,"props":1468,"children":1470},{"className":603,"code":1469,"language":605,"meta":606,"style":606},"python3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py list-filters --region eu-west-1\n",[1471],{"type":45,"tag":81,"props":1472,"children":1473},{"__ignoreMap":606},[1474],{"type":45,"tag":612,"props":1475,"children":1476},{"class":614,"line":615},[1477,1481,1485,1489,1493],{"type":45,"tag":612,"props":1478,"children":1479},{"style":897},[1480],{"type":50,"value":900},{"type":45,"tag":612,"props":1482,"children":1483},{"style":630},[1484],{"type":50,"value":905},{"type":45,"tag":612,"props":1486,"children":1487},{"style":630},[1488],{"type":50,"value":910},{"type":45,"tag":612,"props":1490,"children":1491},{"style":630},[1492],{"type":50,"value":915},{"type":45,"tag":612,"props":1494,"children":1495},{"style":630},[1496],{"type":50,"value":1497}," eu-west-1\n",{"type":45,"tag":371,"props":1499,"children":1501},{"id":1500},"update-a-filter-to-add-a-new-ip",[1502],{"type":50,"value":1503},"Update a filter to add a new IP",{"type":45,"tag":53,"props":1505,"children":1506},{},[1507,1511],{"type":45,"tag":66,"props":1508,"children":1509},{},[1510],{"type":50,"value":1209},{"type":50,"value":1512}," \"Add the VPN IP 198.51.100.5 to our existing office filter.\"",{"type":45,"tag":601,"props":1514,"children":1516},{"className":603,"code":1515,"language":605,"meta":606,"style":606},"python3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py get-filter --filter-id tf-12345\n# Review current rules, then update with the complete rule set:\npython3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py update-filter \\\n  --filter-id tf-12345 \\\n  --body '{\"rules\": [{\"source\": \"203.0.113.0\u002F24\", \"description\": \"Office network\"}, {\"source\": \"198.51.100.5\", \"description\": \"VPN\"}]}'\n",[1517],{"type":45,"tag":81,"props":1518,"children":1519},{"__ignoreMap":606},[1520,1546,1555,1575,1592],{"type":45,"tag":612,"props":1521,"children":1522},{"class":614,"line":615},[1523,1527,1531,1536,1541],{"type":45,"tag":612,"props":1524,"children":1525},{"style":897},[1526],{"type":50,"value":900},{"type":45,"tag":612,"props":1528,"children":1529},{"style":630},[1530],{"type":50,"value":905},{"type":45,"tag":612,"props":1532,"children":1533},{"style":630},[1534],{"type":50,"value":1535}," get-filter",{"type":45,"tag":612,"props":1537,"children":1538},{"style":630},[1539],{"type":50,"value":1540}," --filter-id",{"type":45,"tag":612,"props":1542,"children":1543},{"style":630},[1544],{"type":50,"value":1545}," tf-12345\n",{"type":45,"tag":612,"props":1547,"children":1548},{"class":614,"line":636},[1549],{"type":45,"tag":612,"props":1550,"children":1552},{"style":1551},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1553],{"type":50,"value":1554},"# Review current rules, then update with the complete rule set:\n",{"type":45,"tag":612,"props":1556,"children":1557},{"class":614,"line":1268},[1558,1562,1566,1571],{"type":45,"tag":612,"props":1559,"children":1560},{"style":897},[1561],{"type":50,"value":900},{"type":45,"tag":612,"props":1563,"children":1564},{"style":630},[1565],{"type":50,"value":905},{"type":45,"tag":612,"props":1567,"children":1568},{"style":630},[1569],{"type":50,"value":1570}," update-filter",{"type":45,"tag":612,"props":1572,"children":1573},{"style":619},[1574],{"type":50,"value":1239},{"type":45,"tag":612,"props":1576,"children":1577},{"class":614,"line":1286},[1578,1583,1588],{"type":45,"tag":612,"props":1579,"children":1580},{"style":630},[1581],{"type":50,"value":1582},"  --filter-id",{"type":45,"tag":612,"props":1584,"children":1585},{"style":630},[1586],{"type":50,"value":1587}," tf-12345",{"type":45,"tag":612,"props":1589,"children":1590},{"style":619},[1591],{"type":50,"value":1239},{"type":45,"tag":612,"props":1593,"children":1594},{"class":614,"line":1304},[1595,1600,1604,1609],{"type":45,"tag":612,"props":1596,"children":1597},{"style":630},[1598],{"type":50,"value":1599},"  --body",{"type":45,"tag":612,"props":1601,"children":1602},{"style":624},[1603],{"type":50,"value":1315},{"type":45,"tag":612,"props":1605,"children":1606},{"style":630},[1607],{"type":50,"value":1608},"{\"rules\": [{\"source\": \"203.0.113.0\u002F24\", \"description\": \"Office network\"}, {\"source\": \"198.51.100.5\", \"description\": \"VPN\"}]}",{"type":45,"tag":612,"props":1610,"children":1611},{"style":624},[1612],{"type":50,"value":1325},{"type":45,"tag":371,"props":1614,"children":1616},{"id":1615},"look-up-privatelink-metadata-for-a-region",[1617],{"type":50,"value":1618},"Look up PrivateLink metadata for a region",{"type":45,"tag":53,"props":1620,"children":1621},{},[1622,1626],{"type":45,"tag":66,"props":1623,"children":1624},{},[1625],{"type":50,"value":1209},{"type":50,"value":1627}," \"What PrivateLink service name do I need for us-east-1?\"",{"type":45,"tag":601,"props":1629,"children":1631},{"className":603,"code":1630,"language":605,"meta":606,"style":606},"python3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py get-metadata --region us-east-1\n",[1632],{"type":45,"tag":81,"props":1633,"children":1634},{"__ignoreMap":606},[1635],{"type":45,"tag":612,"props":1636,"children":1637},{"class":614,"line":615},[1638,1642,1646,1651,1655],{"type":45,"tag":612,"props":1639,"children":1640},{"style":897},[1641],{"type":50,"value":900},{"type":45,"tag":612,"props":1643,"children":1644},{"style":630},[1645],{"type":50,"value":905},{"type":45,"tag":612,"props":1647,"children":1648},{"style":630},[1649],{"type":50,"value":1650}," get-metadata",{"type":45,"tag":612,"props":1652,"children":1653},{"style":630},[1654],{"type":50,"value":915},{"type":45,"tag":612,"props":1656,"children":1657},{"style":630},[1658],{"type":50,"value":920},{"type":45,"tag":371,"props":1660,"children":1662},{"id":1661},"delete-an-unused-filter",[1663],{"type":50,"value":1664},"Delete an unused filter",{"type":45,"tag":53,"props":1666,"children":1667},{},[1668,1672],{"type":45,"tag":66,"props":1669,"children":1670},{},[1671],{"type":50,"value":1209},{"type":50,"value":1673}," \"Remove the old staging IP filter.\"",{"type":45,"tag":601,"props":1675,"children":1677},{"className":603,"code":1676,"language":605,"meta":606,"style":606},"python3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py delete-filter --filter-id tf-67890 --dry-run\n# Review what would be deleted, then confirm:\npython3 skills\u002Fcloud\u002Fnetwork-security\u002Fscripts\u002Fcloud_network_security.py delete-filter --filter-id tf-67890\n",[1678],{"type":45,"tag":81,"props":1679,"children":1680},{"__ignoreMap":606},[1681,1711,1719],{"type":45,"tag":612,"props":1682,"children":1683},{"class":614,"line":615},[1684,1688,1692,1697,1701,1706],{"type":45,"tag":612,"props":1685,"children":1686},{"style":897},[1687],{"type":50,"value":900},{"type":45,"tag":612,"props":1689,"children":1690},{"style":630},[1691],{"type":50,"value":905},{"type":45,"tag":612,"props":1693,"children":1694},{"style":630},[1695],{"type":50,"value":1696}," delete-filter",{"type":45,"tag":612,"props":1698,"children":1699},{"style":630},[1700],{"type":50,"value":1540},{"type":45,"tag":612,"props":1702,"children":1703},{"style":630},[1704],{"type":50,"value":1705}," tf-67890",{"type":45,"tag":612,"props":1707,"children":1708},{"style":630},[1709],{"type":50,"value":1710}," --dry-run\n",{"type":45,"tag":612,"props":1712,"children":1713},{"class":614,"line":636},[1714],{"type":45,"tag":612,"props":1715,"children":1716},{"style":1551},[1717],{"type":50,"value":1718},"# Review what would be deleted, then