[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-create-integration":3,"mdc--gn5xfv-key":30,"related-org-elastic-create-integration":1029,"related-repo-elastic-create-integration":1199},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":19,"repoUrl":20,"updatedAt":21,"license":22,"forks":23,"topics":24,"repo":25,"sourceUrl":28,"mdContent":29},"create-integration","create Elastic integration packages","Use when creating a new Elastic integration package, scaffolding data streams, answering package layout or structure questions, or running the end-to-end integration build workflow. Covers package topology, scaffold commands, post-scaffold edits, and full orchestration of CEL\u002Fpipeline\u002Ftest subagents.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16],{"name":13,"slug":14,"type":15},"Integrations","integrations","tag",{"name":17,"slug":18,"type":15},"Elasticsearch","elasticsearch",11,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegration-skills","2026-07-12T07:46:56.318866","Apache-2.0",2,[],{"repoUrl":20,"stars":19,"forks":23,"topics":26,"description":27},[],null,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegration-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fcreate-integration","---\nname: create-integration\ndescription: \"Use when creating a new Elastic integration package, scaffolding data streams, answering package layout or structure questions, or running the end-to-end integration build workflow. Covers package topology, scaffold commands, post-scaffold edits, and full orchestration of CEL\u002Fpipeline\u002Ftest subagents.\"\nlicense: Apache-2.0\nmetadata:\n  author: elastic\n  version: \"1.0\"\n---\n\n# create-integration\n\n## When to use\n\nUse this skill when tasks include:\n- creating a new integration package from scratch\n- scaffolding data streams and applying post-scaffold edits\n- understanding package topology, file placement, and manifest patterns\n- running the end-to-end build workflow (scaffold → data collection setup → pipeline → system tests → review)\n- questions about package structure, layout, or `manifest.yml` shape\n\n## IMPORTANT: Loading references\n\nThis skill has four reference files. Load the appropriate one(s) based on your task:\n\n**When creating a full integration (end-to-end):**\n→ **MUST read `references\u002Fcreate-workflow.md` fully before starting.** This contains the complete orchestration workflow, all phases, subagent delegation instructions, and guardrails.\n\n**When adding data streams to an existing package:**\n→ **MUST read `references\u002Fadd-datastream-workflow.md` fully before starting.** This covers verifying the package, scaffolding streams, and the CEL → pipeline → system-test sequence.\n\n**When scaffolding a package or data stream, or applying post-scaffold edits:**\n→ Read `references\u002Fscaffold-commands.md` for the scaffold commands, post-scaffold checklist, and common pitfalls.\n\n**When reviewing or understanding package topology and file layout:**\n→ Read `references\u002Fpackage-layout.md` for canonical trees, manifest patterns, and review checklists for both integration and input packages.\n\n## What to provide when creating an integration\n\nInclude any combination of the following:\n\n| Input | How to provide | Examples |\n|-------|----------------|----------|\n| Package name | free text | `my_vendor` |\n| Product \u002F vendor | free text | \"Acme Firewall appliance\" |\n| Data delivery method | free text | \"REST API with pagination\", \"syslog over TCP\u002FUDP\", \"S3 bucket\" |\n| API \u002F log documentation | paste URLs | `https:\u002F\u002Fdocs.acme.com\u002Fapi\u002Fv2` |\n| Sample data | `@`-mention files | `@samples\u002Facme_event.json` |\n| Research brief | `@`-mention file | `@notes\u002Facme-research-brief.md` |\n| Constraints | free text | \"CEL input only\", \"single data stream\" |\n\n### Example invocations\n\n```\nCreate a new \"acme_firewall\" integration for Acme Firewall appliance.\n  API docs: https:\u002F\u002Fdocs.acme.com\u002Fapi\u002Fv2\u002Fevents\n  Auth: Bearer token header. Pagination: offset-based with total_count.\n  @samples\u002Facme_events.json. Single data stream \"event\" using cel input.\n```\n\n```\nNew syslog integration \"my_appliance\" with tcp,udp inputs.\n  @notes\u002Fresearch-brief.md. Two streams: \"log\" (syslog) and \"traffic\" (syslog).\n```\n\n## What to provide when adding data streams to an existing package\n\nUse `@`-mentions for files\u002Ffolders and paste links inline.\n\n| Input | How to provide | Examples |\n|-------|----------------|----------|\n| Target package | free text or `@`-mention | `acme_firewall`, `@packages\u002Facme_firewall` |\n| Stream name | free text | `audit`, `traffic`, `alert` |\n| Stream type | free text | `logs` (default) or `metrics` |\n| Input type(s) | free text | `cel`, `tcp,udp`, `filestream`, `http_endpoint`, `aws-s3` |\n| API \u002F log docs | paste URLs | `https:\u002F\u002Fdocs.acme.com\u002Fapi\u002Faudit` |\n| Sample data | `@`-mention files | `@samples\u002Faudit_event.json`, `@samples\u002Ftraffic.log` |\n| Research brief | `@`-mention file | `@notes\u002Facme-audit-brief.md` |\n| Constraints | free text | \"reuse package-level auth vars\", \"separate pipeline per event type\" |\n| Acceptance criteria | free text | \"parse all syslog fields, map to ECS\" |\n\n### Example invocations\n\n```\nAdd \"audit\" stream to @packages\u002Facme_firewall using cel input.