[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-research-integration":3,"mdc-8keo6u-key":33,"related-repo-elastic-research-integration":2889,"related-org-elastic-research-integration":2994},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":22,"repoUrl":23,"updatedAt":24,"license":25,"forks":26,"topics":27,"repo":28,"sourceUrl":31,"mdContent":32},"research-integration","research vendors for Elastic integrations","Research a vendor, product, or feature to collect all information needed before building an Elastic integration. Investigates data collection methods, API or log documentation, sample data formats, field schemas, ECS mapping candidates, and configuration requirements. Outputs a structured research brief to research_results\u002F\u003Cproduct>\u002F. Invoke manually with \u002Fresearch-integration.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19],{"name":13,"slug":14,"type":15},"Research","research","tag",{"name":17,"slug":18,"type":15},"Integrations","integrations",{"name":20,"slug":21,"type":15},"Elasticsearch","elasticsearch",11,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegration-skills","2026-07-12T07:47:02.729329","Apache-2.0",2,[],{"repoUrl":23,"stars":22,"forks":26,"topics":29,"description":30},[],null,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegration-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fresearch-integration","---\nname: research-integration\ndescription: \"Research a vendor, product, or feature to collect all information needed before building an Elastic integration. Investigates data collection methods, API or log documentation, sample data formats, field schemas, ECS mapping candidates, and configuration requirements. Outputs a structured research brief to research_results\u002F\u003Cproduct>\u002F. Invoke manually with \u002Fresearch-integration.\"\nlicense: Apache-2.0\nmetadata:\n  author: elastic\n  version: \"1.0\"\ndisable-model-invocation: true\n---\n\n# Research Integration\n\nYou are the **research orchestrator**. Your job is to thoroughly investigate a vendor, product, or feature and produce a structured research brief that a downstream integration builder can use as the primary input for `\u002Fcreate-integration`.\n\nYou delegate parallel research and analysis to research subagents, synthesize their findings with any locally provided reference material and your own grounded knowledge, and write the final brief to disk.\n\nEach research subagent is dispatched via the platform's **generic \u002F general-purpose subagent** (Cursor: `generalPurpose` Task agent; Claude Code: `general-purpose` Task agent; or the equivalent on other platforms). The subagent reads its operating manual (`references\u002Fresearch-subagent-guidance.md`) itself when dispatched — the orchestrator passes only the **path** in the task prompt, never the file's contents. See \"Before you start\" below.\n\nResearch subagents are **write-capable** -- they can download repositories, install packages, run Python analysis scripts, and write findings to files on disk. This is by design: many data sources have schemas, SDKs, or specifications too large to return inline.\n\n## What you provide\n\nInclude any combination of the following when you invoke this command.\nUse `@`-mentions for files\u002Ffolders and paste links inline.\n\n| Input | How to provide | Examples |\n|-------|----------------|----------|\n| Product \u002F vendor \u002F feature | free text | \"Checkpoint Harmony Endpoint\", \"Okta System Log\", \"AWS CloudTrail via S3\" |\n| Known collection method | free text (optional) | \"REST API\", \"syslog\", \"S3\u002FSQS\", \"Azure Event Hub\" |\n| Documentation URLs | paste URLs | `https:\u002F\u002Fdocs.vendor.com\u002Fapi\u002Fv2`, `https:\u002F\u002Fdocs.vendor.com\u002Flogging-guide` |\n| Local reference material | `@`-mention files | `@samples\u002Fvendor_event.json`, `@notes\u002Fvendor-api-notes.md` |\n| Scope constraints | free text | \"only the alerts API\", \"focus on firewall logs\", \"audit events only\" |\n| Output name override | free text | \"checkpoint_harmony\" (defaults to sanitized product name) |\n\nAnything typed after `\u002Fresearch-integration` is your research goal.\n\n### Invocation examples\n\n```\n\u002Fresearch-integration Checkpoint Harmony Endpoint security events\n  API docs: https:\u002F\u002Fdeveloper.checkpoint.com\u002Freference\u002Fharmony-endpoint\n  Focus on: alerts, threat events, and audit logs.\n  Known method: REST API with pagination.\n```\n\n```\n\u002Fresearch-integration Palo Alto Cortex XDR\n  @notes\u002Fcortex-xdr-api-rough-notes.md\n  Need to investigate both the Incidents API and Alerts API.\n```\n\n```\n\u002Fresearch-integration Cisco Meraki syslog events\n  https:\u002F\u002Fdocumentation.meraki.com\u002FGeneral_Administration\u002FMonitoring_and_Reporting\u002FSyslog_Event_Types_and_Log_Samples\n  Focus on: firewall, URL, and IDS event types.\n  Known method: syslog over UDP\u002FTCP.\n```\n\n```\n\u002Fresearch-integration AWS Security Hub findings via S3\u002FSQS\n  Need full schema of ASFF finding format and S3 delivery configuration.\n```\n\n## Before you start -- load references\n\nRead these reference files from this skill's directory to guide your research strategy:\n\n1. `references\u002Fdata-collection-methods.md` -- understand input types and what to investigate for each\n2. `references\u002Fresearch-output-template.md` -- the structure your final brief must follow\n3. Based on the identified collection method, read the applicable checklist:\n   - `references\u002Fapi-research-checklist.md` -- for REST API \u002F CEL-based collection\n   - `references\u002Flog-file-research-checklist.md` -- for syslog, file-based, and local log collection\n   - `references\u002Fcloud-ingest-research-checklist.md` -- for S3\u002FSQS, Event Hub, Pub\u002FSub, and similar cloud delivery\n4. If the collection method is (or turns out to be) API-based, also read:\n   - `references\u002Ftest-api-script-spec.md` -- specification for the API test script generated in Phase 7\n\nIf the collection method is unknown at invocation time, read all three checklists -- part of your job is to determine the method.\n\nAlso load:\n\n5. `ecs-field-mappings` skill -- for ECS field mapping guidance during the analysis phase\n6. `references\u002Fcompetitive-siem-coverage-checklist.md` -- read this yourself so you know what to pass through; when dispatching the Track E subagent, point it at this file **by path** (do NOT paste its contents into the task prompt). The Track E subagent will read it in its own fresh context.\n7. `references\u002Fresearch-subagent-guidance.md` -- the operating manual every research subagent needs. **Do NOT read this file yourself** unless you specifically need to debug a subagent's behaviour. Instead, point every research subagent at this file **by path** in its task prompt and instruct it to read the file end-to-end before doing any other work. Embedding the file verbatim doubles its context cost.\n\nDo **not** load other integration-building skills (CEL, pipelines, ecs-field-mappings implementation details, etc.). Those are for implementation, not research.\n\n## Output location\n\nWrite all research output to:\n\n```\nresearch_results\u002F\u003Cproduct_slug>\u002F\n```\n\nWhere `\u003Cproduct_slug>` is a lowercase, underscore-separated identifier derived from the product name (e.g., `checkpoint_harmony_endpoint`, `palo_alto_cortex_xdr`, `cisco_meraki`). The user may override this with the \"Output name override\" input.\n\nCreate this directory structure:\n\n```\nresearch_results\u002F\u003Cproduct_slug>\u002F\n  research-brief.md           # the main structured research brief\n  test-api.py                 # API connectivity & flow test script (API\u002FCEL only)\n  references\u002F                 # curated research artifacts for downstream consumers\n    api-spec-notes.md         # API endpoint details, request\u002Fresponse examples (if API)\n    log-format-notes.md       # log format details, sample lines (if log-based)\n    field-schema-analysis.md  # detailed field inventories written by subagents\n    competitive-siem-coverage.md  # detailed competitive SIEM analysis (always created)\n    sample-events\u002F            # representative sample data files\n      \u003Cevent_type>.json       # one file per event type or data format variant\n      \u003Cevent_type>.log\n  temp\u002F                       # downloaded raw artifacts (repos, SDKs, schemas, scripts)\n    \u003Cdescriptive-subfolder>\u002F  # e.g., vendor-sdk\u002F, schema-files\u002F, openapi-spec\u002F\n  ecs-mapping-analysis.md     # initial ECS field mapping analysis\n  configuration-plan.md       # planned integration configuration variables\n```\n\nNot all files are required -- create only what applies to the product's collection method.\n\n**Important: the `temp\u002F` directory** is used by subagents to download git repositories, SDK sources, large schema files, and other raw artifacts they need to analyze. Do not delete `temp\u002F` after research completes -- it serves as a reference for the human and may be useful for follow-up work.\n\n## Workflow\n\n### Phase 1: Parse and plan\n\n1. Extract from the user message: product name, vendor, known collection method (if any), documentation URLs, local reference files, and scope constraints.\n2. Read any `@`-mentioned local files.\n3. Fetch any documentation URLs provided inline to get initial context.\n4. Determine the output slug and create the output directory.\n5. Identify which research tracks to pursue based on what is known and unknown.\n\n### Phase 2: Parallel research\n\nLaunch multiple research subagents in parallel using the platform's generic \u002F general-purpose subagent (see the dispatch description at the top of this skill). Each subagent focuses on a specific research track. **You should launch as many parallel subagents as makes sense for the product -- typically 2-4 subagents, plus the always-on Track E.**\n\n**IMPORTANT -- subagent context and capabilities:**\n\n- Subagents cannot see your conversation or access `@`-mentioned files directly. Include any relevant content from local reference files and fetched URLs in the task prompt.\n- Subagents are **write-capable**. Always tell each subagent its **working directory** (`research_results\u002F\u003Cproduct_slug>\u002F`) so it can write to `temp\u002F` and `references\u002F` within it.\n- Subagents can **download resources**: clone git repos, install pip\u002Fnpm packages, fetch large files -- all into `temp\u002F` under the working directory.\n- Subagents can **run Python scripts** (or other tools) to analyze large artifacts like JSON schemas, OpenAPI specs, or SDK model files. Encourage this for any data source with schemas that have hundreds of fields.\n- Subagents should **write large findings to files** in `references\u002F` or `temp\u002F` and return a **concise summary** with file paths rather than returning everything inline. This keeps context manageable.\n\n**Required structure for every research subagent task prompt:**\n\n1. **Begin with an instruction to read `references\u002Fresearch-subagent-guidance.md`** (relative to the `research-integration` skill) end-to-end before doing any other work. That file is the subagent's operating manual — methodology, `temp\u002F` usage, Python analysis idiom, result delivery contract, quality standards, and anonymization conventions. **Pass only the path; do NOT paste\u002Fembed the file's contents into the task prompt** — the subagent must load it in its own fresh context to avoid doubling the context cost. Track E follows the same pattern for the competitive-SIEM checklist.\n2. **State the working directory explicitly** so the subagent knows where to write:\n   ```\n   Working directory: research_results\u002F\u003Cproduct_slug>\u002F\n   - Download raw artifacts to: research_results\u002F\u003Cproduct_slug>\u002Ftemp\u002F\n   - Write curated findings to: research_results\u002F\u003Cproduct_slug>\u002Freferences\u002F\n   ```\n3. **Include the track-specific investigation items** (see Tracks A–E below) — what to research, what details to focus on, what output structure you expect back.\n4. **Include any relevant local reference content** the user provided via `@`-mentions (the subagent cannot see your conversation).\n5. **Include any documentation URLs** the user provided inline.\n\n#### Research Track A: Product overview and data collection methods\n\nInstruct the subagent to investigate:\n- What the product\u002Ffeature is and what kind of data it generates\n- All available methods for collecting\u002Fexporting data (API, syslog, file export, cloud streaming, SIEM forwarding, etc.)\n- Which method is best suited for an Elastic integration and why\n- Official vendor documentation links for each collection method\n- Any known limitations, rate limits, or licensing requirements for data access\n\nProvide: product name, vendor, any known collection method, any documentation URLs.\n\n#### Research Track B: Data source deep dive\n\nInstruct the subagent to investigate the specifics of the data source based on the most likely collection method:\n\n**For APIs:**\n- Base URL and endpoint paths\n- Authentication method (API key, OAuth2, Bearer token, Basic auth, custom headers)\n- **OAuth2 deep dive (critical):** If the API uses OAuth2, identify ALL supported grant types (client_credentials, authorization_code, etc.) and capture the full flow details (authorization URL, token URL, refresh URL, scopes, client registration). Do NOT settle for \"manual token generation\" if a proper OAuth2 flow exists — many vendors document both a PAT\u002Fmanual token page and a standard OAuth2 authorization_code flow on separate documentation pages. See `api-research-checklist.md` for the detailed OAuth2 investigation checklist.