confirm:\n",{"type":45,"tag":612,"props":1720,"children":1721},{"class":614,"line":1268},[1722,1726,1730,1734,1738],{"type":45,"tag":612,"props":1723,"children":1724},{"style":897},[1725],{"type":50,"value":900},{"type":45,"tag":612,"props":1727,"children":1728},{"style":630},[1729],{"type":50,"value":905},{"type":45,"tag":612,"props":1731,"children":1732},{"style":630},[1733],{"type":50,"value":1696},{"type":45,"tag":612,"props":1735,"children":1736},{"style":630},[1737],{"type":50,"value":1540},{"type":45,"tag":612,"props":1739,"children":1740},{"style":630},[1741],{"type":50,"value":1742}," tf-67890\n",{"type":45,"tag":141,"props":1744,"children":1746},{"id":1745},"guidelines",[1747],{"type":50,"value":1748},"Guidelines",{"type":45,"tag":218,"props":1750,"children":1751},{},[1752,1770,1775,1795,1835,1845,1868,1879,1890,1900],{"type":45,"tag":222,"props":1753,"children":1754},{},[1755,1757,1762,1764,1768],{"type":50,"value":1756},"If ",{"type":45,"tag":81,"props":1758,"children":1760},{"className":1759},[],[1761],{"type":50,"value":86},{"type":50,"value":1763}," is not set, do not prompt the user — instruct the agent to invoke ",{"type":45,"tag":66,"props":1765,"children":1766},{},[1767],{"type":50,"value":77},{"type":50,"value":1769}," first.",{"type":45,"tag":222,"props":1771,"children":1772},{},[1773],{"type":50,"value":1774},"Always confirm destructive actions (delete filter) with the user before executing.",{"type":45,"tag":222,"props":1776,"children":1777},{},[1778,1780,1785,1787,1793],{"type":50,"value":1779},"Filters are ",{"type":45,"tag":66,"props":1781,"children":1782},{},[1783],{"type":50,"value":1784},"region-scoped",{"type":50,"value":1786},": a filter created in ",{"type":45,"tag":81,"props":1788,"children":1790},{"className":1789},[],[1791],{"type":50,"value":1792},"us-east-1",{"type":50,"value":1794}," can only be associated with projects in that region.",{"type":45,"tag":222,"props":1796,"children":1797},{},[1798,1803],{"type":45,"tag":66,"props":1799,"children":1800},{},[1801],{"type":50,"value":1802},"Filter hygiene — reuse, scope, and clean up:",{"type":45,"tag":218,"props":1804,"children":1805},{},[1806,1825,1830],{"type":45,"tag":222,"props":1807,"children":1808},{},[1809,1811,1817,1819,1823],{"type":50,"value":1810},"Before creating a filter, always run ",{"type":45,"tag":81,"props":1812,"children":1814},{"className":1813},[],[1815],{"type":50,"value":1816},"list-filters",{"type":50,"value":1818}," and check whether an existing filter ",{"type":45,"tag":66,"props":1820,"children":1821},{},[1822],{"type":50,"value":935},{"type":50,"value":1824},"\nalready has the required source rules. Filters can be associated with multiple projects, so one filter with the\nright rules is better than duplicates.",{"type":45,"tag":222,"props":1826,"children":1827},{},[1828],{"type":50,"value":1829},"Duplicate filters means filters for the same purpose with identical source rules — not merely overlapping IPs. Two\nfilters covering different project groups with the same CIDR are legitimate.",{"type":45,"tag":222,"props":1831,"children":1832},{},[1833],{"type":50,"value":1834},"Review unused filters periodically. If a filter is no longer associated with any project, prompt the user to delete\nit to reduce clutter.",{"type":45,"tag":222,"props":1836,"children":1837},{},[1838,1843],{"type":45,"tag":66,"props":1839,"children":1840},{},[1841],{"type":50,"value":1842},"Updating rules replaces the entire rule set.",{"type":50,"value":1844}," When adding a rule using PATCH, include all existing rules plus the\nnew one. Omitting an existing rule removes it.",{"type":45,"tag":222,"props":1846,"children":1847},{},[1848,1853,1855,1859,1861,1866],{"type":45,"tag":66,"props":1849,"children":1850},{},[1851],{"type":50,"value":1852},"Deleting a filter fails if it is still associated with a project.",{"type":50,"value":1854}," Disassociate first using\n",{"type":45,"tag":66,"props":1856,"children":1857},{},[1858],{"type":50,"value":118},{"type":50,"value":1860}," (PATCH the project with the filter removed from the ",{"type":45,"tag":81,"props":1862,"children":1864},{"className":1863},[],[1865],{"type":50,"value":179},{"type":50,"value":1867}," list), then