\n  API endpoint: \u002Fapi\u002Fv2\u002Faudit_logs\n  Pagination: timestamp cursor.\n  @samples\u002Facme_audit.json\n```\n\n```\nAdd \"traffic\" and \"threat\" streams to acme_firewall.\n  Both use tcp,udp inputs (syslog).\n  @samples\u002Ftraffic.log @samples\u002Fthreat.log\n```\n\n## Subagents overview\n\nDo **not** load CEL, pipeline, ECS, or field-mapping skills yourself. Delegate to subagents that load their own domain skills.\n\nAll specialised work is delegated to the platform's **generic \u002F general-purpose subagent** (Cursor: `generalPurpose` Task agent; Claude Code: `general-purpose` Task agent; or the equivalent on other platforms). Each task prompt must **point the subagent at the relevant `*-subagent-guidance.md` file by path** and instruct it to read that file (plus the skill SKILL.md it lists in \"First steps\") end-to-end before doing any other work. **Do NOT read the guidance file yourself or paste its contents into the task prompt** — that doubles its context cost. Pass only the path plus the task-specific context. The subagent will load the manual itself in its own fresh context. Full dispatch rules and per-step detail live in `references\u002Fcreate-workflow.md` and `references\u002Fadd-datastream-workflow.md`.\n\n| Subagent guidance file | When to use |\n|----------|-------------|\n| `\u002Fresearch-integration` skill (orchestrates its own research subagents) | Vendor\u002FAPI research before building, when no research brief is provided |\n| `cel-programs\u002Freferences\u002Fbuilder-subagent-guidance.md` | Each CEL data stream — mock API, CEL program (incremental mito build), `cel.yml.hbs` template, manifest vars, initial field mappings |\n| `integration-testing\u002Freferences\u002Fbuilder-setup-subagent-guidance.md` | Each non-CEL data stream — data collection setup (docker-compose, sample logs, agent stream template, system test config, manifest var cleanup) |\n| `ingest-pipelines\u002Freferences\u002Fbuilder-subagent-guidance.md` | Each data stream's pipeline and field definitions |\n| `integration-testing\u002Freferences\u002Fbuilder-system-test-subagent-guidance.md` | System test execution after pipeline work completes, for any testable input (CEL, tcp, udp, http_endpoint, logfile, kafka, pubsub) |\n| `review-integration\u002Freferences\u002Freviewer-subagent-guidance.md` | Quality review after all streams are built — classifies files by domain, loads relevant domain skills and checklists via the `review-integration` skill, returns severity-ranked, domain-tagged findings |\n\nFor **cloud storage inputs** (aws-s3, gcs, azure-blob-storage, azure-eventhub): skip data collection setup and system tests. The scaffold provides a usable template; trim vars to match needs. See `references\u002Fcreate-workflow.md` for details.\n\n## References\n\n- `references\u002Fcreate-workflow.md` — full phases 1–8 for creating a new integration, subagent instructions, guardrails, data anonymization\n- `references\u002Fadd-datastream-workflow.md` — phases 1–4 for adding data streams to an existing package, CEL\u002Fpipeline\u002Fsystem-test sequence\n- `references\u002Fscaffold-commands.md` — scaffold commands, post-scaffold edits, base-fields.yml format\n- `references\u002Fpackage-layout.md` — integration and input package topology, manifest patterns\n",{"data":31,"body":34},{"name":4,"description":6,"license":22,"metadata":32},{"author":8,"version":33},"1.0",{"type":35,"children":36},"root",[37,44,51,57,96,102,107,133,155,173,190,196,201,384,391,403,412,418,430,715,720,729,738,744,756,820,961,980,986],{"type":38,"tag":39,"props":40,"children":41},"element","h1",{"id":4},[42],{"type":43,"value":4},"text",{"type":38,"tag":45,"props":46,"children":48},"h2",{"id":47},"when-to-use",[49],{"type":43,"value":50},"When to use",{"type":38,"tag":52,"props":53,"children":54},"p",{},[55],{"type":43,"value":56},"Use this skill when tasks include:",{"type":38,"tag":58,"props":59,"children":60},"ul",{},[61,67,72,77,82],{"type":38,"tag":62,"props":63,"children":64},"li",{},[65],{"type":43,"value":66},"creating a new integration package from scratch",{"type":38,"tag":62,"props":68,"children":69},{},[70],{"type":43,"value":71},"scaffolding data streams and applying post-scaffold edits",{"type":38,"tag":62,"props":73,"children":74},{},[75],{"type":43,"value":76},"understanding package topology, file placement, and manifest patterns",{"type":38,"tag":62,"props":78,"children":79},{},[80],{"type":43,"value":81},"running the end-to-end build workflow (scaffold → data collection setup → pipeline → system tests → review)",{"type":38,"tag":62,"props":83,"children":84},{},[85,87,94],{"type":43,"value":86},"questions about package structure, layout, or ",{"type":38,"tag":88,"props":89,"children":91},"code",{"className":90},[],[92],{"type":43,"value":93},"manifest.yml",{"type":43,"value":95}," shape",{"type":38,"tag":45,"props":97,"children":99},{"id":98},"important-loading-references",[100],{"type":43,"value":101},"IMPORTANT: Loading references",{"type":38,"tag":52,"props":103,"children":104},{},[105],{"type":43,"value":106},"This