\n- Pagination pattern (offset, cursor, link-header, token-based, keyset)\n- Rate limiting details\n- Request and response structure with field-level detail\n- Available query parameters and filters (especially time-based filtering)\n- API versioning approach\n- Complete request\u002Fresponse examples for each relevant endpoint\n- If the vendor publishes an **OpenAPI\u002FSwagger spec or SDK**, instruct the subagent to download it into `temp\u002F` and use Python to extract endpoint details, request\u002Fresponse schemas, and parameter definitions\n\n**For logs\u002Fsyslog:**\n- Log format (syslog RFC 3164\u002F5424, CEF, LEEF, key-value, JSON, CSV, multiline)\n- Default log file paths per OS\n- Syslog facility and severity usage\n- Message structure and delimiters\n- Sample log lines for each event type\n\n**For cloud ingest (S3\u002FSQS, Event Hub, Pub\u002FSub, etc.):**\n- Delivery mechanism configuration\n- Message\u002Fobject format and structure\n- Path\u002Fprefix patterns\n- Notification configuration requirements\n- If the vendor provides **schema definitions in a repository** (e.g., AWS OCSF schemas, Azure resource schemas), instruct the subagent to clone the repo into `temp\u002F` and analyze the schemas programmatically\n\nProvide: product name, likely collection method, any documentation URLs, any local reference material content.\n\n#### Research Track C: Event types and field schema\n\nInstruct the subagent to investigate:\n- All distinct event types, categories, or log sources the product generates\n- Field names, types, and descriptions for each event type\n- Common fields across event types vs. type-specific fields\n- Enumeration values for status, severity, action, and category fields\n- Timestamp formats and timezone handling\n- Nested object structures\n- Which events are highest-value for security\u002Fobservability use cases\n\n**For data sources with large schemas:** Instruct the subagent to download the schema source (git repo, SDK package, JSON schema file) into `temp\u002F` and use Python to programmatically extract field inventories, type information, and enum values. The subagent should write the complete field analysis to `references\u002Ffield-schema-analysis.md` (or multiple files if per-event-type breakdowns are needed) and return a summary.\n\nProvide: product name, any documentation URLs, any sample data content from local files.\n\n#### Research Track D: Configuration and deployment (optional, launch if needed)\n\nInstruct the subagent to investigate:\n- What configuration the end user needs to provide (credentials, URLs, paths, filters)\n- How to enable\u002Fconfigure data export on the vendor side\n- Network requirements (ports, protocols, firewall rules)\n- Common deployment architectures\n- Prerequisites and permissions needed\n\nProvide: product name, collection method, any documentation URLs.\n\n#### Research Track E: Competitive SIEM coverage (always launch)\n\n**Always launch this track** in parallel with the other tracks. It is not conditional on collection method.\n\nInstruct the subagent to check whether IBM QRadar, Splunk, and Sumo Logic have an existing integration or app for the product being researched, and to document what each covers and how it collects data.\n\nThe subagent must follow `references\u002Fcompetitive-siem-coverage-checklist.md` end-to-end. Point the subagent at that file **by path** and instruct it to read the entire file before doing any other work. **Do NOT paste the checklist contents into the task prompt** — the subagent will load it in its own fresh context. (This is in addition to the read-`references\u002Fresearch-subagent-guidance.md`-by-path directive from Phase 2.)\n\nCompetitor catalog starting points to include in the prompt:\n- IBM QRadar: `https:\u002F\u002Fwww.ibm.com\u002Fproducts\u002Fqradar-siem\u002Fintegrations`\n- Splunk: `https:\u002F\u002Fsplunkbase.splunk.com\u002Fapps`\n- Sumo Logic: `https:\u002F\u002Fwww.sumologic.com\u002Fhelp\u002Fdocs\u002Fintegrations\u002F`\n\nFor each competitor, the subagent must determine:\n- Whether a matching integration\u002Fapp exists (exact, partial, or no match)\n- Integration\u002Fapp name, publisher, direct catalog link, version, and last-updated date\n- Which data sources and event types it covers (be specific, not generic)\n- Collection method used (API pull, syslog push, agent\u002Fforwarder, cloud delivery, etc.)\n- Protocol and wire format details (CEF, LEEF, JSON, key-value, etc.) if documented\n- Support tier (vendor-maintained, platform-built, community\u002Fpartner, or unsupported)\n- Notable gaps or differentiators compared to what Elastic could offer\n\nOutput: write all findings to `references\u002Fcompetitive-siem-coverage.md` using the structure defined in the checklist (summary table → per-competitor H2 sections → comparison notes). Return a concise inline summary with which competitors have integrations, the dominant collection method found, and the path to the written file.\n\nProvide: product name, vendor name, common aliases or abbreviations for the product, and the **path** to `references\u002Fcompetitive-siem-coverage-checklist.md` (so the subagent reads it itself — do not paste the checklist content into the prompt).\n\n### Phase 3: Synthesize and supplement\n\nAfter all subagents return:\n\n1. **Read subagent-written files.** Subagents may have written detailed findings to `references\u002F` or `temp\u002F` and returned only summaries. Read the files they reference to get the full picture. The subagent summaries will tell you which files to read and when.\n2. **Merge findings** from all research tracks into a unified understanding.\n3. **Cross-reference** subagent findings with any local reference material the user provided.\n4. **Fill gaps** using your own grounded knowledge of the vendor\u002Fproduct. Only include information you are confident is accurate and can be attributed to known documentation, specifications, or widely established facts. Flag any details that could not be verified with a `[UNVERIFIED]` marker.\n5. **Resolve conflicts** between subagent findings. When sources disagree, prefer official vendor documentation over third-party sources.\n6. **Collect sample data** -- extract or compile representative sample events from documentation, API response examples, or log format guides. Save each as a separate file in the `sample-events\u002F` subdirectory.\n7. **Review temp\u002F artifacts** if needed. Subagents may have downloaded repos, SDKs, or schemas into `temp\u002F`. You can inspect these directly if you need more detail than what the subagent summaries and reference files provide.\n8. **Read `references\u002Fcompetitive-siem-coverage.md`** (written by Track E). Extract the summary table and overall comparison notes — these are used directly in section 1.5 of the research brief.\n\n### Phase 4: ECS mapping analysis\n\nUsing the ECS reference skill loaded earlier, perform an initial field mapping analysis:\n\n1. For each identified field from the product's data, determine:\n   - Whether it maps to an existing ECS field (and which one)\n   - Whether it should be a custom field under the integration namespace\n   - The appropriate Elasticsearch field type\n2. Identify which `event.kind`, `event.category`, `event.type`, and `event.outcome` values apply to each event type.\n3. Note any fields that are strong candidates for `related.ip`, `related.user`, `related.hosts`, or `related.hash` enrichment.\n4. Write the analysis to `ecs-mapping-analysis.md`.\n\n### Phase 5: Configuration planning\n\nBased on the identified collection method, plan the integration configuration:\n\n1. Determine required vs. optional configuration variables.\n2. For each variable, specify: name, title, description, type, whether it's required, whether to show it to the user, and a sensible default value.\n3. Map variables to the appropriate input type's configuration surface. See `references\u002Fdata-collection-methods.md` for the standard variables per input type.\n4. Write the plan to `configuration-plan.md`.\n\n### Phase 6: Write research brief\n\nCompile the full research brief following the template in `references\u002Fresearch-output-template.md`. Write it to `research_results\u002F\u003Cproduct_slug>\u002Fresearch-brief.md`.\n\nThe brief must be self-contained -- a reader should be able to use it as the sole input to `\u002Fcreate-integration` and have everything they need.\n\nWhen populating **section 1.5 (Competitive SIEM Coverage)**, use the summary table extracted from `references\u002Fcompetitive-siem-coverage.md` in Phase 3 step 8. Include the one-line summary paragraph and the three-row competitor table inline, then add a reference pointer: `See references\u002Fcompetitive-siem-coverage.md for full per-vendor analysis.`\n\n### Phase 7: API test script (API\u002FCEL collection only)\n\n**Skip this phase entirely if the recommended collection method is not API-based (CEL input type).** This phase only applies when the research has identified a REST API as the collection method.\n\nAfter the research brief and all companion artifacts are written, generate a standalone Python test script that exercises the exact API flow proposed for the CEL integration. This lets a human validate connectivity, authentication, pagination, and response structure against a real (or mock) API before any Elastic Agent work begins.\n\n1. **Read the specification:** Load `references\u002Ftest-api-script-spec.md` from this skill's directory. It defines every requirement for the script in detail — file structure, CLI arguments, output files, error handling, and the relationship to the proposed CEL program.\n\n2. **Gather inputs from earlier phases.** The script is synthesized from research already completed:\n   - **Authentication method and credential creation steps** → from section 3.1 of the research brief and the api-spec-notes\n   - **Endpoint paths, query parameters, and request structure** → from section 3.2\n   - **Pagination mechanism, termination conditions, cursor fields** → from section 3.3\n   - **Time-based filtering parameters and formats** → from section 3.4\n   - **Configuration variables** → from `configuration-plan.md`\n\n3. **Write the script** to `research_results\u002F\u003Cproduct_slug>\u002Ftest-api.py`. Key requirements (see spec for full detail):\n   - **Standard library only** — `urllib.request`, `json`, `logging`, `argparse`, `ssl`, etc. No third-party dependencies.\n   - **Comprehensive module docstring** — serves as standalone documentation: what it tests, vendor-side setup steps (credential creation, permissions, prerequisites), usage with all CLI flags, and output description.\n   - **Dual input for credentials** — every credential and connection parameter accepted as both a CLI argument and environment variable (CLI takes precedence). Use `argparse` with `default=os.environ.get(...)`.\n   - **Base URL always configurable** — full URL including scheme (`https:\u002F\u002F...`), even if the vendor has a single static URL. This enables pointing at mock servers.\n   - **`--max-pages` always present** — safety limit to prevent infinite pagination during testing, even if the CEL program has no equivalent.\n   - **TLS verification disabled** — this tests API flow, not certificate health.\n   - **Step-by-step stdout** — show what is happening at each step (calling API, paginating, etc.) without printing raw request\u002Fresponse bodies or any sensitive data.\n   - **Output directory** with two files:\n     - `test-api.log` — verbose log (superset of stdout, written via Python `logging`)\n     - `trace.json` — detailed request\u002Fresponse trace: full URLs, headers, response bodies, pagination state transitions (which field was read, what value it had, what was sent next). Auth values redacted.\n   - **Execution summary** — printed to stdout at the end: overall status, total events, pages fetched, any category breakdown, output location.\n   - **Archive** — compress the output directory as `.tar.gz` and print the path with instructions to share it with integration maintainers.\n   - **Error handling** — all exceptions caught and logged; rate-limit headers logged on 429; `KeyboardInterrupt` handled gracefully; exit 0 on success, 1 on failure.\n\n4. **Mirror the proposed CEL flow.** The script's request sequence, pagination logic, and termination conditions must match what was described in the research brief for the CEL program. This is the core value of the script — if it works, the CEL program should work too.\n\n### Phase 8: Verify and report\n\n1. Verify all output files are written and well-formed.\n2. If `test-api.py` was generated (API\u002FCEL method), verify the script has no syntax errors by running `python3 -m py_compile research_results\u002F\u003Cproduct_slug>\u002Ftest-api.py`.\n3. List all files created with their paths.\n4. Provide a concise summary to the user:\n   - Product overview (1-2 sentences)\n   - Recommended collection method and why\n   - Number of distinct event types\u002Fdata streams identified\n   - Key findings or surprises\n   - Gaps or areas that need user input\n   - If `test-api.py` was generated: remind the user to run it against the real API (with credentials) and share the resulting archive back for development\n   - Suggested next step (typically `\u002Fcreate-integration` with the brief)\n\n## Research quality standards\n\n- **Ground all claims in sources.** Every factual statement in the brief should be traceable to vendor documentation, official specs, or widely established technical references. When using your own knowledge, explicitly note it.\n- **Prefer official vendor documentation** over third-party blog posts, forums, or AI-generated content.\n- **Include direct links** to source documentation wherever possible.