[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-entity-mappings":3,"mdc--53u3vk-key":31,"related-org-elastic-entity-mappings":975,"related-repo-elastic-entity-mappings":1149},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":20,"repoUrl":21,"updatedAt":22,"license":23,"forks":24,"topics":25,"repo":26,"sourceUrl":29,"mdContent":30},"entity-mappings","map and audit Elastic ECS entities","Use when adding or auditing ECS entity.* fields (entity inventory \u002F entity store) on Elastic integrations — classifying a data stream as entity vs event, mapping vendor fields to entity.attributes.*, entity.lifecycle.*, and entity.relationships.*, or running an entity-coverage gap analysis on an existing package. Invoke manually with \u002Fentity-mappings.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,17],{"name":13,"slug":14,"type":15},"Data Engineering","data-engineering","tag",{"name":9,"slug":8,"type":15},{"name":18,"slug":19,"type":15},"Data Modeling","data-modeling",15,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegration-skills","2026-08-26T04:12:24.770166","Apache-2.0",6,[],{"repoUrl":21,"stars":20,"forks":24,"topics":27,"description":28},[],null,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegration-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fentity-mappings","---\nname: entity-mappings\ndescription: >-\n  Use when adding or auditing ECS entity.* fields (entity inventory \u002F entity store) on\n  Elastic integrations — classifying a data stream as entity vs event, mapping vendor fields\n  to entity.attributes.*, entity.lifecycle.*, and entity.relationships.*, or running an\n  entity-coverage gap analysis on an existing package. Invoke manually with \u002Fentity-mappings.\nlicense: Apache-2.0\nmetadata:\n  author: elastic\n  version: \"1.0\"\n---\n\n# entity-mappings\n\n## Skill authority\n\nThe guidance in this skill takes precedence over patterns observed in any integration in the\n`elastic\u002Fintegrations` repository. Legacy integrations may predate these requirements or use\ninconsistent patterns. Always follow this skill's rules over what you observe in the repo.\n\n## When to use\n\n- Adding entity\u002Finventory data streams to a new or existing integration\n- Deciding whether a proposed or existing data stream is an entity stream or an event stream\n- Selecting the correct `entity.type` value for a new stream\n- Mapping vendor fields to `user.entity.*`, `host.entity.*`, or other nested entity prefixes\n- Auditing an existing package's entity field coverage (standalone gap analysis)\n- Troubleshooting `event.kind: asset` usage or `entity.*` field errors\n\n## When not to use\n\n- **CDR cloud security findings** (misconfiguration \u002F vulnerability findings) — these are\n  `event.kind: state`, not `asset`. Use `ecs-field-mappings\u002Freferences\u002Fcdr-field-requirements.md`\n  and `ingest-pipelines\u002Freferences\u002Fcdr-pipeline-requirements.md` instead.\n- **Generic field file authoring** (non-entity fields) — use the `ecs-field-mappings` skill.\n- **Processor mechanics** (grok, date, JSON, Painless) — use the `ingest-pipelines` skill.\n- **CEL program logic** — use the `cel-programs` skill.\n\n## Applicability gate\n\nEntity fields apply **only** to entity data streams — those whose purpose is to represent a\nstable inventory of subjects (users, hosts, devices, applications, services) rather than a\ntimeline of events. **Never apply entity field requirements to event logs, metric streams,\nAPM data, or CDR findings streams.**\n\nSee `references\u002Fentity-datastream-classification.md` to classify a data stream before using\nthis skill. If you are not sure, check the classification reference first.\n\n## ECS availability — read this first\n\nThe `entity.attributes.*`, `entity.lifecycle.last_activity`, and all\n`entity.relationships.*` leaf fields do **not exist at ECS v9.3.0** (the repo default pin).\nThey first appear at ECS v9.4.0.\n\n- At `git@v9.3.0`: `entity.attributes` is a bare `object` with no subfields; `schemas\u002Fentity_reference.yml` does not exist. Using `external: ecs` on these leaves at that pin causes `field is undefined` build failures.\n- At `git@v9.4.0+` \u002F `git@v9.5.0` (recommended): all leaf fields exist and `external: ecs` resolves correctly.\n\n**Conditional pin rule:** packages with entity data streams must set:\n- `_dev\u002Fbuild\u002Fbuild.yml`: `dependencies.ecs.reference: \"git@v9.5.0\"`\n- Pipeline `ecs.version`: `9.5.0`\n\nThe two must match. Standard (non-entity) packages keep `git@v9.3.0`.