skill has four reference files. Load the appropriate one(s) based on your task:",{"type":38,"tag":52,"props":108,"children":109},{},[110,116,118,131],{"type":38,"tag":111,"props":112,"children":113},"strong",{},[114],{"type":43,"value":115},"When creating a full integration (end-to-end):",{"type":43,"value":117},"\n→ ",{"type":38,"tag":111,"props":119,"children":120},{},[121,123,129],{"type":43,"value":122},"MUST read ",{"type":38,"tag":88,"props":124,"children":126},{"className":125},[],[127],{"type":43,"value":128},"references\u002Fcreate-workflow.md",{"type":43,"value":130}," fully before starting.",{"type":43,"value":132}," This contains the complete orchestration workflow, all phases, subagent delegation instructions, and guardrails.",{"type":38,"tag":52,"props":134,"children":135},{},[136,141,142,153],{"type":38,"tag":111,"props":137,"children":138},{},[139],{"type":43,"value":140},"When adding data streams to an existing package:",{"type":43,"value":117},{"type":38,"tag":111,"props":143,"children":144},{},[145,146,152],{"type":43,"value":122},{"type":38,"tag":88,"props":147,"children":149},{"className":148},[],[150],{"type":43,"value":151},"references\u002Fadd-datastream-workflow.md",{"type":43,"value":130},{"type":43,"value":154}," This covers verifying the package, scaffolding streams, and the CEL → pipeline → system-test sequence.",{"type":38,"tag":52,"props":156,"children":157},{},[158,163,165,171],{"type":38,"tag":111,"props":159,"children":160},{},[161],{"type":43,"value":162},"When scaffolding a package or data stream, or applying post-scaffold edits:",{"type":43,"value":164},"\n→ Read ",{"type":38,"tag":88,"props":166,"children":168},{"className":167},[],[169],{"type":43,"value":170},"references\u002Fscaffold-commands.md",{"type":43,"value":172}," for the scaffold commands, post-scaffold checklist, and common pitfalls.",{"type":38,"tag":52,"props":174,"children":175},{},[176,181,182,188],{"type":38,"tag":111,"props":177,"children":178},{},[179],{"type":43,"value":180},"When reviewing or understanding package topology and file layout:",{"type":43,"value":164},{"type":38,"tag":88,"props":183,"children":185},{"className":184},[],[186],{"type":43,"value":187},"references\u002Fpackage-layout.md",{"type":43,"value":189}," for canonical trees, manifest patterns, and review checklists for both integration and input packages.",{"type":38,"tag":45,"props":191,"children":193},{"id":192},"what-to-provide-when-creating-an-integration",[194],{"type":43,"value":195},"What to provide when creating an integration",{"type":38,"tag":52,"props":197,"children":198},{},[199],{"type":43,"value":200},"Include any combination of the following:",{"type":38,"tag":202,"props":203,"children":204},"table",{},[205,229],{"type":38,"tag":206,"props":207,"children":208},"thead",{},[209],{"type":38,"tag":210,"props":211,"children":212},"tr",{},[213,219,224],{"type":38,"tag":214,"props":215,"children":216},"th",{},[217],{"type":43,"value":218},"Input",{"type":38,"tag":214,"props":220,"children":221},{},[222],{"type":43,"value":223},"How to provide",{"type":38,"tag":214,"props":225,"children":226},{},[227],{"type":43,"value":228},"Examples",{"type":38,"tag":230,"props":231,"children":232},"tbody",{},[233,256,273,290,312,340,367],{"type":38,"tag":210,"props":234,"children":235},{},[236,242,247],{"type":38,"tag":237,"props":238,"children":239},"td",{},[240],{"type":43,"value":241},"Package name",{"type":38,"tag":237,"props":243,"children":244},{},[245],{"type":43,"value":246},"free text",{"type":38,"tag":237,"props":248,"children":249},{},[250],{"type":38,"tag":88,"props":251,"children":253},{"className":252},[],[254],{"type":43,"value":255},"my_vendor",{"type":38,"tag":210,"props":257,"children":258},{},[259,264,268],{"type":38,"tag":237,"props":260,"children":261},{},[262],{"type":43,"value":263},"Product \u002F vendor",{"type":38,"tag":237,"props":265,"children":266},{},[267],{"type":43,"value":246},{"type":38,"tag":237,"props":269,"children":270},{},[271],{"type":43,"value":272},"\"Acme Firewall appliance\"",{"type":38,"tag":210,"props":274,"children":275},{},[276,281,285],{"type":38,"tag":237,"props":277,"children":278},{},[279],{"type":43,"value":280},"Data delivery method",{"type":38,"tag":237,"props":282,"children":283},{},[284],{"type":43,"value":246},{"type":38,"tag":237,"props":286,"children":287},{},[288],{"type":43,"value":289},"\"REST API with pagination\", \"syslog over TCP\u002FUDP\", \"S3 bucket\"",{"type":38,"tag":210,"props":291,"children":292},{},[293,298,303],{"type":38,"tag":237,"props":294,"children":295},{},[296],{"type":43,"value":297},"API \u002F log documentation",{"type":38,"tag":237,"props":299,"children":300},{},[301],{"type":43,"value":302},"paste URLs",{"type":38,"tag":237,"props":304,"children":305},{},[306],{"type":38,"tag":88,"props":307,"children":309},{"className":308},[],[310],{"type":43,"value":311},"https:\u002F\u002Fdocs.acme.com\u002Fapi\u002Fv2",{"type":38,"tag":210,"props":313,"children":314},{},[315,320,331],{"type":38,"tag":237,"props":316,"children":317},{},[318],{"type":43,"value":319},"Sample data",{"type":38,"tag":237,"props":321,"children":322},{},[323,329],{"type":38,"tag":88,"props":324,"children":326},{"className":325},[],[327],{"type":43,"value":328},"@",{"type":43,"value":330},"-mention