\n- **Capture real examples** -- sample API responses, log lines, configuration snippets -- not fabricated ones. If you must construct an example to illustrate structure, mark it `[CONSTRUCTED EXAMPLE]`.\n- **Flag uncertainty** with `[UNVERIFIED]` for any detail that could not be confirmed from official sources.\n- **Be specific, not generic.** \"The API uses pagination\" is not useful. \"The API uses cursor-based pagination via a `next_cursor` field in the response body; pass it as the `cursor` query parameter\" is useful.\n- **Cover edge cases.** Note rate limits, maximum page sizes, required permissions, deprecated endpoints, known bugs, and any gotchas.\n\n## Guardrails\n\n- Do not fabricate sample data that looks real. Sample data must come from documentation or be clearly marked as constructed.\n- Do not start building the integration. This skill produces research only.\n- Do not load implementation skills (CEL, pipelines, ecs-field-mappings, etc.) -- those are for the build phase.\n- **Do not prescribe CEL implementation details.** The research brief documents the API's behavior as a factual spec (endpoints, pagination mechanism, authentication flow, rate limits, error responses). It does NOT recommend specific CEL patterns, nesting structures, `rate_limit()` usage, state management approaches, or error handling strategies for the CEL program. The CEL builder agent has its own skills with authoritative patterns. Research output that prescribes CEL implementation details will be ignored or — worse — followed incorrectly, overriding the CEL skill's patterns.\n  - **Good:** \"Pagination uses `next_cursor` with `more_to_read` boolean. Terminate when `more_to_read` is false.\"\n  - **Bad:** \"The CEL program should use `want_more: body.more_to_read` and store the cursor in `state.?cursor.next_cursor`.\"\n  - **Good:** \"Rate limits: 100 req\u002Fmin\u002Fuser. Headers: `X-Ratelimit-Limit`, `X-Ratelimit-Remaining`, `X-Ratelimit-Reset`.\"\n  - **Bad:** \"Use the `rate_limit()` CEL function to parse these headers and propagate the result on every branch.\"\n- **Do not prescribe pipeline, field-mapping, or manifest implementation details.** The research brief documents the *data* (field names, types, enum values, ECS mapping candidates, sample events) — not how the ingest pipeline, `fields\u002F*.yml`, or `manifest.yml` should be authored. The pipeline builder and reviewer skills (`ingest-pipelines`, `ecs-field-mappings`, `package-spec`, `review-integration`) are the authoritative source for those decisions. Recommendations about processor choice, error-handling structure, or pipeline-level configurability will be ignored or followed incorrectly.\n  - **Specifically prohibited values in research output (configuration plans, var recommendations, architecture notes, ECS analysis, anywhere):** the `preserve_duplicate_custom_fields` flag (legacy pipeline anti-pattern, prohibited by `ingest-pipelines\u002FSKILL.md`), `event.ingested` (managed by Elasticsearch), trailing `event.original` removal toggles, and the `preserve_duplicate_custom_fields` manifest variable \u002F tag \u002F conditional. **Never include these as configuration variables, recommended pipeline behaviors, or \"consider supporting…\" suggestions, even if they appear in legacy integrations you examined for reference patterns.** The only `preserve_*` config var that *is* valid is `preserve_original_event` (file\u002Fsyslog inputs only); see the standard-var tables in `references\u002Fdata-collection-methods.md`.\n  - **Good (data-only):** \"The API returns both `srcip` and `source.ip` for the same value; the latter is already ECS-compliant.\"\n  - **Bad (prescribes pipeline behavior):** \"Add a `preserve_duplicate_custom_fields` manifest var so users can keep both `srcip` and `source.ip` populated.\"\n  - **Good (data-only):** \"Timestamps are in RFC 3339 with timezone offset.\"\n  - **Bad (prescribes pipeline behavior):** \"Use a `date` processor with `target_field: event.start` and a fallback to `@timestamp` via `on_failure`.\"\n- The standard configuration variables for each input type are exhaustively listed in `references\u002Fdata-collection-methods.md`. Do not propose additional configuration variables outside that authoritative set unless the vendor's API genuinely requires a new product-specific variable (e.g., a tenant ID for a multi-tenant API). Even then, the variable must be tied to a documented vendor-side requirement, not a pipeline behavior toggle.\n- If a product has multiple viable collection methods, document all of them with a recommendation and rationale, but produce detailed deep-dive material for the recommended method.\n- If research reveals the product does not expose data in a way that Elastic can ingest, say so clearly in the brief.\n\n## Handoff\n\nAfter this command completes, continue with:\n\n1. **If `test-api.py` was generated** (API\u002FCEL method): run the script against the real vendor API to validate connectivity and collect trace data. Share the resulting `.tar.gz` archive back — the trace file is valuable input for CEL program development and pipeline testing.\n2. `\u002Fcreate-integration @research_results\u002F\u003Cproduct_slug>\u002Fresearch-brief.md` to build the integration using the research brief as input.\n3. Provide additional sample data files from `research_results\u002F\u003Cproduct_slug>\u002Freferences\u002Fsample-events\u002F` via `@`-mentions.\n",{"data":34,"body":38},{"name":4,"description":6,"license":25,"metadata":35,"disable-model-invocation":37},{"author":8,"version":36},"1.0",true,{"type":39,"children":40},"root",[41,49,72,77,120,132,139,152,319,332,339,351,360,369,378,384,389,477,482,487,543,555,561,566,575,610,615,624,629,654,660,666,701,707,717,725,844,852,947,954,959,987,992,998,1003,1011,1091,1099,1127,1135,1177,1182,1188,1192,1230,1255,1260,1266,1270,1298,1303,1309,1319,1324,1356,1361,1397,1402,1440,1453,1471,1477,1482,1606,1612,1617,1725,1731,1736,1773,1779,1798,1810,1835,1841,1851,1856,2196,2202,2291,2297,2399,2405,2822,2828,2833],{"type":42,"tag":43,"props":44,"children":45},"element","h1",{"id":4},[46],{"type":47,"value":48},"text","Research Integration",{"type":42,"tag":50,"props":51,"children":52},"p",{},[53,55,61,63,70],{"type":47,"value":54},"You are the ",{"type":42,"tag":56,"props":57,"children":58},"strong",{},[59],{"type":47,"value":60},"research orchestrator",{"type":47,"value":62},". Your job is to thoroughly investigate a vendor, product, or feature and produce a structured research brief that a downstream integration builder can use as the primary input for ",{"type":42,"tag":64,"props":65,"children":67},"code",{"className":66},[],[68],{"type":47,"value":69},"\u002Fcreate-integration",{"type":47,"value":71},".",{"type":42,"tag":50,"props":73,"children":74},{},[75],{"type":47,"value":76},"You delegate parallel research and analysis to research subagents, synthesize their findings with any locally provided reference material and your own grounded knowledge, and write the final brief to disk.",{"type":42,"tag":50,"props":78,"children":79},{},[80,82,87,89,95,97,103,105,111,113,118],{"type":47,"value":81},"Each research subagent is dispatched via the platform's ",{"type":42,"tag":56,"props":83,"children":84},{},[85],{"type":47,"value":86},"generic \u002F general-purpose subagent",{"type":47,"value":88}," (Cursor: ",{"type":42,"tag":64,"props":90,"children":92},{"className":91},[],[93],{"type":47,"value":94},"generalPurpose",{"type":47,"value":96}," Task agent; Claude Code: ",{"type":42,"tag":64,"props":98,"children":100},{"className":99},[],[101],{"type":47,"value":102},"general-purpose",{"type":47,"value":104}," Task agent; or the equivalent on other platforms). The subagent reads its operating manual (",{"type":42,"tag":64,"props":106,"children":108},{"className":107},[],[109],{"type":47,"value":110},"references\u002Fresearch-subagent-guidance.md",{"type":47,"value":112},") itself when dispatched — the orchestrator passes only the ",{"type":42,"tag":56,"props":114,"children":115},{},[116],{"type":47,"value":117},"path",{"type":47,"value":119}," in the task prompt, never the file's contents. See \"Before you start\" below.",{"type":42,"tag":50,"props":121,"children":122},{},[123,125,130],{"type":47,"value":124},"Research subagents are ",{"type":42,"tag":56,"props":126,"children":127},{},[128],{"type":47,"value":129},"write-capable",{"type":47,"value":131}," -- they can download repositories, install packages, run Python analysis scripts, and write findings to files on disk. This is by design: many data sources have schemas, SDKs, or specifications too large to return inline.",{"type":42,"tag":133,"props":134,"children":136},"h2",{"id":135},"what-you-provide",[137],{"type":47,"value":138},"What you provide",{"type":42,"tag":50,"props":140,"children":141},{},[142,144,150],{"type":47,"value":143},"Include any combination of the following when you invoke this command.\nUse ",{"type":42,"tag":64,"props":145,"children":147},{"className":146},[],[148],{"type":47,"value":149},"@",{"type":47,"value":151},"-mentions for files\u002Ffolders and paste links inline.",{"type":42,"tag":153,"props":154,"children":155},"table",{},[156,180],{"type":42,"tag":157,"props":158,"children":159},"thead",{},[160],{"type":42,"tag":161,"props":162,"children":163},"tr",{},[164,170,175],{"type":42,"tag":165,"props":166,"children":167},"th",{},[168],{"type":47,"value":169},"Input",{"type":42,"tag":165,"props":171,"children":172},{},[173],{"type":47,"value":174},"How to provide",{"type":42,"tag":165,"props":176,"children":177},{},[178],{"type":47,"value":179},"Examples",{"type":42,"tag":181,"props":182,"children":183},"tbody",{},[184,203,221,251,285,302],{"type":42,"tag":161,"props":185,"children":186},{},[187,193,198],{"type":42,"tag":188,"props":189,"children":190},"td",{},[191],{"type":47,"value":192},"Product \u002F vendor \u002F feature",{"type":42,"tag":188,"props":194,"children":195},{},[196],{"type":47,"value":197},"free text",{"type":42,"tag":188,"props":199,"children":200},{},[201],{"type":47,"value":202},"\"Checkpoint Harmony Endpoint\", \"Okta System Log\", \"AWS CloudTrail via S3\"",{"type":42,"tag":161,"props":204,"children":205},{},[206,211,216],{"type":42,"tag":188,"props":207,"children":208},{},[209],{"type":47,"value":210},"Known collection method",{"type":42,"tag":188,"props":212,"children":213},{},[214],{"type":47,"value":215},"free text (optional)",{"type":42,"tag":188,"props":217,"children":218},{},[219],{"type":47,"value":220},"\"REST API\", \"syslog\", \"S3\u002FSQS\", \"Azure Event Hub\"",{"type":42,"tag":161,"props":222,"children":223},{},[224,229,234],{"type":42,"tag":188,"props":225,"children":226},{},[227],{"type":47,"value":228},"Documentation URLs",{"type":42,"tag":188,"props":230,"children":231},{},[232],{"type":47,"value":233},"paste URLs",{"type":42,"tag":188,"props":235,"children":236},{},[237,243,245],{"type":42,"tag":64,"props":238,"children":240},{"className":239},[],[241],{"type":47,"value":242},"https:\u002F\u002Fdocs.vendor.com\u002Fapi\u002Fv2",{"type":47,"value":244},", ",{"type":42,"tag":64,"props":246,"children":248},{"className":247},[],[249],{"type":47,"value":250},"https:\u002F\u002Fdocs.vendor.com\u002Flogging-guide",{"type":42,"tag":161,"props":252,"children":253},{},[254,259,269],{"type":42,"tag":188,"props":255,"children":256},{},[257],{"type":47,"value":258},"Local reference material",{"type":42,"tag":188,"props":260,"children":261},{},[262,267],{"type":42,"tag":64,"props":263,"children":265},{"className":264},[],[266],{"type":47,"value":149},{"type":47,"value":268},"-mention files",{"type":42,"tag":188,"props":270,"children":271},{},[272,278,279],{"type":42,"tag":64,"props":273,"children":275},{"className":274},[],[276],{"type":47,"value":277},"@samples\u002Fvendor_event.json",{"type":47,"value":244},{"type":42,"tag":64,"props":280,"children":282},{"className":281},[],[283],{"type":47,"value":284},"@notes\u002Fvendor-api-notes.md",{"type":42,"tag":161,"props":286,"children":287},{},[288,293,297],{"type":42,"tag":188,"props":289,"children":290},{},[291],{"type":47,"value":292},"Scope constraints",{"type":42,"tag":188,"props":294,"children":295},{},[296],{"type":47,"value":197},{"type":42,"tag":188,"props":298,"children":299},{},[300],{"type":47,"value":301},"\"only the alerts API\", \"focus on firewall logs\", \"audit events only\"",{"type":42,"tag":161,"props":303,"children":304},{},[305,310,314],{"type":42,"tag":188,"props":306,"children":307},{},[308],{"type":47,"value":309},"Output name override",{"type":42,"tag":188,"props":311,"children":312},{},[313],{"type":47,"value":197},{"type":42,"tag":188,"props":315,"children":316},{},[317],{"type":47,"value":318},"\"checkpoint_harmony\" (defaults to sanitized product name)",{"type":42,"tag":50,"props":320,"children":321},{},[322,324,330],{"type":47,"value":323},"Anything typed after ",{"type":42,"tag":64,"props":325,"children":327},{"className":326},[],[328],{"type":47,"value":329},"\u002Fresearch-integration",{"type":47,"value":331}," is your research goal.",{"type":42,"tag":333,"props":334,"children":336},"h3",{"id":335},"invocation-examples",[337],{"type":47,"value":338},"Invocation examples",{"type":42,"tag":340,"props":341,"children":345},"pre",{"className":342,"code":344,"language":47},[343],"language-text","\u002Fresearch-integration Checkpoint Harmony Endpoint security events\n  API docs: https:\u002F\u002Fdeveloper.checkpoint.com\u002Freference\u002Fharmony-endpoint\n  Focus on: alerts, threat events, and audit logs.\n  Known method: REST API with pagination.\n",[346],{"type":42,"tag":64,"props":347,"children":349},{"__ignoreMap":348},"",[350],{"type":47,"value":344},{"type":42,"tag":340,"props":352,"children":355},{"className":353,"code":354,"language":47},[343],"\u002Fresearch-integration Palo Alto Cortex XDR\n  @notes\u002Fcortex-xdr-api-rough-notes.md\n  Need to investigate both the Incidents API and Alerts API.