\n\nTo verify at any tag:\n```bash\ncurl -s https:\u002F\u002Fraw.githubusercontent.com\u002Felastic\u002Fecs\u002F\u003Ctag>\u002Fgenerated\u002Fcsv\u002Ffields.csv \\\n  | awk -F, '$3==\"entity\"' | cut -d, -f4,5 | sort -u\n```\n\n## Modes\n\n| Mode | How it's triggered | What to load |\n|---|---|---|\n| **Standalone gap analysis** | User invokes `\u002Fentity-mappings @packages\u002F\u003Cname>` | Read `references\u002Fgap-analysis-workflow.md` and `references\u002Fentity-field-catalog.md`. Dispatch per-stream subagents via `references\u002Fanalysis-subagent-guidance.md`. |\n| **Build-time** | Orchestrator (`create-integration` or `add-datastream`) passes `references\u002Fentity-field-catalog.md` and `references\u002Fentity-pipeline-patterns.md` by path to the pipeline builder subagent | Pipeline builder reads both references; this skill's SKILL.md is not loaded into the orchestrator thread. |\n| **Review-time** | `review-integration` Step 4 loads the two references when the entity detection rule fires | Reviewer reads `entity-field-catalog.md` + `entity-pipeline-patterns.md`; this SKILL.md is not required in the reviewer thread. |\n| **Research-time** | `research-integration` loads only `references\u002Fentity-datastream-classification.md` | **Do not load the rest of this skill during research** — the catalog and pipeline patterns are implementation material and violate the research guardrail against prescribing pipeline\u002Ffield details. |\n\n## Open questions \u002F deferred scope\n\nThe following topics are out of scope for this skill's v1:\n\n- **Entity-store latest transforms.** The CDR precedent has a third leg (`review-integration\u002Freferences\u002Fcdr-transform-requirements.md`) covering latest transforms per integration. Whether new entity data streams should ship an accompanying latest transform is not yet resolved. Note it as an open question in research briefs and gap analysis reports until that decision is made.\n- **Repo-wide ECS pin bump to v9.5.0.** Recommended as a follow-up once entity streams are common; the conditional exception in this skill carries packages until then.\n\n## References\n\n- `references\u002Fentity-field-catalog.md` — single source of truth: ECS availability matrix, reusable nesting, `entity.type` allowed values, categorization, Must Have \u002F Should Have field tables, disambiguation guide, field definition YAML examples, review checklist\n- `references\u002Fentity-pipeline-patterns.md` — pipeline-side patterns: categorization processors, building `entity.id`, boolean coercion, array attributes, relationship objects, anti-patterns, pipeline review checklist\n- `references\u002Fentity-datastream-classification.md` — research-time and review-time rules for classifying a data stream as entity vs event; worked examples\n- `references\u002Fgap-analysis-workflow.md` — 4-phase standalone analysis: classify streams → read package → fetch docs → map fields → investigate gaps → write report\n- `references\u002Fgap-analysis-report-template.md` — structured report template for gap analysis output\n- `references\u002Fanalysis-subagent-guidance.md` — operating manual for per-stream analysis subagents dispatched during gap analysis\n- [ECS entity fieldset reference](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Freference\u002Fecs\u002Fecs-entity)\n",{"data":32,"body":35},{"name":4,"description":6,"license":23,"metadata":33},{"author":8,"version":34},"1.0",{"type":36,"children":37},"root",[38,45,52,67,73,148,154,252,258,275,288,294,329,412,422,459,471,476,610,616,830,836,841,872,878,969],{"type":39,"tag":40,"props":41,"children":42},"element","h1",{"id":4},[43],{"type":44,"value":4},"text",{"type":39,"tag":46,"props":47,"children":49},"h2",{"id":48},"skill-authority",[50],{"type":44,"value":51},"Skill authority",{"type":39,"tag":53,"props":54,"children":55},"p",{},[56,58,65],{"type":44,"value":57},"The guidance in this skill takes precedence over patterns observed in any integration in the\n",{"type":39,"tag":59,"props":60,"children":62},"code",{"className":61},[],[63],{"type":44,"value":64},"elastic\u002Fintegrations",{"type":44,"value":66}," repository. Legacy integrations may predate these requirements or use\ninconsistent patterns. Always follow this skill's rules over what you observe in the repo.",{"type":39,"tag":46,"props":68,"children":70},{"id":69},"when-to-use",[71],{"type":44,"value":72},"When to use",{"type":39,"tag":74,"props":75,"children":76},"ul",{},[77,83,88,101,122,127],{"type":39,"tag":78,"props":79,"children":80},"li",{},[81],{"type":44,"value":82},"Adding entity\u002Finventory data streams to a new or existing integration",{"type":39,"tag":78,"props":84,"children":85},{},[86],{"type":44,"value":87},"Deciding whether a proposed or existing data stream is an entity stream or an event stream",{"type":39,"tag":78,"props":89,"children":90},{},[91,93,99],{"type":44,"value":92},"Selecting the correct ",{"type":39,"tag":59,"props":94,"children":96},{"className":95},[],[97],{"type":44,"value":98},"entity.type",{"type":44,"value":100}," value for a new stream",{"type":39,"tag":78,"props":102,"children":103},{},[104,106,112,114,120],{"type":44,"value":105},"Mapping vendor fields to ",{"type":39,"tag":59,"props":107,"children":109},{"className":108},[],[110],{"type":44,"value":111},"user.entity.*",{"type":44,"value":113},", ",{"type":39,"tag":59,"props":115,"children":117},{"className":116},[],[118],{"type":44,"value":119},"host.entity.