files",{"type":38,"tag":237,"props":332,"children":333},{},[334],{"type":38,"tag":88,"props":335,"children":337},{"className":336},[],[338],{"type":43,"value":339},"@samples\u002Facme_event.json",{"type":38,"tag":210,"props":341,"children":342},{},[343,348,358],{"type":38,"tag":237,"props":344,"children":345},{},[346],{"type":43,"value":347},"Research brief",{"type":38,"tag":237,"props":349,"children":350},{},[351,356],{"type":38,"tag":88,"props":352,"children":354},{"className":353},[],[355],{"type":43,"value":328},{"type":43,"value":357},"-mention file",{"type":38,"tag":237,"props":359,"children":360},{},[361],{"type":38,"tag":88,"props":362,"children":364},{"className":363},[],[365],{"type":43,"value":366},"@notes\u002Facme-research-brief.md",{"type":38,"tag":210,"props":368,"children":369},{},[370,375,379],{"type":38,"tag":237,"props":371,"children":372},{},[373],{"type":43,"value":374},"Constraints",{"type":38,"tag":237,"props":376,"children":377},{},[378],{"type":43,"value":246},{"type":38,"tag":237,"props":380,"children":381},{},[382],{"type":43,"value":383},"\"CEL input only\", \"single data stream\"",{"type":38,"tag":385,"props":386,"children":388},"h3",{"id":387},"example-invocations",[389],{"type":43,"value":390},"Example invocations",{"type":38,"tag":392,"props":393,"children":397},"pre",{"className":394,"code":396,"language":43},[395],"language-text","Create a new \"acme_firewall\" integration for Acme Firewall appliance.\n  API docs: https:\u002F\u002Fdocs.acme.com\u002Fapi\u002Fv2\u002Fevents\n  Auth: Bearer token header. Pagination: offset-based with total_count.\n  @samples\u002Facme_events.json. Single data stream \"event\" using cel input.\n",[398],{"type":38,"tag":88,"props":399,"children":401},{"__ignoreMap":400},"",[402],{"type":43,"value":396},{"type":38,"tag":392,"props":404,"children":407},{"className":405,"code":406,"language":43},[395],"New syslog integration \"my_appliance\" with tcp,udp inputs.\n  @notes\u002Fresearch-brief.md. Two streams: \"log\" (syslog) and \"traffic\" (syslog).\n",[408],{"type":38,"tag":88,"props":409,"children":410},{"__ignoreMap":400},[411],{"type":43,"value":406},{"type":38,"tag":45,"props":413,"children":415},{"id":414},"what-to-provide-when-adding-data-streams-to-an-existing-package",[416],{"type":43,"value":417},"What to provide when adding data streams to an existing package",{"type":38,"tag":52,"props":419,"children":420},{},[421,423,428],{"type":43,"value":422},"Use ",{"type":38,"tag":88,"props":424,"children":426},{"className":425},[],[427],{"type":43,"value":328},{"type":43,"value":429},"-mentions for files\u002Ffolders and paste links inline.",{"type":38,"tag":202,"props":431,"children":432},{},[433,451],{"type":38,"tag":206,"props":434,"children":435},{},[436],{"type":38,"tag":210,"props":437,"children":438},{},[439,443,447],{"type":38,"tag":214,"props":440,"children":441},{},[442],{"type":43,"value":218},{"type":38,"tag":214,"props":444,"children":445},{},[446],{"type":43,"value":223},{"type":38,"tag":214,"props":448,"children":449},{},[450],{"type":43,"value":228},{"type":38,"tag":230,"props":452,"children":453},{},[454,491,526,555,604,625,657,682,698],{"type":38,"tag":210,"props":455,"children":456},{},[457,462,474],{"type":38,"tag":237,"props":458,"children":459},{},[460],{"type":43,"value":461},"Target package",{"type":38,"tag":237,"props":463,"children":464},{},[465,467,472],{"type":43,"value":466},"free text or ",{"type":38,"tag":88,"props":468,"children":470},{"className":469},[],[471],{"type":43,"value":328},{"type":43,"value":473},"-mention",{"type":38,"tag":237,"props":475,"children":476},{},[477,483,485],{"type":38,"tag":88,"props":478,"children":480},{"className":479},[],[481],{"type":43,"value":482},"acme_firewall",{"type":43,"value":484},", ",{"type":38,"tag":88,"props":486,"children":488},{"className":487},[],[489],{"type":43,"value":490},"@packages\u002Facme_firewall",{"type":38,"tag":210,"props":492,"children":493},{},[494,499,503],{"type":38,"tag":237,"props":495,"children":496},{},[497],{"type":43,"value":498},"Stream name",{"type":38,"tag":237,"props":500,"children":501},{},[502],{"type":43,"value":246},{"type":38,"tag":237,"props":504,"children":505},{},[506,512,513,519,520],{"type":38,"tag":88,"props":507,"children":509},{"className":508},[],[510],{"type":43,"value":511},"audit",{"type":43,"value":484},{"type":38,"tag":88,"props":514,"children":516},{"className":515},[],[517],{"type":43,"value":518},"traffic",{"type":43,"value":484},{"type":38,"tag":88,"props":521,"children":523},{"className":522},[],[524],{"type":43,"value":525},"alert",{"type":38,"tag":210,"props":527,"children":528},{},[529,534,538],{"type":38,"tag":237,"props":530,"children":531},{},[532],{"type":43,"value":533},"Stream type",{"type":38,"tag":237,"props":535,"children":536},{},[537],{"type":43,"value":246},{"type":38,"tag":237,"props":539,"children":540},{},[541,547,549],{"type":38,"tag":88,"props":542,"children":544},{"className":543},[],[545],{"type":43,"value":546},"logs",{"type":43,"value":548}," (default) or ",{"type":38,"tag":88,"props":550,"children":552},{"className":551},[],[553],{"type":43,"value":554},"metrics",{"type":38,"tag":210,"props":556,"children":557},{},[558,563,567],{"type":38,"tag":237,"props":559,"children":560},{},[561],{"type":43,"value":562},"Input