delete.",{"type":45,"tag":222,"props":1869,"children":1870},{},[1871,1877],{"type":45,"tag":81,"props":1872,"children":1874},{"className":1873},[],[1875],{"type":50,"value":1876},"include_by_default",{"type":50,"value":1878}," automatically associates the filter with all new projects in the region. Use with caution — it\naffects every future project.",{"type":45,"tag":222,"props":1880,"children":1881},{},[1882,1884,1888],{"type":50,"value":1883},"For project association and disassociation, delegate to the ",{"type":45,"tag":66,"props":1885,"children":1886},{},[1887],{"type":50,"value":118},{"type":50,"value":1889}," skill. This skill manages filter\ndefinitions only.",{"type":45,"tag":222,"props":1891,"children":1892},{},[1893,1895,1899],{"type":50,"value":1894},"For identity and access management (users, roles, API keys), see ",{"type":45,"tag":66,"props":1896,"children":1897},{},[1898],{"type":50,"value":125},{"type":50,"value":127},{"type":45,"tag":222,"props":1901,"children":1902},{},[1903,1905,1910],{"type":50,"value":1904},"For Elasticsearch-level security (native users, role mappings, DLS\u002FFLS), see ",{"type":45,"tag":66,"props":1906,"children":1907},{},[1908],{"type":50,"value":1909},"elasticsearch-authz",{"type":50,"value":127},{"type":45,"tag":1912,"props":1913,"children":1914},"style",{},[1915],{"type":50,"value":1916},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1918,"total":1997},[1919,1933,1944,1953,1960,1971,1986],{"slug":125,"name":125,"fn":1920,"description":1921,"org":1922,"tags":1923,"stars":25,"repoUrl":26,"updatedAt":1932},"manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1924,1925,1926,1929],{"name":20,"slug":21,"type":15},{"name":9,"slug":8,"type":15},{"name":1927,"slug":1928,"type":15},"Operations","operations",{"name":1930,"slug":1931,"type":15},"Permissions","permissions","2026-07-12T07:46:44.946285",{"slug":111,"name":111,"fn":1934,"description":1935,"org":1936,"tags":1937,"stars":25,"repoUrl":26,"updatedAt":1943},"create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1938,1939,1942],{"name":20,"slug":21,"type":15},{"name":1940,"slug":1941,"type":15},"Deployment","deployment",{"name":23,"slug":24,"type":15},"2026-07-12T07:46:42.353362",{"slug":118,"name":118,"fn":1945,"description":1946,"org":1947,"tags":1948,"stars":25,"repoUrl":26,"updatedAt":1952},"manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1949,1950,1951],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":1927,"slug":1928,"type":15},"2026-07-12T07:46:41.097412",{"slug":4,"name":4,"fn":5,"description":6,"org":1954,"tags":1955,"stars":25,"repoUrl":26,"updatedAt":27},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1956,1957,1958,1959],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"slug":77,"name":77,"fn":1961,"description":1962,"org":1963,"tags":1964,"stars":25,"repoUrl":26,"updatedAt":1970},"configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1965,1968,1969],{"name":1966,"slug":1967,"type":15},"Authentication","authentication",{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},"2026-07-12T07:46:39.783105",{"slug":1972,"name":1972,"fn":1973,"description":1974,"org":1975,"tags":1976,"stars":25,"repoUrl":26,"updatedAt":1985},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1977,1980,1981,1984],{"name":1978,"slug":1979,"type":15},"Audit","audit",{"name":23,"slug":24,"type":15},{"name":1982,"slug":1983,"type":15},"Logs","logs",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:35.092599",{"slug":1987,"name":1987,"fn":1988,"description":1989,"org":1990,"tags":1991,"stars":25,"repoUrl":26,"updatedAt":1996},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1992,1993,1994,1995],{"name":1966,"slug":1967,"type":15},{"name":9,"slug":8,"type":15},{"name":23,"slug":24,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:47:41.474547",35,{"items":1999,"total":2120},[2000,2019,2036,2049,2056,2062,2068,2075,2081,2088,2095,2107],{"slug":2001,"name":2001