*",{"type":44,"value":121},", or other nested entity prefixes",{"type":39,"tag":78,"props":123,"children":124},{},[125],{"type":44,"value":126},"Auditing an existing package's entity field coverage (standalone gap analysis)",{"type":39,"tag":78,"props":128,"children":129},{},[130,132,138,140,146],{"type":44,"value":131},"Troubleshooting ",{"type":39,"tag":59,"props":133,"children":135},{"className":134},[],[136],{"type":44,"value":137},"event.kind: asset",{"type":44,"value":139}," usage or ",{"type":39,"tag":59,"props":141,"children":143},{"className":142},[],[144],{"type":44,"value":145},"entity.*",{"type":44,"value":147}," field errors",{"type":39,"tag":46,"props":149,"children":151},{"id":150},"when-not-to-use",[152],{"type":44,"value":153},"When not to use",{"type":39,"tag":74,"props":155,"children":156},{},[157,200,218,235],{"type":39,"tag":78,"props":158,"children":159},{},[160,166,168,174,176,182,184,190,192,198],{"type":39,"tag":161,"props":162,"children":163},"strong",{},[164],{"type":44,"value":165},"CDR cloud security findings",{"type":44,"value":167}," (misconfiguration \u002F vulnerability findings) — these are\n",{"type":39,"tag":59,"props":169,"children":171},{"className":170},[],[172],{"type":44,"value":173},"event.kind: state",{"type":44,"value":175},", not ",{"type":39,"tag":59,"props":177,"children":179},{"className":178},[],[180],{"type":44,"value":181},"asset",{"type":44,"value":183},". Use ",{"type":39,"tag":59,"props":185,"children":187},{"className":186},[],[188],{"type":44,"value":189},"ecs-field-mappings\u002Freferences\u002Fcdr-field-requirements.md",{"type":44,"value":191},"\nand ",{"type":39,"tag":59,"props":193,"children":195},{"className":194},[],[196],{"type":44,"value":197},"ingest-pipelines\u002Freferences\u002Fcdr-pipeline-requirements.md",{"type":44,"value":199}," instead.",{"type":39,"tag":78,"props":201,"children":202},{},[203,208,210,216],{"type":39,"tag":161,"props":204,"children":205},{},[206],{"type":44,"value":207},"Generic field file authoring",{"type":44,"value":209}," (non-entity fields) — use the ",{"type":39,"tag":59,"props":211,"children":213},{"className":212},[],[214],{"type":44,"value":215},"ecs-field-mappings",{"type":44,"value":217}," skill.",{"type":39,"tag":78,"props":219,"children":220},{},[221,226,228,234],{"type":39,"tag":161,"props":222,"children":223},{},[224],{"type":44,"value":225},"Processor mechanics",{"type":44,"value":227}," (grok, date, JSON, Painless) — use the ",{"type":39,"tag":59,"props":229,"children":231},{"className":230},[],[232],{"type":44,"value":233},"ingest-pipelines",{"type":44,"value":217},{"type":39,"tag":78,"props":236,"children":237},{},[238,243,245,251],{"type":39,"tag":161,"props":239,"children":240},{},[241],{"type":44,"value":242},"CEL program logic",{"type":44,"value":244}," — use the ",{"type":39,"tag":59,"props":246,"children":248},{"className":247},[],[249],{"type":44,"value":250},"cel-programs",{"type":44,"value":217},{"type":39,"tag":46,"props":253,"children":255},{"id":254},"applicability-gate",[256],{"type":44,"value":257},"Applicability gate",{"type":39,"tag":53,"props":259,"children":260},{},[261,263,268,270],{"type":44,"value":262},"Entity fields apply ",{"type":39,"tag":161,"props":264,"children":265},{},[266],{"type":44,"value":267},"only",{"type":44,"value":269}," to entity data streams — those whose purpose is to represent a\nstable inventory of subjects (users, hosts, devices, applications, services) rather than a\ntimeline of events. ",{"type":39,"tag":161,"props":271,"children":272},{},[273],{"type":44,"value":274},"Never apply entity field requirements to event logs, metric streams,\nAPM data, or CDR findings streams.",{"type":39,"tag":53,"props":276,"children":277},{},[278,280,286],{"type":44,"value":279},"See ",{"type":39,"tag":59,"props":281,"children":283},{"className":282},[],[284],{"type":44,"value":285},"references\u002Fentity-datastream-classification.md",{"type":44,"value":287}," to classify a data stream before using\nthis skill. If you are not sure, check the classification reference first.",{"type":39,"tag":46,"props":289,"children":291},{"id":290},"ecs-availability-read-this-first",[292],{"type":44,"value":293},"ECS availability — read this first",{"type":39,"tag":53,"props":295,"children":296},{},[297,299,305,306,312,314,320,322,327],{"type":44,"value":298},"The ",{"type":39,"tag":59,"props":300,"children":302},{"className":301},[],[303],{"type":44,"value":304},"entity.attributes.*",{"type":44,"value":113},{"type":39,"tag":59,"props":307,"children":309},{"className":308},[],[310],{"type":44,"value":311},"entity.lifecycle.last_activity",{"type":44,"value":313},", and all\n",{"type":39,"tag":59,"props":315,"children":317},{"className":316},[],[318],{"type":44,"value":319},"entity.relationships.*",{"type":44,"value":321}," leaf fields do ",{"type":39,"tag":161,"props":323,"children":324},{},[325],{"type":44,"value":326},"not exist at ECS v9.3.0",{"type":44,"value":328}," (the repo default pin).