type(s)",{"type":38,"tag":237,"props":564,"children":565},{},[566],{"type":43,"value":246},{"type":38,"tag":237,"props":568,"children":569},{},[570,576,577,583,584,590,591,597,598],{"type":38,"tag":88,"props":571,"children":573},{"className":572},[],[574],{"type":43,"value":575},"cel",{"type":43,"value":484},{"type":38,"tag":88,"props":578,"children":580},{"className":579},[],[581],{"type":43,"value":582},"tcp,udp",{"type":43,"value":484},{"type":38,"tag":88,"props":585,"children":587},{"className":586},[],[588],{"type":43,"value":589},"filestream",{"type":43,"value":484},{"type":38,"tag":88,"props":592,"children":594},{"className":593},[],[595],{"type":43,"value":596},"http_endpoint",{"type":43,"value":484},{"type":38,"tag":88,"props":599,"children":601},{"className":600},[],[602],{"type":43,"value":603},"aws-s3",{"type":38,"tag":210,"props":605,"children":606},{},[607,612,616],{"type":38,"tag":237,"props":608,"children":609},{},[610],{"type":43,"value":611},"API \u002F log docs",{"type":38,"tag":237,"props":613,"children":614},{},[615],{"type":43,"value":302},{"type":38,"tag":237,"props":617,"children":618},{},[619],{"type":38,"tag":88,"props":620,"children":622},{"className":621},[],[623],{"type":43,"value":624},"https:\u002F\u002Fdocs.acme.com\u002Fapi\u002Faudit",{"type":38,"tag":210,"props":626,"children":627},{},[628,632,641],{"type":38,"tag":237,"props":629,"children":630},{},[631],{"type":43,"value":319},{"type":38,"tag":237,"props":633,"children":634},{},[635,640],{"type":38,"tag":88,"props":636,"children":638},{"className":637},[],[639],{"type":43,"value":328},{"type":43,"value":330},{"type":38,"tag":237,"props":642,"children":643},{},[644,650,651],{"type":38,"tag":88,"props":645,"children":647},{"className":646},[],[648],{"type":43,"value":649},"@samples\u002Faudit_event.json",{"type":43,"value":484},{"type":38,"tag":88,"props":652,"children":654},{"className":653},[],[655],{"type":43,"value":656},"@samples\u002Ftraffic.log",{"type":38,"tag":210,"props":658,"children":659},{},[660,664,673],{"type":38,"tag":237,"props":661,"children":662},{},[663],{"type":43,"value":347},{"type":38,"tag":237,"props":665,"children":666},{},[667,672],{"type":38,"tag":88,"props":668,"children":670},{"className":669},[],[671],{"type":43,"value":328},{"type":43,"value":357},{"type":38,"tag":237,"props":674,"children":675},{},[676],{"type":38,"tag":88,"props":677,"children":679},{"className":678},[],[680],{"type":43,"value":681},"@notes\u002Facme-audit-brief.md",{"type":38,"tag":210,"props":683,"children":684},{},[685,689,693],{"type":38,"tag":237,"props":686,"children":687},{},[688],{"type":43,"value":374},{"type":38,"tag":237,"props":690,"children":691},{},[692],{"type":43,"value":246},{"type":38,"tag":237,"props":694,"children":695},{},[696],{"type":43,"value":697},"\"reuse package-level auth vars\", \"separate pipeline per event type\"",{"type":38,"tag":210,"props":699,"children":700},{},[701,706,710],{"type":38,"tag":237,"props":702,"children":703},{},[704],{"type":43,"value":705},"Acceptance criteria",{"type":38,"tag":237,"props":707,"children":708},{},[709],{"type":43,"value":246},{"type":38,"tag":237,"props":711,"children":712},{},[713],{"type":43,"value":714},"\"parse all syslog fields, map to ECS\"",{"type":38,"tag":385,"props":716,"children":718},{"id":717},"example-invocations-1",[719],{"type":43,"value":390},{"type":38,"tag":392,"props":721,"children":724},{"className":722,"code":723,"language":43},[395],"Add \"audit\" stream to @packages\u002Facme_firewall using cel input.\n  API endpoint: \u002Fapi\u002Fv2\u002Faudit_logs\n  Pagination: timestamp cursor.\n  @samples\u002Facme_audit.json\n",[725],{"type":38,"tag":88,"props":726,"children":727},{"__ignoreMap":400},[728],{"type":43,"value":723},{"type":38,"tag":392,"props":730,"children":733},{"className":731,"code":732,"language":43},[395],"Add \"traffic\" and \"threat\" streams to acme_firewall.\n  Both use tcp,udp inputs (syslog).\n  @samples\u002Ftraffic.log @samples\u002Fthreat.log\n",[734],{"type":38,"tag":88,"props":735,"children":736},{"__ignoreMap":400},[737],{"type":43,"value":732},{"type":38,"tag":45,"props":739,"children":741},{"id":740},"subagents-overview",[742],{"type":43,"value":743},"Subagents overview",{"type":38,"tag":52,"props":745,"children":746},{},[747,749,754],{"type":43,"value":748},"Do ",{"type":38,"tag":111,"props":750,"children":751},{},[752],{"type":43,"value":753},"not",{"type":43,"value":755}," load CEL, pipeline, ECS, or field-mapping skills yourself. Delegate to subagents that load their own domain skills.",{"type":38,"tag":52,"props":757,"children":758},{},[759,761,766,768,774,776,782,784,797,799,804,806,811,813,818],{"type":43,"value":760},"All specialised work is delegated to the platform's ",{"type":38,"tag":111,"props":762,"children":763},{},[764],{"type":43,"value":765},"generic \u002F general-purpose subagent",{"type":43,"value":767}," (Cursor: ",{"type":38,"tag":88,"props":769,"children":771},{"className":770},[],[772],{"type":43,"value":773},"generalPurpose",{"type":43,"value":775}," Task agent; Claude Code: ",{"type":38,"tag":88,"props":777,"children":779},{"className":778},[],[780],{"type":43,"value":781},"general-purpose",{"type":43,"value":783}," Task