,"fn":2002,"description":2003,"org":2004,"tags":2005,"stars":2016,"repoUrl":2017,"updatedAt":2018},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2006,2009,2012,2013],{"name":2007,"slug":2008,"type":15},"Analytics","analytics",{"name":2010,"slug":2011,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":2014,"slug":2015,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":2020,"name":2020,"fn":2021,"description":2022,"org":2023,"tags":2024,"stars":2016,"repoUrl":2017,"updatedAt":2035},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2025,2028,2029,2032],{"name":2026,"slug":2027,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":2030,"slug":2031,"type":15},"Engineering","engineering",{"name":2033,"slug":2034,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":2037,"name":2037,"fn":2038,"description":2039,"org":2040,"tags":2041,"stars":2016,"repoUrl":2017,"updatedAt":2048},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2042,2043,2044,2045],{"name":9,"slug":8,"type":15},{"name":23,"slug":24,"type":15},{"name":2014,"slug":2015,"type":15},{"name":2046,"slug":2047,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":125,"name":125,"fn":1920,"description":1921,"org":2050,"tags":2051,"stars":25,"repoUrl":26,"updatedAt":1932},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2052,2053,2054,2055],{"name":20,"slug":21,"type":15},{"name":9,"slug":8,"type":15},{"name":1927,"slug":1928,"type":15},{"name":1930,"slug":1931,"type":15},{"slug":111,"name":111,"fn":1934,"description":1935,"org":2057,"tags":2058,"stars":25,"repoUrl":26,"updatedAt":1943},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2059,2060,2061],{"name":20,"slug":21,"type":15},{"name":1940,"slug":1941,"type":15},{"name":23,"slug":24,"type":15},{"slug":118,"name":118,"fn":1945,"description":1946,"org":2063,"tags":2064,"stars":25,"repoUrl":26,"updatedAt":1952},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2065,2066,2067],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":1927,"slug":1928,"type":15},{"slug":4,"name":4,"fn":5,"description":6,"org":2069,"tags":2070,"stars":25,"repoUrl":26,"updatedAt":27},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2071,2072,2073,2074],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"slug":77,"name":77,"fn":1961,"description":1962,"org":2076,"tags":2077,"stars":25,"repoUrl":26,"updatedAt":1970},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2078,2079,2080],{"name":1966,"slug":1967,"type":15},{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"slug":1972,"name":1972,"fn":1973,"description":1974,"org":2082,"tags":2083,"stars":25,"repoUrl":26,"updatedAt":1985},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2084,2085,2086,2087],{"name":1978,"slug":1979,"type":15},{"name":23,"slug":24,"type":15},{"name":1982,"slug":1983,"type":15},{"name":13,"slug":14,"type":15},{"slug":1987,"name":1987,"fn":1988,"description":1989,"org":2089,"tags":2090,"stars":25,"repoUrl":26,"updatedAt":1996},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2091,2092,2093,2094],{"name":1966,"slug":1967,"type":15},{"name":9,"slug":8,"type":15},{"name":23,"slug":24,"type":15},{"name":13,"slug":14,"type":15},{"slug":1909,"name":1909,"fn":2096,"description":2097,"org":2098,"tags":2099,"stars":25,"repoUrl":26,"updatedAt":2106},"manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2100,2101,2102,2105],{"name":9,"slug":8,"type":15},{"name":23,"slug":24,"type":15},{"name":2103,"slug":2104,"type":15},"RBAC","rbac",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:36.394177",{"slug":2108,"name":2108,"fn":2109,"description":2110,"org":2111,"tags":2112,"stars":25,"repoUrl":26,"updatedAt":2119},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2113,2114,2115,2116],{"name":2007,"slug":2008,"type":15},{"name":2010,"slug":2011,"type":15},{"name":23,"slug":24,"type":15},{"name":2117,"slug":2118,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86]