\n",[356],{"type":42,"tag":64,"props":357,"children":358},{"__ignoreMap":348},[359],{"type":47,"value":354},{"type":42,"tag":340,"props":361,"children":364},{"className":362,"code":363,"language":47},[343],"\u002Fresearch-integration Cisco Meraki syslog events\n  https:\u002F\u002Fdocumentation.meraki.com\u002FGeneral_Administration\u002FMonitoring_and_Reporting\u002FSyslog_Event_Types_and_Log_Samples\n  Focus on: firewall, URL, and IDS event types.\n  Known method: syslog over UDP\u002FTCP.\n",[365],{"type":42,"tag":64,"props":366,"children":367},{"__ignoreMap":348},[368],{"type":47,"value":363},{"type":42,"tag":340,"props":370,"children":373},{"className":371,"code":372,"language":47},[343],"\u002Fresearch-integration AWS Security Hub findings via S3\u002FSQS\n  Need full schema of ASFF finding format and S3 delivery configuration.\n",[374],{"type":42,"tag":64,"props":375,"children":376},{"__ignoreMap":348},[377],{"type":47,"value":372},{"type":42,"tag":133,"props":379,"children":381},{"id":380},"before-you-start-load-references",[382],{"type":47,"value":383},"Before you start -- load references",{"type":42,"tag":50,"props":385,"children":386},{},[387],{"type":47,"value":388},"Read these reference files from this skill's directory to guide your research strategy:",{"type":42,"tag":390,"props":391,"children":392},"ol",{},[393,405,416,458],{"type":42,"tag":394,"props":395,"children":396},"li",{},[397,403],{"type":42,"tag":64,"props":398,"children":400},{"className":399},[],[401],{"type":47,"value":402},"references\u002Fdata-collection-methods.md",{"type":47,"value":404}," -- understand input types and what to investigate for each",{"type":42,"tag":394,"props":406,"children":407},{},[408,414],{"type":42,"tag":64,"props":409,"children":411},{"className":410},[],[412],{"type":47,"value":413},"references\u002Fresearch-output-template.md",{"type":47,"value":415}," -- the structure your final brief must follow",{"type":42,"tag":394,"props":417,"children":418},{},[419,421],{"type":47,"value":420},"Based on the identified collection method, read the applicable checklist:\n",{"type":42,"tag":422,"props":423,"children":424},"ul",{},[425,436,447],{"type":42,"tag":394,"props":426,"children":427},{},[428,434],{"type":42,"tag":64,"props":429,"children":431},{"className":430},[],[432],{"type":47,"value":433},"references\u002Fapi-research-checklist.md",{"type":47,"value":435}," -- for REST API \u002F CEL-based collection",{"type":42,"tag":394,"props":437,"children":438},{},[439,445],{"type":42,"tag":64,"props":440,"children":442},{"className":441},[],[443],{"type":47,"value":444},"references\u002Flog-file-research-checklist.md",{"type":47,"value":446}," -- for syslog, file-based, and local log collection",{"type":42,"tag":394,"props":448,"children":449},{},[450,456],{"type":42,"tag":64,"props":451,"children":453},{"className":452},[],[454],{"type":47,"value":455},"references\u002Fcloud-ingest-research-checklist.md",{"type":47,"value":457}," -- for S3\u002FSQS, Event Hub, Pub\u002FSub, and similar cloud delivery",{"type":42,"tag":394,"props":459,"children":460},{},[461,463],{"type":47,"value":462},"If the collection method is (or turns out to be) API-based, also read:\n",{"type":42,"tag":422,"props":464,"children":465},{},[466],{"type":42,"tag":394,"props":467,"children":468},{},[469,475],{"type":42,"tag":64,"props":470,"children":472},{"className":471},[],[473],{"type":47,"value":474},"references\u002Ftest-api-script-spec.md",{"type":47,"value":476}," -- specification for the API test script generated in Phase 7",{"type":42,"tag":50,"props":478,"children":479},{},[480],{"type":47,"value":481},"If the collection method is unknown at invocation time, read all three checklists -- part of your job is to determine the method.",{"type":42,"tag":50,"props":483,"children":484},{},[485],{"type":47,"value":486},"Also load:",{"type":42,"tag":390,"props":488,"children":490},{"start":489},5,[491,502,520],{"type":42,"tag":394,"props":492,"children":493},{},[494,500],{"type":42,"tag":64,"props":495,"children":497},{"className":496},[],[498],{"type":47,"value":499},"ecs-field-mappings",{"type":47,"value":501}," skill -- for ECS field mapping guidance during the analysis phase",{"type":42,"tag":394,"props":503,"children":504},{},[505,511,513,518],{"type":42,"tag":64,"props":506,"children":508},{"className":507},[],[509],{"type":47,"value":510},"references\u002Fcompetitive-siem-coverage-checklist.md",{"type":47,"value":512}," -- read this yourself so you know what to pass through; when dispatching the Track E subagent, point it at this file ",{"type":42,"tag":56,"props":514,"children":515},{},[516],{"type":47,"value":517},"by path",{"type":47,"value":519}," (do NOT paste its contents into the task prompt). The Track E subagent will read it in its own fresh context.",{"type":42,"tag":394,"props":521,"children":522},{},[523,528,530,535,537,541],{"type":42,"tag":64,"props":524,"children":526},{"className":525},[],[527],{"type":47,"value":110},{"type":47,"value":529}," -- the operating manual every research subagent needs. ",{"type":42,"tag":56,"props":531,"children":532},{},[533],{"type":47,"value":534},"Do NOT read this file yourself",{"type":47,"value":536}," unless you specifically need to debug a subagent's behaviour. Instead, point every research subagent at this file ",{"type":42,"tag":56,"props":538,"children":539},{},[540],{"type":47,"value":517},{"type":47,"value":542}," in its task prompt and instruct it to read the file end-to-end before doing any other work. Embedding the file verbatim doubles its context cost.",{"type":42,"tag":50,"props":544,"children":545},{},[546,548,553],{"type":47,"value":547},"Do ",{"type":42,"tag":56,"props":549,"children":550},{},[551],{"type":47,"value":552},"not",{"type":47,"value":554}," load other integration-building skills (CEL, pipelines, ecs-field-mappings implementation details, etc.). Those are for implementation, not research.",{"type":42,"tag":133,"props":556,"children":558},{"id":557},"output-location",[559],{"type":47,"value":560},"Output location",{"type":42,"tag":50,"props":562,"children":563},{},[564],{"type":47,"value":565},"Write all research output to:",{"type":42,"tag":340,"props":567,"children":570},{"className":568,"code":569,"language":47},[343],"research_results\u002F\u003Cproduct_slug>\u002F\n",[571],{"type":42,"tag":64,"props":572,"children":573},{"__ignoreMap":348},[574],{"type":47,"value":569},{"type":42,"tag":50,"props":576,"children":577},{},[578,580,586,588,594,595,601,602,608],{"type":47,"value":579},"Where ",{"type":42,"tag":64,"props":581,"children":583},{"className":582},[],[584],{"type":47,"value":585},"\u003Cproduct_slug>",{"type":47,"value":587}," is a lowercase, underscore-separated identifier derived from the product name (e.g., ",{"type":42,"tag":64,"props":589,"children":591},{"className":590},[],[592],{"type":47,"value":593},"checkpoint_harmony_endpoint",{"type":47,"value":244},{"type":42,"tag":64,"props":596,"children":598},{"className":597},[],[599],{"type":47,"value":600},"palo_alto_cortex_xdr",{"type":47,"value":244},{"type":42,"tag":64,"props":603,"children":605},{"className":604},[],[606],{"type":47,"value":607},"cisco_meraki",{"type":47,"value":609},"). The user may override this with the \"Output name override\" input.",{"type":42,"tag":50,"props":611,"children":612},{},[613],{"type":47,"value":614},"Create this directory structure:",{"type":42,"tag":340,"props":616,"children":619},{"className":617,"code":618,"language":47},[343],"research_results\u002F\u003Cproduct_slug>\u002F\n  research-brief.md           # the main structured research brief\n  test-api.py                 # API connectivity & flow test script (API\u002FCEL only)\n  references\u002F                 # curated research artifacts for downstream consumers\n    api-spec-notes.md         # API endpoint details, request\u002Fresponse examples (if API)\n    log-format-notes.md       # log format details, sample lines (if log-based)\n    field-schema-analysis.md  # detailed field inventories written by subagents\n    competitive-siem-coverage.md  # detailed competitive SIEM analysis (always created)\n    sample-events\u002F            # representative sample data files\n      \u003Cevent_type>.json       # one file per event type or data format variant\n      \u003Cevent_type>.log\n  temp\u002F                       # downloaded raw artifacts (repos, SDKs, schemas, scripts)\n    \u003Cdescriptive-subfolder>\u002F  # e.g., vendor-sdk\u002F, schema-files\u002F, openapi-spec\u002F\n  ecs-mapping-analysis.md     # initial ECS field mapping analysis\n  configuration-plan.md       # planned integration configuration variables\n",[620],{"type":42,"tag":64,"props":621,"children":622},{"__ignoreMap":348},[623],{"type":47,"value":618},{"type":42,"tag":50,"props":625,"children":626},{},[627],{"type":47,"value":628},"Not all files are required -- create only what applies to the product's collection method.",{"type":42,"tag":50,"props":630,"children":631},{},[632,645,647,652],{"type":42,"tag":56,"props":633,"children":634},{},[635,637,643],{"type":47,"value":636},"Important: the ",{"type":42,"tag":64,"props":638,"children":640},{"className":639},[],[641],{"type":47,"value":642},"temp\u002F",{"type":47,"value":644}," directory",{"type":47,"value":646}," is used by subagents to download git repositories, SDK sources, large schema files, and other raw artifacts they need to analyze. Do not delete ",{"type":42,"tag":64,"props":648,"children":650},{"className":649},[],[651],{"type":47,"value":642},{"type":47,"value":653}," after research completes -- it serves as a reference for the human and may be useful for follow-up work.",{"type":42,"tag":133,"props":655,"children":657},{"id":656},"workflow",[658],{"type":47,"value":659},"Workflow",{"type":42,"tag":333,"props":661,"children":663},{"id":662},"phase-1-parse-and-plan",[664],{"type":47,"value":665},"Phase 1: Parse and plan",{"type":42,"tag":390,"props":667,"children":668},{},[669,674,686,691,696],{"type":42,"tag":394,"props":670,"children":671},{},[672],{"type":47,"value":673},"Extract from the user message: product name, vendor, known collection method (if any), documentation URLs, local reference files, and scope constraints.",{"type":42,"tag":394,"props":675,"children":676},{},[677,679,684],{"type":47,"value":678},"Read any ",{"type":42,"tag":64,"props":680,"children":682},{"className":681},[],[683],{"type":47,"value":149},{"type":47,"value":685},"-mentioned local files.",{"type":42,"tag":394,"props":687,"children":688},{},[689],{"type":47,"value":690},"Fetch any documentation URLs provided inline to get initial context.",{"type":42,"tag":394,"props":692,"children":693},{},[694],{"type":47,"value":695},"Determine the output slug and create the output directory.",{"type":42,"tag":394,"props":697,"children":698},{},[699],{"type":47,"value":700},"Identify which research tracks to pursue based on what is known and unknown.",{"type":42,"tag":333,"props":702,"children":704},{"id":703},"phase-2-parallel-research",[705],{"type":47,"value":706},"Phase 2: Parallel research",{"type":42,"tag":50,"props":708,"children":709},{},[710,712],{"type":47,"value":711},"Launch multiple research subagents in parallel using the platform's generic \u002F general-purpose subagent (see the dispatch description at the top of this skill). Each subagent focuses on a specific research track. ",{"type":42,"tag":56,"props":713,"children":714},{},[715],{"type":47,"value":716},"You should launch as many parallel subagents as makes sense for the product -- typically 2-4 subagents, plus the always-on Track E.",{"type":42,"tag":50,"props":718,"children":719},{},[720],{"type":42,"tag":56,"props":721,"children":722},{},[723],{"type":47,"value":724},"IMPORTANT -- subagent context and capabilities:",{"type":42,"tag":422,"props":726,"children":727},{},[728,740,781,800,811],{"type":42,"tag":394,"props":729,"children":730},{},[731,733,738],{"type":47,"value":732},"Subagents cannot see your conversation or access ",{"type":42,"tag":64,"props":734,"children":736},{"className":735},[],[737],{"type":47,"value":149},{"type":47,"value":739},"-mentioned files directly. Include any relevant content from local reference files and fetched URLs in the task prompt.",{"type":42,"tag":394,"props":741,"children":742},{},[743,745,749,751,756,758,764,766,771,773,779],{"type":47,"value":744},"Subagents are ",{"type":42,"tag":56,"props":746,"children":747},{},[748],{"type":47,"value":129},{"type":47,"value":750},". Always tell each subagent its ",{"type":42,"tag":56,"props":752,"children":753},{},[754],{"type":47,"value":755},"working directory",{"type":47,"value":757}," (",{"type":42,"tag":64,"props":759,"children":761},{"className":760},[],[762],{"type":47,"value":763},"research_results\u002F\u003Cproduct_slug>\u002F",{"type":47,"value":765},") so it can write to ",{"type":42,"tag":64,"props":767,"children":769},{"className":768},[],[770],{"type":47,"value":642},{"type":47,"value":772}," and ",{"type":42,"tag":64,"props":774,"children":776},{"className":775},[],[777],{"type":47,"value":778},"references\u002F",{"type":47,"value":780}," within it.",{"type":42,"tag":394,"props":782,"children":783},{},[784,786,791,793,798],{"type":47,"value":785},"Subagents can ",{"type":42,"tag":56,"props":787,"children":788},{},[789],{"type":47,"value":790},"download resources",{"type":47,"value":792},": clone git repos, install pip\u002Fnpm packages, fetch large files -- all into ",{"type":42,"tag":64,"props":794,"children":796},{"className":795},[],[797],{"type":47,"value":642},{"type":47,"value":799}," under the working directory.",{"type":42,"tag":394,"props":801,"children":802},{},[803,804,809],{"type":47,"value":785},{"type":42,"tag":56,"props":805,"children":806},{},[807],{"type":47,"value":808},"run Python scripts",{"type":47,"value":810}," (or other tools) to analyze large artifacts like JSON schemas, OpenAPI specs, or SDK