agent; or the equivalent on other platforms). Each task prompt must ",{"type":38,"tag":111,"props":785,"children":786},{},[787,789,795],{"type":43,"value":788},"point the subagent at the relevant ",{"type":38,"tag":88,"props":790,"children":792},{"className":791},[],[793],{"type":43,"value":794},"*-subagent-guidance.md",{"type":43,"value":796}," file by path",{"type":43,"value":798}," and instruct it to read that file (plus the skill SKILL.md it lists in \"First steps\") end-to-end before doing any other work. ",{"type":38,"tag":111,"props":800,"children":801},{},[802],{"type":43,"value":803},"Do NOT read the guidance file yourself or paste its contents into the task prompt",{"type":43,"value":805}," — that doubles its context cost. Pass only the path plus the task-specific context. The subagent will load the manual itself in its own fresh context. Full dispatch rules and per-step detail live in ",{"type":38,"tag":88,"props":807,"children":809},{"className":808},[],[810],{"type":43,"value":128},{"type":43,"value":812}," and ",{"type":38,"tag":88,"props":814,"children":816},{"className":815},[],[817],{"type":43,"value":151},{"type":43,"value":819},".",{"type":38,"tag":202,"props":821,"children":822},{},[823,838],{"type":38,"tag":206,"props":824,"children":825},{},[826],{"type":38,"tag":210,"props":827,"children":828},{},[829,834],{"type":38,"tag":214,"props":830,"children":831},{},[832],{"type":43,"value":833},"Subagent guidance file",{"type":38,"tag":214,"props":835,"children":836},{},[837],{"type":43,"value":50},{"type":38,"tag":230,"props":839,"children":840},{},[841,860,885,902,919,936],{"type":38,"tag":210,"props":842,"children":843},{},[844,855],{"type":38,"tag":237,"props":845,"children":846},{},[847,853],{"type":38,"tag":88,"props":848,"children":850},{"className":849},[],[851],{"type":43,"value":852},"\u002Fresearch-integration",{"type":43,"value":854}," skill (orchestrates its own research subagents)",{"type":38,"tag":237,"props":856,"children":857},{},[858],{"type":43,"value":859},"Vendor\u002FAPI research before building, when no research brief is provided",{"type":38,"tag":210,"props":861,"children":862},{},[863,872],{"type":38,"tag":237,"props":864,"children":865},{},[866],{"type":38,"tag":88,"props":867,"children":869},{"className":868},[],[870],{"type":43,"value":871},"cel-programs\u002Freferences\u002Fbuilder-subagent-guidance.md",{"type":38,"tag":237,"props":873,"children":874},{},[875,877,883],{"type":43,"value":876},"Each CEL data stream — mock API, CEL program (incremental mito build), ",{"type":38,"tag":88,"props":878,"children":880},{"className":879},[],[881],{"type":43,"value":882},"cel.yml.hbs",{"type":43,"value":884}," template, manifest vars, initial field mappings",{"type":38,"tag":210,"props":886,"children":887},{},[888,897],{"type":38,"tag":237,"props":889,"children":890},{},[891],{"type":38,"tag":88,"props":892,"children":894},{"className":893},[],[895],{"type":43,"value":896},"integration-testing\u002Freferences\u002Fbuilder-setup-subagent-guidance.md",{"type":38,"tag":237,"props":898,"children":899},{},[900],{"type":43,"value":901},"Each non-CEL data stream — data collection setup (docker-compose, sample logs, agent stream template, system test config, manifest var cleanup)",{"type":38,"tag":210,"props":903,"children":904},{},[905,914],{"type":38,"tag":237,"props":906,"children":907},{},[908],{"type":38,"tag":88,"props":909,"children":911},{"className":910},[],[912],{"type":43,"value":913},"ingest-pipelines\u002Freferences\u002Fbuilder-subagent-guidance.md",{"type":38,"tag":237,"props":915,"children":916},{},[917],{"type":43,"value":918},"Each data stream's pipeline and field definitions",{"type":38,"tag":210,"props":920,"children":921},{},[922,931],{"type":38,"tag":237,"props":923,"children":924},{},[925],{"type":38,"tag":88,"props":926,"children":928},{"className":927},[],[929],{"type":43,"value":930},"integration-testing\u002Freferences\u002Fbuilder-system-test-subagent-guidance.md",{"type":38,"tag":237,"props":932,"children":933},{},[934],{"type":43,"value":935},"System test execution after pipeline work completes, for any testable input (CEL, tcp, udp, http_endpoint, logfile, kafka, pubsub)",{"type":38,"tag":210,"props":937,"children":938},{},[939,948],{"type":38,"tag":237,"props":940,"children":941},{},[942],{"type":38,"tag":88,"props":943,"children":945},{"className":944},[],[946],{"type":43,"value":947},"review-integration\u002Freferences\u002Freviewer-subagent-guidance.md",{"type":38,"tag":237,"props":949,"children":950},{},[951,953,959],{"type":43,"value":952},"Quality review after all streams are built — classifies files by domain, loads relevant domain skills and checklists via the ",{"type":38,"tag":88,"props":954,"children":956},{"className":955},[],[957],{"type":43,"value":958},"review-integration",{"type":43,"value":960}," skill, returns severity-ranked, domain-tagged findings",{"type":38,"tag":52,"props":962,"children":963},{},[964,966,971,973,978],{"type":43,"value":965},"For ",{"type":38,"tag":111,"props":967,"children":968},{},[969],{"type":43,"value":970},"cloud storage inputs",{"type":43,"value":972}," (aws-s3, gcs, azure-blob-storage, azure-eventhub): skip data collection setup and system tests. The scaffold provides a