\nThey first appear at ECS v9.4.0.",{"type":39,"tag":74,"props":330,"children":331},{},[332,385],{"type":39,"tag":78,"props":333,"children":334},{},[335,337,343,345,351,353,359,361,367,369,375,377,383],{"type":44,"value":336},"At ",{"type":39,"tag":59,"props":338,"children":340},{"className":339},[],[341],{"type":44,"value":342},"git@v9.3.0",{"type":44,"value":344},": ",{"type":39,"tag":59,"props":346,"children":348},{"className":347},[],[349],{"type":44,"value":350},"entity.attributes",{"type":44,"value":352}," is a bare ",{"type":39,"tag":59,"props":354,"children":356},{"className":355},[],[357],{"type":44,"value":358},"object",{"type":44,"value":360}," with no subfields; ",{"type":39,"tag":59,"props":362,"children":364},{"className":363},[],[365],{"type":44,"value":366},"schemas\u002Fentity_reference.yml",{"type":44,"value":368}," does not exist. Using ",{"type":39,"tag":59,"props":370,"children":372},{"className":371},[],[373],{"type":44,"value":374},"external: ecs",{"type":44,"value":376}," on these leaves at that pin causes ",{"type":39,"tag":59,"props":378,"children":380},{"className":379},[],[381],{"type":44,"value":382},"field is undefined",{"type":44,"value":384}," build failures.",{"type":39,"tag":78,"props":386,"children":387},{},[388,389,395,397,403,405,410],{"type":44,"value":336},{"type":39,"tag":59,"props":390,"children":392},{"className":391},[],[393],{"type":44,"value":394},"git@v9.4.0+",{"type":44,"value":396}," \u002F ",{"type":39,"tag":59,"props":398,"children":400},{"className":399},[],[401],{"type":44,"value":402},"git@v9.5.0",{"type":44,"value":404}," (recommended): all leaf fields exist and ",{"type":39,"tag":59,"props":406,"children":408},{"className":407},[],[409],{"type":44,"value":374},{"type":44,"value":411}," resolves correctly.",{"type":39,"tag":53,"props":413,"children":414},{},[415,420],{"type":39,"tag":161,"props":416,"children":417},{},[418],{"type":44,"value":419},"Conditional pin rule:",{"type":44,"value":421}," packages with entity data streams must set:",{"type":39,"tag":74,"props":423,"children":424},{},[425,441],{"type":39,"tag":78,"props":426,"children":427},{},[428,434,435],{"type":39,"tag":59,"props":429,"children":431},{"className":430},[],[432],{"type":44,"value":433},"_dev\u002Fbuild\u002Fbuild.yml",{"type":44,"value":344},{"type":39,"tag":59,"props":436,"children":438},{"className":437},[],[439],{"type":44,"value":440},"dependencies.ecs.reference: \"git@v9.5.0\"",{"type":39,"tag":78,"props":442,"children":443},{},[444,446,452,453],{"type":44,"value":445},"Pipeline ",{"type":39,"tag":59,"props":447,"children":449},{"className":448},[],[450],{"type":44,"value":451},"ecs.version",{"type":44,"value":344},{"type":39,"tag":59,"props":454,"children":456},{"className":455},[],[457],{"type":44,"value":458},"9.5.0",{"type":39,"tag":53,"props":460,"children":461},{},[462,464,469],{"type":44,"value":463},"The two must match. Standard (non-entity) packages keep ",{"type":39,"tag":59,"props":465,"children":467},{"className":466},[],[468],{"type":44,"value":342},{"type":44,"value":470},".",{"type":39,"tag":53,"props":472,"children":473},{},[474],{"type":44,"value":475},"To verify at any tag:",{"type":39,"tag":477,"props":478,"children":483},"pre",{"className":479,"code":480,"language":481,"meta":482,"style":482},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","curl -s https:\u002F\u002Fraw.githubusercontent.com\u002Felastic\u002Fecs\u002F\u003Ctag>\u002Fgenerated\u002Fcsv\u002Ffields.csv \\\n  | awk -F, '$3==\"entity\"' | cut -d, -f4,5 | sort -u\n","bash","",[484],{"type":39,"tag":59,"props":485,"children":486},{"__ignoreMap":482},[487,542],{"type":39,"tag":488,"props":489,"children":492},"span",{"class":490,"line":491},"line",1,[493,499,505,510,516,521,527,532,537],{"type":39,"tag":488,"props":494,"children":496},{"style":495},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[497],{"type":44,"value":498},"curl",{"type":39,"tag":488,"props":500,"children":502},{"style":501},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[503],{"type":44,"value":504}," -s",{"type":39,"tag":488,"props":506,"children":507},{"style":501},[508],{"type":44,"value":509}," https:\u002F\u002Fraw.githubusercontent.com\u002Felastic\u002Fecs\u002F",{"type":39,"tag":488,"props":511,"children":513},{"style":512},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[514],{"type":44,"value":515},"\u003C",{"type":39,"tag":488,"props":517,"children":518},{"style":501},[519],{"type":44,"value":520},"ta",{"type":39,"tag":488,"props":522,"children":524},{"style":523},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[525],{"type":44,"value":526},"g",{"type":39,"tag":488,"props":528,"children":529},{"style":512},[530],{"type":44,"value":531},">",{"type":39,"tag":488,"props":533,"children":534},{"style":501},[535],{"type":44,"value":536},"\u002Fgenerated\u002Fcsv\u002Ffields.csv",{"type":39,"tag":488,"props":538,"children":539},{"style":523},[540],{"type":44,"value":541}," \\\n",{"type":39,"tag":488,"props":543,"children":545},{"class":490,"line":544},2,[546,551,556,561,566,571,576,581,586,591,596,600,605],{"type":39,"tag":488,"props":547,"children":548},{"style":512},[549],{"type":44,"value":550},"  |",{"type":39,"tag":488,"props":552,"children":553},{"style":495},[554],{"type":44,"value":555}," awk",{"type":39,"tag":488,"props":557,"children":558},{"style":501},[559],{"type":44,"value":560}," -F,",{"type":39,"tag":488,"props":562,"children":563},{"style":512},[564],{"type":44,"value":565}," '",{"type":39,"tag":488,"props":567,"children":568},{"style":501},[569],{"type":44,"value":570},"$3==\"entity\"",{"type":39,"tag":488,"props":572,"children":573},{"style":512},[574],{"type":44,"value":575},"'",{"type":39,"tag":488,"props":577,"children":578},{"style":512},[579],{"type":44,"value":580}," |",{"type":39,"tag":488,"props":582,"children":583},{"style":495},[584],{"type":44,"value":585}," cut",{"type":39,"tag":488,"props":587,"children":588},{"style":501},[589],{"type":44,"value":590}," -d,",{"type":39,"tag":488,"props":592,"children":593},{"style":501},[594],{"type":44,"value":595}," -f4,5",{"type":39,"tag":488,"props":597,"children":598},{"style":512},[599],{"type":44,"value":580},{"type":39,"tag":488,"props":601,"children":602},{"style":495},[603],{"type":44,"value":604}," sort",{"type":39,"tag":488,"props":606,"children":607},{"style":501},[608],{"type":44,"value":609}," -u\n",{"type":39,"tag":46,"props":611,"children":613},{"id":612},"modes",[614],{"type":44,"value":615},"Modes",{"type":39,"tag":617,"props":618,"children":619},"table",{},[620,644],{"type":39,"tag":621,"props":622,"children":623},"thead",{},[624],{"type":39,"tag":625,"props":626,"children":627},"tr",{},[628,634,639],{"type":39,"tag":629,"props":630,"children":631},"th",{},[632],{"type":44,"value":633},"Mode",{"type":39,"tag":629,"props":635,"children":636},{},[637],{"type":44,"value":638},"How it's triggered",{"type":39,"tag":629,"props":640,"children":641},{},[642],{"type":44,"value":643},"What to load",{"type":39,"tag":645,"props":646,"children":647},"tbody",{},[648,699,750,793],{"type":39,"tag":625,"props":649,"children":650},{},[651,660,671],{"type":39,"tag":652,"props":653,"children":654},"td",{},[655],{"type":39,"tag":161,"props":656,"children":657},{},[658],{"type":44,"value":659},"Standalone gap analysis",{"type":39,"tag":652,"props":661,"children":662},{},[663,665],{"type":44,"value":664},"User invokes ",{"type":39,"tag":59,"props":666,"children":668},{"className":667},[],[669],{"type":44,"value":670},"\u002Fentity-mappings @packages\u002F\u003Cname>",{"type":39,"tag":652,"props":672,"children":673},{},[674,676,682,684,690,692,698],{"type":44,"value":675},"Read ",{"type":39,"tag":59,"props":677,"children":679},{"className":678},[],[680],{"type":44,"value":681},"references\u002Fgap-analysis-workflow.md",{"type":44,"value":683}," and ",{"type":39,"tag":59,"props":685,"children":687},{"className":686},[],[688],{"type":44,"value":689},"references\u002Fentity-field-catalog.md",{"type":44,"value":691},". Dispatch per-stream subagents via ",{"type":39,"tag":59,"props":693,"children":695},{"className":694},[],[696],{"type":44,"value":697},"references\u002Fanalysis-subagent-guidance.md",{"type":44,"value":470},{"type":39,"tag":625,"props":700,"children":701},{},[702,710,745],{"type":39,"tag":652,"props":703,"children":704},{},[705],{"type":39,"tag":161,"props":706,"children":707},{},[708],{"type":44,"value":709},"Build-time",{"type":39,"tag":652,"props":711,"children":712},{},[713,715,721,723,729,731,736,737,743],{"type":44,"value":714},"Orchestrator (",{"type":39,"tag":59,"props":716,"children":718},{"className":717},[],[719],{"type":44,"value":720},"create-integration",{"type":44,"value":722}," or ",{"type":39,"tag":59,"props":724,"children":726},{"className":725},[],[727],{"type":44,"value":728},"add-datastream",{"type":44,"value":730},") passes ",{"type":39,"tag":59,"props":732,"children":734},{"className":733},[],[735],{"type":44,"value":689},{"type":44,"value":683},{"type":39,"tag":59,"props":738,"children":740},{"className":739},[],[741],{"type":44,"value":742},"references\u002Fentity-pipeline-patterns.md",{"type":44,"value":744}," by path to the pipeline builder subagent",{"type":39,"tag":652,"props":746,"children":747},{},[748],{"type":44,"value":749},"Pipeline builder reads both references; this skill's SKILL.md is not loaded into the orchestrator thread.",{"type":39,"tag":625,"props":751,"children":752},{},[753,761,772],{"type":39,"tag":652,"props":754,"children":755},{},[756],{"type":39,"tag":161,"props":757,"children":758},{},[759],{"type":44,"value":760},"Review-time",{"type":39,"tag":652,"props":762,"children":763},{},[764,770],{"type":39,"tag":59,"props":765,"children":767},{"className":766},[],[768],{"type":44,"value":769},"review-integration",{"type":44,"value":771}," Step 4 loads the two references when the entity detection rule fires",{"type":39,"tag":652,"props":773,"children":774},{},[775,777,783,785,791],{"type":44,"value":776},"Reviewer reads ",{"type":39,"tag":59,"props":778,"children":780},{"className":779},[],[781],{"type":44,"value":782},"entity-field-catalog.md",{"type":44,"value":784}," + ",{"type":39,"tag":59,"props":786,"children":788},{"className":787},[],[789],{"type":44,"value":790},"entity-pipeline-patterns.md",{"type":44,"value":792},"; this SKILL.md is not required in the reviewer thread.",{"type":39,"tag":625,"props":794,"children":795},{},[796,804,820],{"type":39,"tag":652,"props":797,"children":798},{},[799],{"type":39,"tag":161,"props":800,"children":801},{},[802],{"type":44,"value":803},"Research-time",{"type":39,"tag":652,"props":805,"children":806},{},[807,813,815],{"type":39,"tag":59,"props":808,"children":810},{"className":809},[],[811],{"type":44,"value":812},"research-integration",{"type":44,"value":814}," loads only ",{"type":39,"tag":59,"props":816,"children":818},{"className":817},[],[819],{"type":44,"value":285},{"type":39,"tag":652,"props":821,"children":822},{},[823,828],{"type":39,"tag":161,"props":824,"children":825},{},[826],{"type":44,"value":827},"Do not load the rest of this skill during research",{"type":44,"value":829}," — the catalog and pipeline patterns are implementation material and violate the research guardrail against prescribing pipeline\u002Ffield details.",{"type":39,"tag":46,"props":831,"children":833},{"id":832},"open-questions-deferred-scope",[834],{"type":44,"value":835},"Open questions \u002F deferred scope",{"type":39,"tag":53,"props":837,"children":838},{},[839],{"type":44,"value":840},"The following topics are out of scope for this skill's v1:",{"type":39,"tag":74,"props":842,"children":843},{},[844,862],{"type":39,"tag":78,"props":845,"children":846},{},[847,852,854,860],{"type":39,"tag":161,"props":848,"children":849},{},[850],{"type":44,"value":851},"Entity-store latest transforms.",{"type":44,"value":853}," The CDR precedent has a third leg (",{"type":39,"tag":59,"props":855,"children":857},{"className":856},[],[858],{"type":44,"value":859},"review-integration\u002Freferences\u002Fcdr-transform-requirements.md",{"type":44,"value":861},") covering latest transforms per integration. Whether new entity data streams should ship an accompanying latest transform is not yet resolved. Note it as an open question in research briefs and gap analysis reports until that decision is made.",{"type":39,"tag":78,"props":863,"children":864},{},[865,870],{"type":39,"tag":161,"props":866,"children":867},{},[868],{"type":44,"value":869},"Repo-wide ECS pin bump to v9.5.0.",{"type":44,"value":871}," Recommended as a follow-up once entity streams are common; the conditional exception in this skill carries packages until then.",{"type":39,"tag":46,"props":873,"children":875},{"id":874},"references",[876],{"type":44,"value":877},"References",{"type":39,"tag":74,"props":879,"children":880},{},[881,898,916,926,936,947,957],{"type":39,"tag":78,"props":882,"children":883},{},[884,889,891,896],{"type":39,"tag":59,"props":885,"children":887},{"className":886},[],[888],{"type":44,"value":689},{"type":44,"value":890}," — single source of truth: ECS availability matrix, reusable nesting, ",{"type":39,"tag":59,"props":892,"children":894},{"className":893},[],[895],{"type":44,"value":98},{"type":44,"value":897}," allowed values, categorization, Must Have \u002F Should Have field tables, disambiguation guide, field definition YAML examples, review checklist",{"type":39,"tag":78,"props":899,"children":900},{},[901,906,908,914],{"type":39,"tag":59,"props":902,"children":904},{"className":903},[],[905],{"type":44,"value":742},{"type":44,"value":907}," — pipeline-side patterns: categorization processors, building ",{"type":39,"tag":59,"props":909,"children":911},{"className":910},[],[912],{"type":44,"value":913},"entity.id",{"type":44,"value":915},", boolean coercion, array attributes, relationship objects, anti-patterns, pipeline review checklist",{"type":39,"tag":78,"props":917,"children":918},{},[919,924],{"type":39,"tag":59,"props":920,"children":922},{"className":921},[],[923],{"type":44,"value":285},{"type":44,"value":925}," — research-time and review-time rules for classifying a data stream as entity vs event; worked examples",{"type":39,"tag":78,"props":927,"children":928},{},[929,934],{"type":39,"tag":59,"props":930,"children":932},{"className":931},[],[933],{"type":44,"value":681},{"type":44,"value":935}," — 4-phase standalone analysis: classify streams → read package → fetch docs → map fields → investigate gaps → write report",{"type":39,"tag":78,"props":937,"children":938},{},[939,945],{"type":39,"tag":59,"props":940,"children":942},{"className":941},[],[943],{"type":44,"value":944},"references\u002Fgap-analysis-report-template.md",{"type":44,"value":946}," — structured report template for gap analysis output",{"type":39,"tag":78,"props":948,"children":949},{},[950,955],{"type":39,"tag":59,"props":951,"children":953},{"className":952},[],[954],{"type":44,"value":697},{"type":44,"value":956}," — operating manual for per-stream analysis