model files. Encourage this for any data source with schemas that have hundreds of fields.",{"type":42,"tag":394,"props":812,"children":813},{},[814,816,821,823,828,830,835,837,842],{"type":47,"value":815},"Subagents should ",{"type":42,"tag":56,"props":817,"children":818},{},[819],{"type":47,"value":820},"write large findings to files",{"type":47,"value":822}," in ",{"type":42,"tag":64,"props":824,"children":826},{"className":825},[],[827],{"type":47,"value":778},{"type":47,"value":829}," or ",{"type":42,"tag":64,"props":831,"children":833},{"className":832},[],[834],{"type":47,"value":642},{"type":47,"value":836}," and return a ",{"type":42,"tag":56,"props":838,"children":839},{},[840],{"type":47,"value":841},"concise summary",{"type":47,"value":843}," with file paths rather than returning everything inline. This keeps context manageable.",{"type":42,"tag":50,"props":845,"children":846},{},[847],{"type":42,"tag":56,"props":848,"children":849},{},[850],{"type":47,"value":851},"Required structure for every research subagent task prompt:",{"type":42,"tag":390,"props":853,"children":854},{},[855,891,910,920,937],{"type":42,"tag":394,"props":856,"children":857},{},[858,868,870,875,877,882,884,889],{"type":42,"tag":56,"props":859,"children":860},{},[861,863],{"type":47,"value":862},"Begin with an instruction to read ",{"type":42,"tag":64,"props":864,"children":866},{"className":865},[],[867],{"type":47,"value":110},{"type":47,"value":869}," (relative to the ",{"type":42,"tag":64,"props":871,"children":873},{"className":872},[],[874],{"type":47,"value":4},{"type":47,"value":876}," skill) end-to-end before doing any other work. That file is the subagent's operating manual — methodology, ",{"type":42,"tag":64,"props":878,"children":880},{"className":879},[],[881],{"type":47,"value":642},{"type":47,"value":883}," usage, Python analysis idiom, result delivery contract, quality standards, and anonymization conventions. ",{"type":42,"tag":56,"props":885,"children":886},{},[887],{"type":47,"value":888},"Pass only the path; do NOT paste\u002Fembed the file's contents into the task prompt",{"type":47,"value":890}," — the subagent must load it in its own fresh context to avoid doubling the context cost. Track E follows the same pattern for the competitive-SIEM checklist.",{"type":42,"tag":394,"props":892,"children":893},{},[894,899,901],{"type":42,"tag":56,"props":895,"children":896},{},[897],{"type":47,"value":898},"State the working directory explicitly",{"type":47,"value":900}," so the subagent knows where to write:\n",{"type":42,"tag":340,"props":902,"children":905},{"className":903,"code":904,"language":47},[343],"Working directory: research_results\u002F\u003Cproduct_slug>\u002F\n- Download raw artifacts to: research_results\u002F\u003Cproduct_slug>\u002Ftemp\u002F\n- Write curated findings to: research_results\u002F\u003Cproduct_slug>\u002Freferences\u002F\n",[906],{"type":42,"tag":64,"props":907,"children":908},{"__ignoreMap":348},[909],{"type":47,"value":904},{"type":42,"tag":394,"props":911,"children":912},{},[913,918],{"type":42,"tag":56,"props":914,"children":915},{},[916],{"type":47,"value":917},"Include the track-specific investigation items",{"type":47,"value":919}," (see Tracks A–E below) — what to research, what details to focus on, what output structure you expect back.",{"type":42,"tag":394,"props":921,"children":922},{},[923,928,930,935],{"type":42,"tag":56,"props":924,"children":925},{},[926],{"type":47,"value":927},"Include any relevant local reference content",{"type":47,"value":929}," the user provided via ",{"type":42,"tag":64,"props":931,"children":933},{"className":932},[],[934],{"type":47,"value":149},{"type":47,"value":936},"-mentions (the subagent cannot see your conversation).",{"type":42,"tag":394,"props":938,"children":939},{},[940,945],{"type":42,"tag":56,"props":941,"children":942},{},[943],{"type":47,"value":944},"Include any documentation URLs",{"type":47,"value":946}," the user provided inline.",{"type":42,"tag":948,"props":949,"children":951},"h4",{"id":950},"research-track-a-product-overview-and-data-collection-methods",[952],{"type":47,"value":953},"Research Track A: Product overview and data collection methods",{"type":42,"tag":50,"props":955,"children":956},{},[957],{"type":47,"value":958},"Instruct the subagent to investigate:",{"type":42,"tag":422,"props":960,"children":961},{},[962,967,972,977,982],{"type":42,"tag":394,"props":963,"children":964},{},[965],{"type":47,"value":966},"What the product\u002Ffeature is and what kind of data it generates",{"type":42,"tag":394,"props":968,"children":969},{},[970],{"type":47,"value":971},"All available methods for collecting\u002Fexporting data (API, syslog, file export, cloud streaming, SIEM forwarding, etc.)",{"type":42,"tag":394,"props":973,"children":974},{},[975],{"type":47,"value":976},"Which method is best suited for an Elastic integration and why",{"type":42,"tag":394,"props":978,"children":979},{},[980],{"type":47,"value":981},"Official vendor documentation links for each collection method",{"type":42,"tag":394,"props":983,"children":984},{},[985],{"type":47,"value":986},"Any known limitations, rate limits, or licensing requirements for data access",{"type":42,"tag":50,"props":988,"children":989},{},[990],{"type":47,"value":991},"Provide: product name, vendor, any known collection method, any documentation URLs.",{"type":42,"tag":948,"props":993,"children":995},{"id":994},"research-track-b-data-source-deep-dive",[996],{"type":47,"value":997},"Research Track B: Data source deep dive",{"type":42,"tag":50,"props":999,"children":1000},{},[1001],{"type":47,"value":1002},"Instruct the subagent to investigate the specifics of the data source based on the most likely collection method:",{"type":42,"tag":50,"props":1004,"children":1005},{},[1006],{"type":42,"tag":56,"props":1007,"children":1008},{},[1009],{"type":47,"value":1010},"For APIs:",{"type":42,"tag":422,"props":1012,"children":1013},{},[1014,1019,1024,1042,1047,1052,1057,1062,1067,1072],{"type":42,"tag":394,"props":1015,"children":1016},{},[1017],{"type":47,"value":1018},"Base URL and endpoint paths",{"type":42,"tag":394,"props":1020,"children":1021},{},[1022],{"type":47,"value":1023},"Authentication method (API key, OAuth2, Bearer token, Basic auth, custom headers)",{"type":42,"tag":394,"props":1025,"children":1026},{},[1027,1032,1034,1040],{"type":42,"tag":56,"props":1028,"children":1029},{},[1030],{"type":47,"value":1031},"OAuth2 deep dive (critical):",{"type":47,"value":1033}," If the API uses OAuth2, identify ALL supported grant types (client_credentials, authorization_code, etc.) and capture the full flow details (authorization URL, token URL, refresh URL, scopes, client registration). Do NOT settle for \"manual token generation\" if a proper OAuth2 flow exists — many vendors document both a PAT\u002Fmanual token page and a standard OAuth2 authorization_code flow on separate documentation pages. See ",{"type":42,"tag":64,"props":1035,"children":1037},{"className":1036},[],[1038],{"type":47,"value":1039},"api-research-checklist.md",{"type":47,"value":1041}," for the detailed OAuth2 investigation checklist.",{"type":42,"tag":394,"props":1043,"children":1044},{},[1045],{"type":47,"value":1046},"Pagination pattern (offset, cursor, link-header, token-based, keyset)",{"type":42,"tag":394,"props":1048,"children":1049},{},[1050],{"type":47,"value":1051},"Rate limiting details",{"type":42,"tag":394,"props":1053,"children":1054},{},[1055],{"type":47,"value":1056},"Request and response structure with field-level detail",{"type":42,"tag":394,"props":1058,"children":1059},{},[1060],{"type":47,"value":1061},"Available query parameters and filters (especially time-based filtering)",{"type":42,"tag":394,"props":1063,"children":1064},{},[1065],{"type":47,"value":1066},"API versioning approach",{"type":42,"tag":394,"props":1068,"children":1069},{},[1070],{"type":47,"value":1071},"Complete request\u002Fresponse examples for each relevant endpoint",{"type":42,"tag":394,"props":1073,"children":1074},{},[1075,1077,1082,1084,1089],{"type":47,"value":1076},"If the vendor publishes an ",{"type":42,"tag":56,"props":1078,"children":1079},{},[1080],{"type":47,"value":1081},"OpenAPI\u002FSwagger spec or SDK",{"type":47,"value":1083},", instruct the subagent to download it into ",{"type":42,"tag":64,"props":1085,"children":1087},{"className":1086},[],[1088],{"type":47,"value":642},{"type":47,"value":1090}," and use Python to extract endpoint details, request\u002Fresponse schemas, and parameter definitions",{"type":42,"tag":50,"props":1092,"children":1093},{},[1094],{"type":42,"tag":56,"props":1095,"children":1096},{},[1097],{"type":47,"value":1098},"For logs\u002Fsyslog:",{"type":42,"tag":422,"props":1100,"children":1101},{},[1102,1107,1112,1117,1122],{"type":42,"tag":394,"props":1103,"children":1104},{},[1105],{"type":47,"value":1106},"Log format (syslog RFC 3164\u002F5424, CEF, LEEF, key-value, JSON, CSV, multiline)",{"type":42,"tag":394,"props":1108,"children":1109},{},[1110],{"type":47,"value":1111},"Default log file paths per OS",{"type":42,"tag":394,"props":1113,"children":1114},{},[1115],{"type":47,"value":1116},"Syslog facility and severity usage",{"type":42,"tag":394,"props":1118,"children":1119},{},[1120],{"type":47,"value":1121},"Message structure and delimiters",{"type":42,"tag":394,"props":1123,"children":1124},{},[1125],{"type":47,"value":1126},"Sample log lines for each event type",{"type":42,"tag":50,"props":1128,"children":1129},{},[1130],{"type":42,"tag":56,"props":1131,"children":1132},{},[1133],{"type":47,"value":1134},"For cloud ingest (S3\u002FSQS, Event Hub, Pub\u002FSub, etc.):",{"type":42,"tag":422,"props":1136,"children":1137},{},[1138,1143,1148,1153,1158],{"type":42,"tag":394,"props":1139,"children":1140},{},[1141],{"type":47,"value":1142},"Delivery mechanism configuration",{"type":42,"tag":394,"props":1144,"children":1145},{},[1146],{"type":47,"value":1147},"Message\u002Fobject format and structure",{"type":42,"tag":394,"props":1149,"children":1150},{},[1151],{"type":47,"value":1152},"Path\u002Fprefix patterns",{"type":42,"tag":394,"props":1154,"children":1155},{},[1156],{"type":47,"value":1157},"Notification configuration requirements",{"type":42,"tag":394,"props":1159,"children":1160},{},[1161,1163,1168,1170,1175],{"type":47,"value":1162},"If the vendor provides ",{"type":42,"tag":56,"props":1164,"children":1165},{},[1166],{"type":47,"value":1167},"schema definitions in a repository",{"type":47,"value":1169}," (e.g., AWS OCSF schemas, Azure resource schemas), instruct the subagent to clone the repo into ",{"type":42,"tag":64,"props":1171,"children":1173},{"className":1172},[],[1174],{"type":47,"value":642},{"type":47,"value":1176}," and analyze the schemas programmatically",{"type":42,"tag":50,"props":1178,"children":1179},{},[1180],{"type":47,"value":1181},"Provide: product name, likely collection method, any documentation URLs, any local reference material content.",{"type":42,"tag":948,"props":1183,"children":1185},{"id":1184},"research-track-c-event-types-and-field-schema",[1186],{"type":47,"value":1187},"Research Track C: Event types and field schema",{"type":42,"tag":50,"props":1189,"children":1190},{},[1191],{"type":47,"value":958},{"type":42,"tag":422,"props":1193,"children":1194},{},[1195,1200,1205,1210,1215,1220,1225],{"type":42,"tag":394,"props":1196,"children":1197},{},[1198],{"type":47,"value":1199},"All distinct event types, categories, or log sources the product generates",{"type":42,"tag":394,"props":1201,"children":1202},{},[1203],{"type":47,"value":1204},"Field names, types, and descriptions for each event type",{"type":42,"tag":394,"props":1206,"children":1207},{},[1208],{"type":47,"value":1209},"Common fields across event types vs. type-specific fields",{"type":42,"tag":394,"props":1211,"children":1212},{},[1213],{"type":47,"value":1214},"Enumeration values for status, severity, action, and category fields",{"type":42,"tag":394,"props":1216,"children":1217},{},[1218],{"type":47,"value":1219},"Timestamp formats and timezone handling",{"type":42,"tag":394,"props":1221,"children":1222},{},[1223],{"type":47,"value":1224},"Nested object structures",{"type":42,"tag":394,"props":1226,"children":1227},{},[1228],{"type":47,"value":1229},"Which events are highest-value for security\u002Fobservability use cases",{"type":42,"tag":50,"props":1231,"children":1232},{},[1233,1238,1240,1245,1247,1253],{"type":42,"tag":56,"props":1234,"children":1235},{},[1236],{"type":47,"value":1237},"For data sources with large schemas:",{"type":47,"value":1239}," Instruct the subagent to download the schema source (git repo, SDK package, JSON schema file) into ",{"type":42,"tag":64,"props":1241,"children":1243},{"className":1242},[],[1244],{"type":47,"value":642},{"type":47,"value":1246}," and use Python to programmatically extract field inventories, type information, and enum values. The subagent should write the complete field analysis to ",{"type":42,"tag":64,"props":1248,"children":1250},{"className":1249},[],[1251],{"type":47,"value":1252},"references\u002Ffield-schema-analysis.md",{"type":47,"value":1254}," (or multiple files if per-event-type breakdowns are needed) and return a summary.",{"type":42,"tag":50,"props":1256,"children":1257},{},[1258],{"type":47,"value":1259},"Provide: product name, any documentation URLs, any sample data content from local files.",{"type":42,"tag":948,"props":1261,"children":1263},{"id":1262},"research-track-d-configuration-and-deployment-optional-launch-if-needed",[1264],{"type":47,"value":1265},"Research Track D: Configuration and deployment (optional, launch if needed)",{"type":42,"tag":50,"props":1267,"children":1268},{},[1269],{"type":47,"value":958},{"type":42,"tag":422,"props":1271,"children":1272},{},[1273,1278,1283,1288,1293],{"type":42,"tag":394,"props":1274,"children":1275},{},[1276],{"type":47,"value":1277},"What