usable template; trim vars to match needs. See ",{"type":38,"tag":88,"props":974,"children":976},{"className":975},[],[977],{"type":43,"value":128},{"type":43,"value":979}," for details.",{"type":38,"tag":45,"props":981,"children":983},{"id":982},"references",[984],{"type":43,"value":985},"References",{"type":38,"tag":58,"props":987,"children":988},{},[989,999,1009,1019],{"type":38,"tag":62,"props":990,"children":991},{},[992,997],{"type":38,"tag":88,"props":993,"children":995},{"className":994},[],[996],{"type":43,"value":128},{"type":43,"value":998}," — full phases 1–8 for creating a new integration, subagent instructions, guardrails, data anonymization",{"type":38,"tag":62,"props":1000,"children":1001},{},[1002,1007],{"type":38,"tag":88,"props":1003,"children":1005},{"className":1004},[],[1006],{"type":43,"value":151},{"type":43,"value":1008}," — phases 1–4 for adding data streams to an existing package, CEL\u002Fpipeline\u002Fsystem-test sequence",{"type":38,"tag":62,"props":1010,"children":1011},{},[1012,1017],{"type":38,"tag":88,"props":1013,"children":1015},{"className":1014},[],[1016],{"type":43,"value":170},{"type":43,"value":1018}," — scaffold commands, post-scaffold edits, base-fields.yml format",{"type":38,"tag":62,"props":1020,"children":1021},{},[1022,1027],{"type":38,"tag":88,"props":1023,"children":1025},{"className":1024},[],[1026],{"type":43,"value":187},{"type":43,"value":1028}," — integration and input package topology, manifest patterns",{"items":1030,"total":1198},[1031,1050,1067,1080,1099,1111,1121,1136,1148,1161,1172,1185],{"slug":1032,"name":1032,"fn":1033,"description":1034,"org":1035,"tags":1036,"stars":1047,"repoUrl":1048,"updatedAt":1049},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1037,1040,1043,1044],{"name":1038,"slug":1039,"type":15},"Analytics","analytics",{"name":1041,"slug":1042,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":1045,"slug":1046,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":1051,"name":1051,"fn":1052,"description":1053,"org":1054,"tags":1055,"stars":1047,"repoUrl":1048,"updatedAt":1066},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1056,1059,1060,1063],{"name":1057,"slug":1058,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":1061,"slug":1062,"type":15},"Engineering","engineering",{"name":1064,"slug":1065,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":1068,"name":1068,"fn":1069,"description":1070,"org":1071,"tags":1072,"stars":1047,"repoUrl":1048,"updatedAt":1079},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1073,1074,1075,1076],{"name":9,"slug":8,"type":15},{"name":17,"slug":18,"type":15},{"name":1045,"slug":1046,"type":15},{"name":1077,"slug":1078,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":1081,"name":1081,"fn":1082,"description":1083,"org":1084,"tags":1085,"stars":1096,"repoUrl":1097,"updatedAt":1098},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1086,1089,1090,1093],{"name":1087,"slug":1088,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":1091,"slug":1092,"type":15},"Operations","operations",{"name":1094,"slug":1095,"type":15},"Permissions","permissions",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:44.946285",{"slug":1100,"name":1100,"fn":1101,"description":1102,"org":1103,"tags":1104,"stars":1096,"repoUrl":1097,"updatedAt":1110},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1105,1106,1109],{"name":1087,"slug":1088,"type":15},{"name":1107,"slug":1108,"type":15},"Deployment","deployment",{"name":17,"slug":18,"type":15},"2026-07-12T07:46:42.353362",{"slug":1112,"name":1112,"fn":1113,"description":1114,"org":1115,"tags":1116,"stars":1096,"repoUrl":1097,"updatedAt":1120},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1117,1118,1119],{"name":1087,"slug":1088,"type":15},{"name":17,"slug":18,"type":15},{"name":1091,"slug":1092,"type":15},"2026-07-12T07:46:41.097412",{"slug":1122,"name":1122,"fn":1123,"description":1124,"org":1125,"tags":1126,"stars":1096,"repoUrl":1097,"updatedAt":1135},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1127,1128,1129,1132],{"name":1087,"slug":1088,"type":15},{"name":17,"slug":18,"type":15},{"name":1130,"slug":1131,"type":15},"Networking","networking",{"name":1133,"slug":1134,"type":15},"Security","security","2026-07-12T07:46:43.675992",{"slug":1137,"name":1137,"fn":1138,"description":1139,"org":1140,"tags":1141,"stars":1096,"repoUrl":1097,"updatedAt":1147},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1142,1145,1146],{"name":1143,"slug":1144,"type":15},"Authentication","authentication",{"name":1087,"slug":1088,"type":15},{"name":17,"slug":18,"type":15},"2026-07-12T07:46:39.783105",{"slug":1149,"name":1149,"fn":1150,"description":1151,"org":1152,"tags":1153,"stars":1096,"repoUrl":1097,"updatedAt":1160},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1154,1156,1157,1159],{"name":1155,"slug":511,"type":15},"Audit",{"name":17,"slug":18,"type":15},{"name":1158,"slug":546,"type":15},"Logs",{"name":1133,"slug":1134,"type":15},"2026-07-12T07:47:35.092599",{"slug":1162,"name":1162,"fn":1163,"description":1164,"org":1165,"tags":1166,"stars":1096,"repoUrl":1097,"updatedAt":1171},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1167,1168,1169,1170],{"name":1143,"slug":1144,"type":15},{"name":9,"slug":8,"type":15},