subagents dispatched during gap analysis",{"type":39,"tag":78,"props":958,"children":959},{},[960],{"type":39,"tag":961,"props":962,"children":966},"a",{"href":963,"rel":964},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Freference\u002Fecs\u002Fecs-entity",[965],"nofollow",[967],{"type":44,"value":968},"ECS entity fieldset reference",{"type":39,"tag":970,"props":971,"children":972},"style",{},[973],{"type":44,"value":974},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":976,"total":1148},[977,996,1013,1028,1047,1059,1069,1084,1096,1111,1122,1135],{"slug":978,"name":978,"fn":979,"description":980,"org":981,"tags":982,"stars":993,"repoUrl":994,"updatedAt":995},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[983,986,989,990],{"name":984,"slug":985,"type":15},"Analytics","analytics",{"name":987,"slug":988,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":991,"slug":992,"type":15},"Performance","performance",2029,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-08-23T03:32:52.415006",{"slug":997,"name":997,"fn":998,"description":999,"org":1000,"tags":1001,"stars":993,"repoUrl":994,"updatedAt":1012},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1002,1005,1006,1009],{"name":1003,"slug":1004,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":1007,"slug":1008,"type":15},"Engineering","engineering",{"name":1010,"slug":1011,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":1014,"name":1014,"fn":1015,"description":1016,"org":1017,"tags":1018,"stars":993,"repoUrl":994,"updatedAt":1027},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1019,1020,1023,1024],{"name":9,"slug":8,"type":15},{"name":1021,"slug":1022,"type":15},"Elasticsearch","elasticsearch",{"name":991,"slug":992,"type":15},{"name":1025,"slug":1026,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":1029,"name":1029,"fn":1030,"description":1031,"org":1032,"tags":1033,"stars":1044,"repoUrl":1045,"updatedAt":1046},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1034,1037,1038,1041],{"name":1035,"slug":1036,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":1039,"slug":1040,"type":15},"Operations","operations",{"name":1042,"slug":1043,"type":15},"Permissions","permissions",547,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:44.946285",{"slug":1048,"name":1048,"fn":1049,"description":1050,"org":1051,"tags":1052,"stars":1044,"repoUrl":1045,"updatedAt":1058},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1053,1054,1057],{"name":1035,"slug":1036,"type":15},{"name":1055,"slug":1056,"type":15},"Deployment","deployment",{"name":1021,"slug":1022,"type":15},"2026-07-12T07:46:42.353362",{"slug":1060,"name":1060,"fn":1061,"description":1062,"org":1063,"tags":1064,"stars":1044,"repoUrl":1045,"updatedAt":1068},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1065,1066,1067],{"name":1035,"slug":1036,"type":15},{"name":1021,"slug":1022,"type":15},{"name":1039,"slug":1040,"type":15},"2026-07-12T07:46:41.097412",{"slug":1070,"name":1070,"fn":1071,"description":1072,"org":1073,"tags":1074,"stars":1044,"repoUrl":1045,"updatedAt":1083},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1075,1076,1077,1080],{"name":1035,"slug":1036,"type":15},{"name":1021,"slug":1022,"type":15},{"name":1078,"slug":1079,"type":15},"Networking","networking",{"name":1081,"slug":1082,"type":15},"Security","security","2026-07-12T07:46:43.675992",{"slug":1085,"name":1085,"fn":1086,"description":1087,"org":1088,"tags":1089,"stars":1044,"repoUrl":1045,"updatedAt":1095},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1090,1093,1094],{"name":1091,"slug":1092,"type":15},"Authentication","authentication",{"name":1035,"slug":1036,"type":15},{"name":1021,"slug":1022,"type":15},"2026-07-12T07:46:39.783105",{"slug":1097,"name":1097,"fn":1098,"description":1099,"org":1100,"tags":1101,"stars":1044,"repoUrl":1045,"updatedAt":1110},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1102,1105,1106,1109],{"name":1103,"slug":1104,"type":15},"Audit","audit",{"name":1021,"slug":1022,"type":15},{"name":1107,"slug":1108,"type":15},"Logs","logs",{"name":1081,"slug":1082,"type":15},"2026-07-12T07:47:35.092599",{"slug":1112,"name":1112,"fn":1113,"description":1114,"org":1115,"tags":1116,"stars":1044,"repoUrl":1045,"updatedAt":1121},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1117,1118,1119,1120],{"name":1091,"slug":1092,"type":15},{"name":9,"slug":8,"type":15},{"name":1021,"slug":1022,"type":15},{"name":1081,"slug":1082,"type":15},"2026-07-12T07:47:41.474547",{"slug":1123,"name":1123,"fn":1124,"description":1125,"org":1126,"tags":1127,"stars":1044,"repoUrl":1045,"updatedAt":1134},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1128,1129,1130,1133],{"name":9,"slug":8,"type":15},{"name":1021,"slug":1022,"type":15},{"name":1131,"slug":1132,"type":15},"RBAC","rbac",{"name":1081,"slug":1082,"type":15},"2026-07-12T07:47:36.394177",{"slug":1136,"name":1136,"fn":1137,"description":1138,"org":1139,"tags":1140,"stars":1044,"repoUrl":1045,"updatedAt":1147},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1141,1142,1143,1144],{"name":984,"slug":985,"type":15},{"name":987,"slug":988,"type":15},{"name":1021,"slug":1022,"type":15},{"name":1145,"slug":1146,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",93,{"items":1150,"total":20},[1151,1166,1180,1188,1205,1218,1230],{"slug":1152,"name":1152,"fn":1153,"description":1154,"org":1155,"tags":1156,"stars":20,"repoUrl":21,"updatedAt":1165},"anonymize-logs","anonymize