configuration the end user needs to provide (credentials, URLs, paths, filters)",{"type":42,"tag":394,"props":1279,"children":1280},{},[1281],{"type":47,"value":1282},"How to enable\u002Fconfigure data export on the vendor side",{"type":42,"tag":394,"props":1284,"children":1285},{},[1286],{"type":47,"value":1287},"Network requirements (ports, protocols, firewall rules)",{"type":42,"tag":394,"props":1289,"children":1290},{},[1291],{"type":47,"value":1292},"Common deployment architectures",{"type":42,"tag":394,"props":1294,"children":1295},{},[1296],{"type":47,"value":1297},"Prerequisites and permissions needed",{"type":42,"tag":50,"props":1299,"children":1300},{},[1301],{"type":47,"value":1302},"Provide: product name, collection method, any documentation URLs.",{"type":42,"tag":948,"props":1304,"children":1306},{"id":1305},"research-track-e-competitive-siem-coverage-always-launch",[1307],{"type":47,"value":1308},"Research Track E: Competitive SIEM coverage (always launch)",{"type":42,"tag":50,"props":1310,"children":1311},{},[1312,1317],{"type":42,"tag":56,"props":1313,"children":1314},{},[1315],{"type":47,"value":1316},"Always launch this track",{"type":47,"value":1318}," in parallel with the other tracks. It is not conditional on collection method.",{"type":42,"tag":50,"props":1320,"children":1321},{},[1322],{"type":47,"value":1323},"Instruct the subagent to check whether IBM QRadar, Splunk, and Sumo Logic have an existing integration or app for the product being researched, and to document what each covers and how it collects data.",{"type":42,"tag":50,"props":1325,"children":1326},{},[1327,1329,1334,1336,1340,1342,1347,1349,1354],{"type":47,"value":1328},"The subagent must follow ",{"type":42,"tag":64,"props":1330,"children":1332},{"className":1331},[],[1333],{"type":47,"value":510},{"type":47,"value":1335}," end-to-end. Point the subagent at that file ",{"type":42,"tag":56,"props":1337,"children":1338},{},[1339],{"type":47,"value":517},{"type":47,"value":1341}," and instruct it to read the entire file before doing any other work. ",{"type":42,"tag":56,"props":1343,"children":1344},{},[1345],{"type":47,"value":1346},"Do NOT paste the checklist contents into the task prompt",{"type":47,"value":1348}," — the subagent will load it in its own fresh context. (This is in addition to the read-",{"type":42,"tag":64,"props":1350,"children":1352},{"className":1351},[],[1353],{"type":47,"value":110},{"type":47,"value":1355},"-by-path directive from Phase 2.)",{"type":42,"tag":50,"props":1357,"children":1358},{},[1359],{"type":47,"value":1360},"Competitor catalog starting points to include in the prompt:",{"type":42,"tag":422,"props":1362,"children":1363},{},[1364,1375,1386],{"type":42,"tag":394,"props":1365,"children":1366},{},[1367,1369],{"type":47,"value":1368},"IBM QRadar: ",{"type":42,"tag":64,"props":1370,"children":1372},{"className":1371},[],[1373],{"type":47,"value":1374},"https:\u002F\u002Fwww.ibm.com\u002Fproducts\u002Fqradar-siem\u002Fintegrations",{"type":42,"tag":394,"props":1376,"children":1377},{},[1378,1380],{"type":47,"value":1379},"Splunk: ",{"type":42,"tag":64,"props":1381,"children":1383},{"className":1382},[],[1384],{"type":47,"value":1385},"https:\u002F\u002Fsplunkbase.splunk.com\u002Fapps",{"type":42,"tag":394,"props":1387,"children":1388},{},[1389,1391],{"type":47,"value":1390},"Sumo Logic: ",{"type":42,"tag":64,"props":1392,"children":1394},{"className":1393},[],[1395],{"type":47,"value":1396},"https:\u002F\u002Fwww.sumologic.com\u002Fhelp\u002Fdocs\u002Fintegrations\u002F",{"type":42,"tag":50,"props":1398,"children":1399},{},[1400],{"type":47,"value":1401},"For each competitor, the subagent must determine:",{"type":42,"tag":422,"props":1403,"children":1404},{},[1405,1410,1415,1420,1425,1430,1435],{"type":42,"tag":394,"props":1406,"children":1407},{},[1408],{"type":47,"value":1409},"Whether a matching integration\u002Fapp exists (exact, partial, or no match)",{"type":42,"tag":394,"props":1411,"children":1412},{},[1413],{"type":47,"value":1414},"Integration\u002Fapp name, publisher, direct catalog link, version, and last-updated date",{"type":42,"tag":394,"props":1416,"children":1417},{},[1418],{"type":47,"value":1419},"Which data sources and event types it covers (be specific, not generic)",{"type":42,"tag":394,"props":1421,"children":1422},{},[1423],{"type":47,"value":1424},"Collection method used (API pull, syslog push, agent\u002Fforwarder, cloud delivery, etc.)",{"type":42,"tag":394,"props":1426,"children":1427},{},[1428],{"type":47,"value":1429},"Protocol and wire format details (CEF, LEEF, JSON, key-value, etc.) if documented",{"type":42,"tag":394,"props":1431,"children":1432},{},[1433],{"type":47,"value":1434},"Support tier (vendor-maintained, platform-built, community\u002Fpartner, or unsupported)",{"type":42,"tag":394,"props":1436,"children":1437},{},[1438],{"type":47,"value":1439},"Notable gaps or differentiators compared to what Elastic could offer",{"type":42,"tag":50,"props":1441,"children":1442},{},[1443,1445,1451],{"type":47,"value":1444},"Output: write all findings to ",{"type":42,"tag":64,"props":1446,"children":1448},{"className":1447},[],[1449],{"type":47,"value":1450},"references\u002Fcompetitive-siem-coverage.md",{"type":47,"value":1452}," using the structure defined in the checklist (summary table → per-competitor H2 sections → comparison notes). Return a concise inline summary with which competitors have integrations, the dominant collection method found, and the path to the written file.",{"type":42,"tag":50,"props":1454,"children":1455},{},[1456,1458,1462,1464,1469],{"type":47,"value":1457},"Provide: product name, vendor name, common aliases or abbreviations for the product, and the ",{"type":42,"tag":56,"props":1459,"children":1460},{},[1461],{"type":47,"value":117},{"type":47,"value":1463}," to ",{"type":42,"tag":64,"props":1465,"children":1467},{"className":1466},[],[1468],{"type":47,"value":510},{"type":47,"value":1470}," (so the subagent reads it itself — do not paste the checklist content into the prompt).",{"type":42,"tag":333,"props":1472,"children":1474},{"id":1473},"phase-3-synthesize-and-supplement",[1475],{"type":47,"value":1476},"Phase 3: Synthesize and supplement",{"type":42,"tag":50,"props":1478,"children":1479},{},[1480],{"type":47,"value":1481},"After all subagents return:",{"type":42,"tag":390,"props":1483,"children":1484},{},[1485,1508,1518,1528,1546,1556,1574,1591],{"type":42,"tag":394,"props":1486,"children":1487},{},[1488,1493,1495,1500,1501,1506],{"type":42,"tag":56,"props":1489,"children":1490},{},[1491],{"type":47,"value":1492},"Read subagent-written files.",{"type":47,"value":1494}," Subagents may have written detailed findings to ",{"type":42,"tag":64,"props":1496,"children":1498},{"className":1497},[],[1499],{"type":47,"value":778},{"type":47,"value":829},{"type":42,"tag":64,"props":1502,"children":1504},{"className":1503},[],[1505],{"type":47,"value":642},{"type":47,"value":1507}," and returned only summaries. Read the files they reference to get the full picture. The subagent summaries will tell you which files to read and when.",{"type":42,"tag":394,"props":1509,"children":1510},{},[1511,1516],{"type":42,"tag":56,"props":1512,"children":1513},{},[1514],{"type":47,"value":1515},"Merge findings",{"type":47,"value":1517}," from all research tracks into a unified understanding.",{"type":42,"tag":394,"props":1519,"children":1520},{},[1521,1526],{"type":42,"tag":56,"props":1522,"children":1523},{},[1524],{"type":47,"value":1525},"Cross-reference",{"type":47,"value":1527}," subagent findings with any local reference material the user provided.",{"type":42,"tag":394,"props":1529,"children":1530},{},[1531,1536,1538,1544],{"type":42,"tag":56,"props":1532,"children":1533},{},[1534],{"type":47,"value":1535},"Fill gaps",{"type":47,"value":1537}," using your own grounded knowledge of the vendor\u002Fproduct. Only include information you are confident is accurate and can be attributed to known documentation, specifications, or widely established facts. Flag any details that could not be verified with a ",{"type":42,"tag":64,"props":1539,"children":1541},{"className":1540},[],[1542],{"type":47,"value":1543},"[UNVERIFIED]",{"type":47,"value":1545}," marker.",{"type":42,"tag":394,"props":1547,"children":1548},{},[1549,1554],{"type":42,"tag":56,"props":1550,"children":1551},{},[1552],{"type":47,"value":1553},"Resolve conflicts",{"type":47,"value":1555}," between subagent findings. When sources disagree, prefer official vendor documentation over third-party sources.",{"type":42,"tag":394,"props":1557,"children":1558},{},[1559,1564,1566,1572],{"type":42,"tag":56,"props":1560,"children":1561},{},[1562],{"type":47,"value":1563},"Collect sample data",{"type":47,"value":1565}," -- extract or compile representative sample events from documentation, API response examples, or log format guides. Save each as a separate file in the ",{"type":42,"tag":64,"props":1567,"children":1569},{"className":1568},[],[1570],{"type":47,"value":1571},"sample-events\u002F",{"type":47,"value":1573}," subdirectory.",{"type":42,"tag":394,"props":1575,"children":1576},{},[1577,1582,1584,1589],{"type":42,"tag":56,"props":1578,"children":1579},{},[1580],{"type":47,"value":1581},"Review temp\u002F artifacts",{"type":47,"value":1583}," if needed. Subagents may have downloaded repos, SDKs, or schemas into ",{"type":42,"tag":64,"props":1585,"children":1587},{"className":1586},[],[1588],{"type":47,"value":642},{"type":47,"value":1590},". You can inspect these directly if you need more detail than what the subagent summaries and reference files provide.",{"type":42,"tag":394,"props":1592,"children":1593},{},[1594,1604],{"type":42,"tag":56,"props":1595,"children":1596},{},[1597,1599],{"type":47,"value":1598},"Read ",{"type":42,"tag":64,"props":1600,"children":1602},{"className":1601},[],[1603],{"type":47,"value":1450},{"type":47,"value":1605}," (written by Track E). Extract the summary table and overall comparison notes — these are used directly in section 1.5 of the research brief.",{"type":42,"tag":333,"props":1607,"children":1609},{"id":1608},"phase-4-ecs-mapping-analysis",[1610],{"type":47,"value":1611},"Phase 4: ECS mapping analysis",{"type":42,"tag":50,"props":1613,"children":1614},{},[1615],{"type":47,"value":1616},"Using the ECS reference skill loaded earlier, perform an initial field mapping analysis:",{"type":42,"tag":390,"props":1618,"children":1619},{},[1620,1643,1678,1713],{"type":42,"tag":394,"props":1621,"children":1622},{},[1623,1625],{"type":47,"value":1624},"For each identified field from the product's data, determine:\n",{"type":42,"tag":422,"props":1626,"children":1627},{},[1628,1633,1638],{"type":42,"tag":394,"props":1629,"children":1630},{},[1631],{"type":47,"value":1632},"Whether it maps to an existing ECS field (and which one)",{"type":42,"tag":394,"props":1634,"children":1635},{},[1636],{"type":47,"value":1637},"Whether it should be a custom field under the integration namespace",{"type":42,"tag":394,"props":1639,"children":1640},{},[1641],{"type":47,"value":1642},"The appropriate Elasticsearch field type",{"type":42,"tag":394,"props":1644,"children":1645},{},[1646,1648,1654,1655,1661,1662,1668,1670,1676],{"type":47,"value":1647},"Identify which ",{"type":42,"tag":64,"props":1649,"children":1651},{"className":1650},[],[1652],{"type":47,"value":1653},"event.kind",{"type":47,"value":244},{"type":42,"tag":64,"props":1656,"children":1658},{"className":1657},[],[1659],{"type":47,"value":1660},"event.category",{"type":47,"value":244},{"type":42,"tag":64,"props":1663,"children":1665},{"className":1664},[],[1666],{"type":47,"value":1667},"event.type",{"type":47,"value":1669},", and ",{"type":42,"tag":64,"props":1671,"children":1673},{"className":1672},[],[1674],{"type":47,"value":1675},"event.outcome",{"type":47,"value":1677}," values apply to each event type.",{"type":42,"tag":394,"props":1679,"children":1680},{},[1681,1683,1689,1690,1696,1697,1703,1705,1711],{"type":47,"value":1682},"Note any fields that are strong candidates for ",{"type":42,"tag":64,"props":1684,"children":1686},{"className":1685},[],[1687],{"type":47,"value":1688},"related.ip",{"type":47,"value":244},{"type":42,"tag":64,"props":1691,"children":1693},{"className":1692},[],[1694],{"type":47,"value":1695},"related.user",{"type":47,"value":244},{"type":42,"tag":64,"props":1698,"children":1700},{"className":1699},[],[1701],{"type":47,"value":1702},"related.hosts",{"type":47,"value":1704},", or ",{"type":42,"tag":64,"props":1706,"children":1708},{"className":1707},[],[1709],{"type":47,"value":1710},"related.hash",{"type":47,"value":1712}," enrichment.",{"type":42,"tag":394,"props":1714,"children":1715},{},[1716,1718,1724],{"type":47,"value":1717},"Write the analysis to ",{"type":42,"tag":64,"props":1719,"children":1721},{"className":1720},[],[1722],{"type":47,"value":1723},"ecs-mapping-analysis.md",{"type":47,"value":71},{"type":42,"tag":333,"props":1726,"children":1728},{"id":1727},"phase-5-configuration-planning",[1729],{"type":47,"value":1730},"Phase 5: Configuration planning",{"type":42,"tag":50,"props":1732,"children":1733},{},[1734],{"type":47,"value":1735},"Based on the identified collection method, plan the integration configuration:",{"type":42,"tag":390,"props":1737,"children":1738},{},[1739,1744,1749,1761],{"type":42,"tag":394,"props":1740,"children":1741},{},[1742],{"type":47,"value":1743},"Determine required vs. optional configuration variables.",{"type":42,"tag":394,"props":1745,"children":1746},{},[1747],{"type":47,"value":1748},"For each variable, specify: name, title, description, type, whether it's required, whether to show it to the user, and a sensible default value.",{"type":42,"tag":394,"props":1750,"children":1751},{},[1752,1754,1759],{"type":47,"value":1753},"Map variables to the appropriate input type's configuration surface. See ",{"type":42,"tag":64,"props":1755,"children":1757},{"className":1756},[],[1758],{"type":47,"value":402},{"type":47,"value":1760}," for the standard variables per input type.",{"type":42,"tag":394,"props":1762,"children":1763},{},[1764,1766,1772],{"type":47,"value":1765},"Write the plan to ",{"type":42,"tag":64,"props":1767,"children":1769},{"className":1768},[],[1770],{"type":47,"value":1771},"configuration-plan.md",{"type":47,"value":71},{"type":42,"tag":333,"props":1774,"children":1776},{"id":1775},"phase-6-write-research-brief",[1777],{"type":47,"value":1778},"Phase 6: Write research brief",{"type":42,"tag":50,"props":1780,"children":1781},{},[1782,1784,1789,1791,1797],{"type":47,"value":1783},"Compile the full research brief following the template in ",{"type":42,"tag":64,"props":1785,"children":1787},{"className":1786},[],[1788],{"type":47,"value":413},{"type":47,"value":1790},". Write it to ",{"type":42,"tag":64,"props":1792,"children":1794},{"className":1793},[],[1795],{"type":47,"value":1796},"research_results\u002F\u003Cproduct_slug>\u002Fresearch-brief.md",{"type":47,"value":71},{"type":42,"tag":50,"props":1799,"children":1800},{},[1801,1803,1808],{"type":47,"value":1802},"The brief must be self-contained -- a reader should be able to use it as the sole input to ",{"type":42,"tag":64,"props":1804,"children":1806},{"className":1805},[],[1807],{"type":47,"value":69},{"type":47,"value":1809}," and have everything they need.",{"type":42,"tag":50,"props":1811,"children":1812},{},[1813,1815,1820,1822,1827,1829],{"type":47,"value":1814},"When populating ",{"type":42,"tag":56,"props":1816,"children":1817},{},[1818],{"type":47,"value":1819},"section 1.5 (Competitive SIEM Coverage)",{"type":47,"value":1821},", use the summary table extracted from ",{"type":42,"tag":64,"props":1823,"children":1825},{"className":1824},[],[1826],{"type":47,"value":1450},{"type":47,"value":1828}," in Phase 3 step 8. Include the one-line summary paragraph and the three-row competitor table inline, then add a reference pointer: ",{"type":42,"tag":64,"props":1830,"children":1832},{"className":1831},[],[1833],{"type":47,"value":1834},"See references\u002Fcompetitive-siem-coverage.md for full per-vendor analysis.",{"type":42,"tag":333,"props":1836,"children":1838},{"id":1837},"phase-7-api-test-script-apicel-collection-only",[1839],{"type":47,"value":1840},"Phase 7: API test script (API\u002FCEL collection only)",{"type":42,"tag":50,"props":1842,"children":1843},{},[1844,1849],{"type":42,"tag":56,"props":1845,"children":1846},{},[1847],{"type":47,"value":1848},"Skip this phase entirely if the recommended collection method is not API-based (CEL input type).",{"type":47,"value":1850}," This phase only applies when the research has identified a REST API as the collection method.",{"type":42,"tag":50,"props":1852,"children":1853},{},[1854],{"type":47,"value":1855},"After the research brief and all companion artifacts are written, generate a standalone Python test script that exercises the exact API flow proposed for the CEL integration. This lets a human validate connectivity, authentication, pagination, and response structure against a real (or mock) API before any Elastic Agent work begins.",{"type":42,"tag":390,"props":1857,"children":1858},{},[1859,1876,1944,2186],{"type":42,"tag":394,"props":1860,"children":1861},{},[1862,1867,1869,1874],{"type":42,"tag":56,"props":1863,"children":1864},{},[1865],{"type":47,"value":1866},"Read the specification:",{"type":47,"value":1868}," Load ",{"type":42,"tag":64,"props":1870,"children":1872},{"className":1871},[],[1873],{"type":47,"value":474},{"type":47,"value":1875}," from this skill's directory. It defines every requirement for the script in detail — file structure, CLI arguments, output files, error handling, and the relationship to the proposed CEL program.",{"type":42,"tag":394,"props":1877,"children":1878},{},[1879,1884,1886],{"type":42,"tag":56,"props":1880,"children":1881},{},[1882],{"type":47,"value":1883},"Gather inputs from earlier phases.",{"type":47,"value":1885}," The script is synthesized from research already completed:",{"type":42,"tag":422,"props":1887,"children":1888},{},[1889,1899,1909,1919,1929],{"type":42,"tag":394,"props":1890,"children":1891},{},[1892,1897],{"type":42,"tag":56,"props":1893,"children":1894},{},[1895],{"type":47,"value":1896},"Authentication method and credential creation steps",{"type":47,"value":1898}," → from section 3.1 of the research brief and the api-spec-notes",{"type":42,"tag":394,"props":1900,"children":1901},{},[1902,1907],{"type":42,"tag":56,"props":1903,"children":1904},{},[1905],{"type":47,"value":1906},"Endpoint paths, query parameters, and request structure",{"type":47,"value":1908}," → from section 3.2",{"type":42,"tag":394,"props":1910,"children":1911},{},[1912,1917],{"type":42,"tag":56,"props":1913,"children":1914},{},[1915],{"type":47,"value":1916},"Pagination mechanism, termination conditions, cursor fields",{"type":47,"value":1918}," → from section 3.3",{"type":42,"tag":394,"props":1920,"children":1921},{},[1922,1927],{"type":42,"tag":56,"props":1923,"children":1924},{},[1925],{"type":47,"value":1926},"Time-based filtering parameters and formats",{"type":47,"value":1928}," → from section 3.4",{"type":42,"tag":394,"props":1930,"children":1931},{},[1932,1937,1939],{"type":42,"tag":56,"props":1933,"children":1934},{},[1935],{"type":47,"value":1936},"Configuration variables",{"type":47,"value":1938}," → from ",{"type":42,"tag":64,"props":1940,"children":1942},{"className":1941},[],[1943],{"type":47,"value":1771},{"type":42,"tag":394,"props":1945,"children":1946},{},[1947,1952,1953,1959,1961],{"type":42,"tag":56,"props":1948,"children":1949},{},[1950],{"type":47,"value":1951},"Write the script",{"type":47,"value":1463},{"type":42,"tag":64,"props":1954,"children":1956},{"className":1955},[],[1957],{"type":47,"value":1958},"research_results\u002F\u003Cproduct_slug>\u002Ftest-api.py",{"type":47,"value":1960},". Key requirements (see spec for full detail):",{"type":42,"tag":422,"props":1962,"children":1963},{},[1964,2010,2020,2044,2062,2078,2088,2098,2140,2150,2168],{"type":42,"tag":394,"props":1965,"children":1966},{},[1967,1972,1974,1980,1981,1987,1988,1994,1995,2001,2002,2008],{"type":42,"tag":56,"props":1968,"children":1969},{},[1970],{"type":47,"value":1971},"Standard library only",{"type":47,"value":1973}," — ",{"type":42,"tag":64,"props":1975,"children":1977},{"className":1976},[],[1978],{"type":47,"value":1979},"urllib.request",{"type":47,"value":244},{"type":42,"tag":64,"props":1982,"children":1984},{"className":1983},[],[1985],{"type":47,"value":1986},"json",{"type":47,"value":244},{"type":42,"tag":64,"props":1989,"children":1991},{"className":1990},[],[1992],{"type":47,"value":1993},"logging",{"type":47,"value":244},{"type":42,"tag":64,"props":1996,"children":1998},{"className":1997},[],[1999],{"type":47,"value":2000},"argparse",{"type":47,"value":244},{"type":42,"tag":64,"props":2003,"children":2005},{"className":2004},[],[2006],{"type":47,"value":2007},"ssl",{"type":47,"value":2009},", etc. No third-party dependencies.",{"type":42,"tag":394,"props":2011,"children":2012},{},[2013,2018],{"type":42,"tag":56,"props":2014,"children":2015},{},[2016],{"type":47,"value":2017},"Comprehensive module docstring",{"type":47,"value":2019}," — serves as standalone documentation: what it tests, vendor-side setup steps (credential creation, permissions, prerequisites), usage with all CLI flags, and output description.",{"type":42,"tag":394,"props":2021,"children":2022},{},[2023,2028,2030,2035,2037,2043],{"type":42,"tag":56,"props":2024,"children":2025},{},[2026],{"type":47,"value":2027},"Dual input for credentials",{"type":47,"value":2029}," — every credential and connection parameter accepted as both a CLI argument and environment variable (CLI takes precedence). Use ",{"type":42,"tag":64,"props":2031,"children":2033},{"className":2032},[],[2034],{"type":47,"value":2000},{"type":47,"value":2036}," with ",{"type":42,"tag":64,"props":2038,"children":2040},{"className":2039},[],[2041],{"type":47,"value":2042},"default=os.environ.get(...)",{"type":47,"value":71},{"type":42,"tag":394,"props":2045,"children":2046},{},[2047,2052,2054,2060],{"type":42,"tag":56,"props":2048,"children":2049},{},[2050],{"type":47,"value":2051},"Base URL always configurable",{"type":47,"value":2053}," — full URL including scheme (",{"type":42,"tag":64,"props":2055,"children":2057},{"className":2056},[],[2058],{"type":47,"value":2059},"https:\u002F\u002F...",{"type":47,"value":2061},"), even if the vendor has a single static URL. This enables pointing at mock servers.",{"type":42,"tag":394,"props":2063,"children":2064},{},[2065,2076],{"type":42,"tag":56,"props":2066,"children":2067},{},[2068,2074],{"type":42,"tag":64,"props":2069,"children":2071},{"className":2070},[],[2072],{"type":47,"value":2073},"--max-pages",{"type":47,"value":2075}," always present",{"type":47,"value":2077}," — safety limit to prevent infinite pagination during testing, even if the CEL program has no equivalent.",{"type":42,"tag":394,"props":2079,"children":2080},{},[2081,2086],{"type":42,"tag":56,"props":2082,"children":2083},{},[2084],{"type":47,"value":2085},"TLS verification disabled",{"type":47,"value":2087}," — this tests API flow, not certificate health.",{"type":42,"tag":394,"props":2089,"children":2090},{},[2091,2096],{"type":42,"tag":56,"props":2092,"children":2093},{},[2094],{"type":47,"value":2095},"Step-by-step stdout",{"type":47,"value":2097}," — show what is happening at each step (calling API, paginating, etc.) without printing raw request\u002Fresponse bodies or any sensitive data.",{"type":42,"tag":394,"props":2099,"children":2100},{},[2101,2106,2108],{"type":42,"tag":56,"props":2102,"children":2103},{},[2104],{"type":47,"value":2105},"Output directory",{"type":47,"value":2107}," with two files:\n",{"type":42,"tag":422,"props":2109,"children":2110},{},[2111,2129],{"type":42,"tag":394,"props":2112,"children":2113},{},[2114,2120,2122,2127],{"type":42,"tag":64,"props":2115,"children":2117},{"className":2116},[],[2118],{"type":47,"value":2119},"test-api.log",{"type":47,"value":2121}," — verbose log (superset of stdout, written via Python ",{"type":42,"tag":64,"props":2123,"children":2125},{"className":2124},[],[2126],{"type":47,"value":1993},{"type":47,"value":2128},")",{"type":42,"tag":394,"props":2130,"children":2131},{},[2132,2138],{"type":42,"tag":64,"props":2133,"children":2135},{"className":2134},[],[2136],{"type":47,"value":2137},"trace.json",{"type":47,"value":2139}," — detailed request\u002Fresponse trace: full URLs, headers, response bodies, pagination state transitions (which field was read, what value it had, what was sent next). Auth values redacted.",{"type":42,"tag":394,"props":2141,"children":2142},{},[2143,2148],{"type":42,"tag":56,"props":2144,"children":2145},{},[2146],{"type":47,"value":2147},"Execution summary",{"type":47,"value":2149}," — printed to stdout at the end: overall status, total events, pages fetched, any category breakdown, output location.",{"type":42,"tag":394,"props":2151,"children":2152},{},[2153,2158,2160,2166],{"type":42,"tag":56,"props":2154,"children":2155},{},[2156],{"type":47,"value":2157},"Archive",{"type":47,"value":2159}," — compress the output directory as ",{"type":42,"tag":64,"props":2161,"children":2163},{"className":2162},[],[2164],{"type":47,"value":2165},".tar.gz",{"type":47,"value":2167}," and print the path with instructions to share it with integration maintainers.",{"type":42,"tag":394,"props":2169,"children":2170},{},[2171,2176,2178,2184],{"type":42,"tag":56,"props":2172,"children":2173},{},[2174],{"type":47,"value":2175},"Error handling",{"type":47,"value":2177}," — all exceptions caught and logged; rate-limit headers logged on 429; ",{"type":42,"tag":64,"props":2179,"children":2181},{"className":2180},[],[2182],{"type":47,"value":2183},"KeyboardInterrupt",{"type":47,"value":2185}," handled gracefully; exit 0 on success, 1 on failure.",{"type":42,"tag":394,"props":2187,"children":2188},{},[2189,2194],{"type":42,"tag":56,"props":2190,"children":2191},{},[2192],{"type":47,"value":2193},"Mirror the proposed CEL flow.",{"type":47,"value":2195}," The script's request sequence, pagination logic, and termination conditions must match what was described in the research brief for the CEL program. This is the core value of the script — if it works, the CEL program should work too.",{"type":42,"tag":333,"props":2197,"children":2199},{"id":2198},"phase-8-verify-and-report",[2200],{"type":47,"value":2201},"Phase 8: Verify and report",{"type":42,"tag":390,"props":2203,"children":2204},{},[2205,2210,2230,2235],{"type":42,"tag":394,"props":2206,"children":2207},{},[2208],{"type":47,"value":2209},"Verify all output files are written and well-formed.",{"type":42,"tag":394,"props":2211,"children":2212},{},[2213,2215,2221,2223,2229],{"type":47,"value":2214},"If ",{"type":42,"tag":64,"props":2216,"children":2218},{"className":2217},[],[2219],{"type":47,"value":2220},"test-api.py",{"type":47,"value":2222}," was generated (API\u002FCEL method), verify the script has no syntax errors by running ",{"type":42,"tag":64,"props":2224,"children":2226},{"className":2225},[],[2227],{"type":47,"value":2228},"python3 -m py_compile research_results\u002F\u003Cproduct_slug>\u002Ftest-api.py",{"type":47,"value":71},{"type":42,"tag":394,"props":2231,"children":2232},{},[2233],{"type":47,"value":2234},"List all files created with their paths.",{"type":42,"tag":394,"props":2236,"children":2237},{},[2238,2240],{"type":47,"value":2239},"Provide a concise summary to the user:\n",{"type":42,"tag":422,"props":2241,"children":2242},{},[2243,2248,2253,2258,2263,2268,2279],{"type":42,"tag":394,"props":2244,"children":2245},{},[2246],{"type":47,"value":2247},"Product overview (1-2 sentences)",{"type":42,"tag":394,"props":2249,"children":2250},{},[2251],{"type":47,"value":2252},"Recommended