{"name":17,"slug":18,"type":15},{"name":1133,"slug":1134,"type":15},"2026-07-12T07:47:41.474547",{"slug":1173,"name":1173,"fn":1174,"description":1175,"org":1176,"tags":1177,"stars":1096,"repoUrl":1097,"updatedAt":1184},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1178,1179,1180,1183],{"name":9,"slug":8,"type":15},{"name":17,"slug":18,"type":15},{"name":1181,"slug":1182,"type":15},"RBAC","rbac",{"name":1133,"slug":1134,"type":15},"2026-07-12T07:47:36.394177",{"slug":1186,"name":1186,"fn":1187,"description":1188,"org":1189,"tags":1190,"stars":1096,"repoUrl":1097,"updatedAt":1197},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1191,1192,1193,1194],{"name":1038,"slug":1039,"type":15},{"name":1041,"slug":1042,"type":15},{"name":17,"slug":18,"type":15},{"name":1195,"slug":1196,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86,{"items":1200,"total":1294},[1201,1216,1231,1236,1253,1266,1281],{"slug":1202,"name":1202,"fn":1203,"description":1204,"org":1205,"tags":1206,"stars":19,"repoUrl":20,"updatedAt":1215},"anonymize-logs","anonymize sensitive log data","Anonymize and sanitize customer-provided log files before they are committed as pipeline test fixtures or sample events. Performs a line-by-line review and replaces all sensitive values inline, preserving log structure and format exactly — never reformats, re-indents, or restructures content. Invoke manually with \u002Fanonymize-logs.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1207,1210,1211,1214],{"name":1208,"slug":1209,"type":15},"Data Cleaning","data-cleaning",{"name":1158,"slug":546,"type":15},{"name":1212,"slug":1213,"type":15},"Privacy","privacy",{"name":1133,"slug":1134,"type":15},"2026-07-18T05:13:04.420121",{"slug":1217,"name":1217,"fn":1218,"description":1219,"org":1220,"tags":1221,"stars":19,"repoUrl":20,"updatedAt":1230},"cel-programs","write CEL programs for data collection","Use for all CEL and mito work on integrations that collect from APIs — writing CEL programs, cel.yml.hbs templates, manifest configuration, mock-first development with the mito CLI, system test mock setup, and answering CEL\u002Fmito questions. Load this skill whenever any data stream uses the cel input type.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1222,1225,1228,1229],{"name":1223,"slug":1224,"type":15},"API Development","api-development",{"name":1226,"slug":1227,"type":15},"Data Engineering","data-engineering",{"name":9,"slug":8,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:47:10.207064",{"slug":4,"name":4,"fn":5,"description":6,"org":1232,"tags":1233,"stars":19,"repoUrl":20,"updatedAt":21},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1234,1235],{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"slug":1237,"name":1237,"fn":1238,"description":1239,"org":1240,"tags":1241,"stars":19,"repoUrl":20,"updatedAt":1252},"dashboard-guidelines","create and review Kibana dashboard assets","Use when creating or reviewing Kibana assets in packages, including dashboard export structure, naming, and data stream alignment.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1242,1245,1246,1249],{"name":1243,"slug":1244,"type":15},"Dashboards","dashboards",{"name":17,"slug":18,"type":15},{"name":1247,"slug":1248,"type":15},"Kibana","kibana",{"name":1250,"slug":1251,"type":15},"UI Components","ui-components","2026-07-12T07:47:07.702332",{"slug":1254,"name":1254,"fn":1255,"description":1256,"org":1257,"tags":1258,"stars":19,"repoUrl":20,"updatedAt":1265},"dashboard-review","review Elastic dashboard JSON changes","Use when reviewing dashboard JSON changes in a PR or branch. Extracts structured descriptions with kbdash, compares before\u002Fafter, and checks guideline compliance.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1259,1262,1263,1264],{"name":1260,"slug":1261,"type":15},"Code Review","code-review",{"name":1243,"slug":1244,"type":15},{"name":9,"slug":8,"type":15},{"name":1247,"slug":1248,"type":15},"2026-07-12T07:47:06.493988",{"slug":1267,"name":1267,"fn":1268,"description":1269,"org":1270,"tags":1271,"stars":19,"repoUrl":20,"updatedAt":1280},"ecs-field-mappings","define ECS field mappings for integrations","Use when defining field mappings for data streams, populating ecs.yml with ECS field references, selecting ECS categorization values, choosing custom field types, or troubleshooting mapping validation failures.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1272,1275,1278,1279],{"name":1273,"slug":1274,"type":15},"Data Modeling","data-modeling",{"name":1276,"slug":1277,"type":15},"Data Quality","data-quality",{"name":9,"slug":8,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:47:13.472534",{"slug":1282,"name":1282,"fn":1283,"description":1284,"org":1285,"tags":1286,"stars":19,"repoUrl":20,"updatedAt":1293},"elastic-package-cli","develop and validate Elastic integrations","Use when developing or validating Elastic integrations with elastic-package commands such as build, check, lint, format, test, stack, service, install, profiles, and benchmark.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1287,1290,1291,1292],{"name":1288,"slug":1289,"type":15},"CLI","cli",{"name":9,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"name":1077,"slug":1078,"type":15},"2026-07-12T07:46:57.647395",14]