sensitive log data","Anonymize and sanitize customer-provided log files. Performs a line-by-line review and replaces all sensitive values inline, preserving log structure and format exactly — never reformats, re-indents, or restructures content. Use when sanitizing customer logs, sample events, or test fixtures. Invoke manually with \u002Fanonymize-logs.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1157,1160,1161,1164],{"name":1158,"slug":1159,"type":15},"Data Cleaning","data-cleaning",{"name":1107,"slug":1108,"type":15},{"name":1162,"slug":1163,"type":15},"Privacy","privacy",{"name":1081,"slug":1082,"type":15},"2026-08-26T03:39:42.90925",{"slug":250,"name":250,"fn":1167,"description":1168,"org":1169,"tags":1170,"stars":20,"repoUrl":21,"updatedAt":1179},"write CEL programs for data collection","Use for all CEL and mito work on integrations that collect from APIs — writing CEL programs, cel.yml.hbs templates, manifest configuration, mock-first development with the mito CLI, system test mock setup, and answering CEL\u002Fmito questions. Load this skill whenever any data stream uses the cel input type.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1171,1174,1175,1176],{"name":1172,"slug":1173,"type":15},"API Development","api-development",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},{"name":1177,"slug":1178,"type":15},"Integrations","integrations","2026-08-26T03:39:37.832771",{"slug":720,"name":720,"fn":1181,"description":1182,"org":1183,"tags":1184,"stars":20,"repoUrl":21,"updatedAt":1187},"create Elastic integration packages","Use when creating a new Elastic integration package, scaffolding data streams, answering package layout or structure questions, or running the end-to-end integration build workflow. Covers package topology, scaffold commands, post-scaffold edits, and full orchestration of CEL\u002Fpipeline\u002Ftest subagents.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1185,1186],{"name":1021,"slug":1022,"type":15},{"name":1177,"slug":1178,"type":15},"2026-07-12T07:46:56.318866",{"slug":1189,"name":1189,"fn":1190,"description":1191,"org":1192,"tags":1193,"stars":20,"repoUrl":21,"updatedAt":1204},"dashboard-guidelines","create and review Kibana dashboard assets","Use when creating or reviewing Kibana assets in packages, including dashboard export structure, naming, and data stream alignment.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1194,1197,1198,1201],{"name":1195,"slug":1196,"type":15},"Dashboards","dashboards",{"name":1021,"slug":1022,"type":15},{"name":1199,"slug":1200,"type":15},"Kibana","kibana",{"name":1202,"slug":1203,"type":15},"UI Components","ui-components","2026-07-12T07:47:07.702332",{"slug":1206,"name":1206,"fn":1207,"description":1208,"org":1209,"tags":1210,"stars":20,"repoUrl":21,"updatedAt":1217},"dashboard-review","review Elastic dashboard JSON changes","Use when reviewing dashboard JSON changes in a PR or branch. Extracts structured descriptions with kbdash, compares before\u002Fafter, and checks guideline compliance.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1211,1214,1215,1216],{"name":1212,"slug":1213,"type":15},"Code Review","code-review",{"name":1195,"slug":1196,"type":15},{"name":9,"slug":8,"type":15},{"name":1199,"slug":1200,"type":15},"2026-08-26T03:39:41.799257",{"slug":215,"name":215,"fn":1219,"description":1220,"org":1221,"tags":1222,"stars":20,"repoUrl":21,"updatedAt":1229},"define ECS field mappings for integrations","Use when defining field mappings for data streams, populating ecs.yml with ECS field references, selecting ECS categorization values, choosing custom field types, or troubleshooting mapping validation failures.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1223,1224,1227,1228],{"name":18,"slug":19,"type":15},{"name":1225,"slug":1226,"type":15},"Data Quality","data-quality",{"name":9,"slug":8,"type":15},{"name":1177,"slug":1178,"type":15},"2026-08-26T03:39:39.829597",{"slug":1231,"name":1231,"fn":1232,"description":1233,"org":1234,"tags":1235,"stars":20,"repoUrl":21,"updatedAt":1242},"elastic-package-cli","develop and validate Elastic integrations","Use when developing or validating Elastic integrations with elastic-package commands such as build, check, lint, format, test, stack, service, install, profiles, and benchmark.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1236,1239,1240,1241],{"name":1237,"slug":1238,"type":15},"CLI","cli",{"name":9,"slug":8,"type":15},{"name":1177,"slug":1178,"type":15},{"name":1025,"slug":1026,"type":15},"2026-07-12T07:46:57.647395"]