collection method and why",{"type":42,"tag":394,"props":2254,"children":2255},{},[2256],{"type":47,"value":2257},"Number of distinct event types\u002Fdata streams identified",{"type":42,"tag":394,"props":2259,"children":2260},{},[2261],{"type":47,"value":2262},"Key findings or surprises",{"type":42,"tag":394,"props":2264,"children":2265},{},[2266],{"type":47,"value":2267},"Gaps or areas that need user input",{"type":42,"tag":394,"props":2269,"children":2270},{},[2271,2272,2277],{"type":47,"value":2214},{"type":42,"tag":64,"props":2273,"children":2275},{"className":2274},[],[2276],{"type":47,"value":2220},{"type":47,"value":2278}," was generated: remind the user to run it against the real API (with credentials) and share the resulting archive back for development",{"type":42,"tag":394,"props":2280,"children":2281},{},[2282,2284,2289],{"type":47,"value":2283},"Suggested next step (typically ",{"type":42,"tag":64,"props":2285,"children":2287},{"className":2286},[],[2288],{"type":47,"value":69},{"type":47,"value":2290}," with the brief)",{"type":42,"tag":133,"props":2292,"children":2294},{"id":2293},"research-quality-standards",[2295],{"type":47,"value":2296},"Research quality standards",{"type":42,"tag":422,"props":2298,"children":2299},{},[2300,2310,2320,2330,2347,2363,2389],{"type":42,"tag":394,"props":2301,"children":2302},{},[2303,2308],{"type":42,"tag":56,"props":2304,"children":2305},{},[2306],{"type":47,"value":2307},"Ground all claims in sources.",{"type":47,"value":2309}," Every factual statement in the brief should be traceable to vendor documentation, official specs, or widely established technical references. When using your own knowledge, explicitly note it.",{"type":42,"tag":394,"props":2311,"children":2312},{},[2313,2318],{"type":42,"tag":56,"props":2314,"children":2315},{},[2316],{"type":47,"value":2317},"Prefer official vendor documentation",{"type":47,"value":2319}," over third-party blog posts, forums, or AI-generated content.",{"type":42,"tag":394,"props":2321,"children":2322},{},[2323,2328],{"type":42,"tag":56,"props":2324,"children":2325},{},[2326],{"type":47,"value":2327},"Include direct links",{"type":47,"value":2329}," to source documentation wherever possible.",{"type":42,"tag":394,"props":2331,"children":2332},{},[2333,2338,2340,2346],{"type":42,"tag":56,"props":2334,"children":2335},{},[2336],{"type":47,"value":2337},"Capture real examples",{"type":47,"value":2339}," -- sample API responses, log lines, configuration snippets -- not fabricated ones. If you must construct an example to illustrate structure, mark it ",{"type":42,"tag":64,"props":2341,"children":2343},{"className":2342},[],[2344],{"type":47,"value":2345},"[CONSTRUCTED EXAMPLE]",{"type":47,"value":71},{"type":42,"tag":394,"props":2348,"children":2349},{},[2350,2355,2356,2361],{"type":42,"tag":56,"props":2351,"children":2352},{},[2353],{"type":47,"value":2354},"Flag uncertainty",{"type":47,"value":2036},{"type":42,"tag":64,"props":2357,"children":2359},{"className":2358},[],[2360],{"type":47,"value":1543},{"type":47,"value":2362}," for any detail that could not be confirmed from official sources.",{"type":42,"tag":394,"props":2364,"children":2365},{},[2366,2371,2373,2379,2381,2387],{"type":42,"tag":56,"props":2367,"children":2368},{},[2369],{"type":47,"value":2370},"Be specific, not generic.",{"type":47,"value":2372}," \"The API uses pagination\" is not useful. \"The API uses cursor-based pagination via a ",{"type":42,"tag":64,"props":2374,"children":2376},{"className":2375},[],[2377],{"type":47,"value":2378},"next_cursor",{"type":47,"value":2380}," field in the response body; pass it as the ",{"type":42,"tag":64,"props":2382,"children":2384},{"className":2383},[],[2385],{"type":47,"value":2386},"cursor",{"type":47,"value":2388}," query parameter\" is useful.",{"type":42,"tag":394,"props":2390,"children":2391},{},[2392,2397],{"type":42,"tag":56,"props":2393,"children":2394},{},[2395],{"type":47,"value":2396},"Cover edge cases.",{"type":47,"value":2398}," Note rate limits, maximum page sizes, required permissions, deprecated endpoints, known bugs, and any gotchas.",{"type":42,"tag":133,"props":2400,"children":2402},{"id":2401},"guardrails",[2403],{"type":47,"value":2404},"Guardrails",{"type":42,"tag":422,"props":2406,"children":2407},{},[2408,2413,2418,2423,2547,2800,2812,2817],{"type":42,"tag":394,"props":2409,"children":2410},{},[2411],{"type":47,"value":2412},"Do not fabricate sample data that looks real. Sample data must come from documentation or be clearly marked as constructed.",{"type":42,"tag":394,"props":2414,"children":2415},{},[2416],{"type":47,"value":2417},"Do not start building the integration. This skill produces research only.",{"type":42,"tag":394,"props":2419,"children":2420},{},[2421],{"type":47,"value":2422},"Do not load implementation skills (CEL, pipelines, ecs-field-mappings, etc.) -- those are for the build phase.",{"type":42,"tag":394,"props":2424,"children":2425},{},[2426,2431,2433,2439,2441],{"type":42,"tag":56,"props":2427,"children":2428},{},[2429],{"type":47,"value":2430},"Do not prescribe CEL implementation details.",{"type":47,"value":2432}," The research brief documents the API's behavior as a factual spec (endpoints, pagination mechanism, authentication flow, rate limits, error responses). It does NOT recommend specific CEL patterns, nesting structures, ",{"type":42,"tag":64,"props":2434,"children":2436},{"className":2435},[],[2437],{"type":47,"value":2438},"rate_limit()",{"type":47,"value":2440}," usage, state management approaches, or error handling strategies for the CEL program. The CEL builder agent has its own skills with authoritative patterns. Research output that prescribes CEL implementation details will be ignored or — worse — followed incorrectly, overriding the CEL skill's patterns.\n",{"type":42,"tag":422,"props":2442,"children":2443},{},[2444,2475,2501,2531],{"type":42,"tag":394,"props":2445,"children":2446},{},[2447,2452,2454,2459,2460,2466,2468,2473],{"type":42,"tag":56,"props":2448,"children":2449},{},[2450],{"type":47,"value":2451},"Good:",{"type":47,"value":2453}," \"Pagination uses ",{"type":42,"tag":64,"props":2455,"children":2457},{"className":2456},[],[2458],{"type":47,"value":2378},{"type":47,"value":2036},{"type":42,"tag":64,"props":2461,"children":2463},{"className":2462},[],[2464],{"type":47,"value":2465},"more_to_read",{"type":47,"value":2467}," boolean. Terminate when ",{"type":42,"tag":64,"props":2469,"children":2471},{"className":2470},[],[2472],{"type":47,"value":2465},{"type":47,"value":2474}," is false.\"",{"type":42,"tag":394,"props":2476,"children":2477},{},[2478,2483,2485,2491,2493,2499],{"type":42,"tag":56,"props":2479,"children":2480},{},[2481],{"type":47,"value":2482},"Bad:",{"type":47,"value":2484}," \"The CEL program should use ",{"type":42,"tag":64,"props":2486,"children":2488},{"className":2487},[],[2489],{"type":47,"value":2490},"want_more: body.more_to_read",{"type":47,"value":2492}," and store the cursor in ",{"type":42,"tag":64,"props":2494,"children":2496},{"className":2495},[],[2497],{"type":47,"value":2498},"state.?cursor.next_cursor",{"type":47,"value":2500},".\"",{"type":42,"tag":394,"props":2502,"children":2503},{},[2504,2508,2510,2516,2517,2523,2524,2530],{"type":42,"tag":56,"props":2505,"children":2506},{},[2507],{"type":47,"value":2451},{"type":47,"value":2509}," \"Rate limits: 100 req\u002Fmin\u002Fuser. Headers: ",{"type":42,"tag":64,"props":2511,"children":2513},{"className":2512},[],[2514],{"type":47,"value":2515},"X-Ratelimit-Limit",{"type":47,"value":244},{"type":42,"tag":64,"props":2518,"children":2520},{"className":2519},[],[2521],{"type":47,"value":2522},"X-Ratelimit-Remaining",{"type":47,"value":244},{"type":42,"tag":64,"props":2525,"children":2527},{"className":2526},[],[2528],{"type":47,"value":2529},"X-Ratelimit-Reset",{"type":47,"value":2500},{"type":42,"tag":394,"props":2532,"children":2533},{},[2534,2538,2540,2545],{"type":42,"tag":56,"props":2535,"children":2536},{},[2537],{"type":47,"value":2482},{"type":47,"value":2539}," \"Use the ",{"type":42,"tag":64,"props":2541,"children":2543},{"className":2542},[],[2544],{"type":47,"value":2438},{"type":47,"value":2546}," CEL function to parse these headers and propagate the result on every branch.\"",{"type":42,"tag":394,"props":2548,"children":2549},{},[2550,2555,2557,2563,2565,2571,2572,2578,2580,2586,2587,2592,2593,2599,2600,2606,2608],{"type":42,"tag":56,"props":2551,"children":2552},{},[2553],{"type":47,"value":2554},"Do not prescribe pipeline, field-mapping, or manifest implementation details.",{"type":47,"value":2556}," The research brief documents the ",{"type":42,"tag":2558,"props":2559,"children":2560},"em",{},[2561],{"type":47,"value":2562},"data",{"type":47,"value":2564}," (field names, types, enum values, ECS mapping candidates, sample events) — not how the ingest pipeline, ",{"type":42,"tag":64,"props":2566,"children":2568},{"className":2567},[],[2569],{"type":47,"value":2570},"fields\u002F*.yml",{"type":47,"value":1704},{"type":42,"tag":64,"props":2573,"children":2575},{"className":2574},[],[2576],{"type":47,"value":2577},"manifest.yml",{"type":47,"value":2579}," should be authored. The pipeline builder and reviewer skills (",{"type":42,"tag":64,"props":2581,"children":2583},{"className":2582},[],[2584],{"type":47,"value":2585},"ingest-pipelines",{"type":47,"value":244},{"type":42,"tag":64,"props":2588,"children":2590},{"className":2589},[],[2591],{"type":47,"value":499},{"type":47,"value":244},{"type":42,"tag":64,"props":2594,"children":2596},{"className":2595},[],[2597],{"type":47,"value":2598},"package-spec",{"type":47,"value":244},{"type":42,"tag":64,"props":2601,"children":2603},{"className":2602},[],[2604],{"type":47,"value":2605},"review-integration",{"type":47,"value":2607},") are the authoritative source for those decisions. Recommendations about processor choice, error-handling structure, or pipeline-level configurability will be ignored or followed incorrectly.\n",{"type":42,"tag":422,"props":2609,"children":2610},{},[2611,2696,2721,2751,2760],{"type":42,"tag":394,"props":2612,"children":2613},{},[2614,2619,2621,2627,2629,2635,2637,2643,2645,2651,2653,2658,2660,2665,2667,2673,2675,2680,2682,2688,2690,2695],{"type":42,"tag":56,"props":2615,"children":2616},{},[2617],{"type":47,"value":2618},"Specifically prohibited values in research output (configuration plans, var recommendations, architecture notes, ECS analysis, anywhere):",{"type":47,"value":2620}," the ",{"type":42,"tag":64,"props":2622,"children":2624},{"className":2623},[],[2625],{"type":47,"value":2626},"preserve_duplicate_custom_fields",{"type":47,"value":2628}," flag (legacy pipeline anti-pattern, prohibited by ",{"type":42,"tag":64,"props":2630,"children":2632},{"className":2631},[],[2633],{"type":47,"value":2634},"ingest-pipelines\u002FSKILL.md",{"type":47,"value":2636},"), ",{"type":42,"tag":64,"props":2638,"children":2640},{"className":2639},[],[2641],{"type":47,"value":2642},"event.ingested",{"type":47,"value":2644}," (managed by Elasticsearch), trailing ",{"type":42,"tag":64,"props":2646,"children":2648},{"className":2647},[],[2649],{"type":47,"value":2650},"event.original",{"type":47,"value":2652}," removal toggles, and the ",{"type":42,"tag":64,"props":2654,"children":2656},{"className":2655},[],[2657],{"type":47,"value":2626},{"type":47,"value":2659}," manifest variable \u002F tag \u002F conditional. ",{"type":42,"tag":56,"props":2661,"children":2662},{},[2663],{"type":47,"value":2664},"Never include these as configuration variables, recommended pipeline behaviors, or \"consider supporting…\" suggestions, even if they appear in legacy integrations you examined for reference patterns.",{"type":47,"value":2666}," The only ",{"type":42,"tag":64,"props":2668,"children":2670},{"className":2669},[],[2671],{"type":47,"value":2672},"preserve_*",{"type":47,"value":2674}," config var that ",{"type":42,"tag":2558,"props":2676,"children":2677},{},[2678],{"type":47,"value":2679},"is",{"type":47,"value":2681}," valid is ",{"type":42,"tag":64,"props":2683,"children":2685},{"className":2684},[],[2686],{"type":47,"value":2687},"preserve_original_event",{"type":47,"value":2689}," (file\u002Fsyslog inputs only); see the standard-var tables in ",{"type":42,"tag":64,"props":2691,"children":2693},{"className":2692},[],[2694],{"type":47,"value":402},{"type":47,"value":71},{"type":42,"tag":394,"props":2697,"children":2698},{},[2699,2704,2706,2712,2713,2719],{"type":42,"tag":56,"props":2700,"children":2701},{},[2702],{"type":47,"value":2703},"Good (data-only):",{"type":47,"value":2705}," \"The API returns both ",{"type":42,"tag":64,"props":2707,"children":2709},{"className":2708},[],[2710],{"type":47,"value":2711},"srcip",{"type":47,"value":772},{"type":42,"tag":64,"props":2714,"children":2716},{"className":2715},[],[2717],{"type":47,"value":2718},"source.ip",{"type":47,"value":2720}," for the same value; the latter is already ECS-compliant.\"",{"type":42,"tag":394,"props":2722,"children":2723},{},[2724,2729,2731,2736,2738,2743,2744,2749],{"type":42,"tag":56,"props":2725,"children":2726},{},[2727],{"type":47,"value":2728},"Bad (prescribes pipeline behavior):",{"type":47,"value":2730}," \"Add a ",{"type":42,"tag":64,"props":2732,"children":2734},{"className":2733},[],[2735],{"type":47,"value":2626},{"type":47,"value":2737}," manifest var so users can keep both ",{"type":42,"tag":64,"props":2739,"children":2741},{"className":2740},[],[2742],{"type":47,"value":2711},{"type":47,"value":772},{"type":42,"tag":64,"props":2745,"children":2747},{"className":2746},[],[2748],{"type":47,"value":2718},{"type":47,"value":2750}," populated.\"",{"type":42,"tag":394,"props":2752,"children":2753},{},[2754,2758],{"type":42,"tag":56,"props":2755,"children":2756},{},[2757],{"type":47,"value":2703},{"type":47,"value":2759}," \"Timestamps are in RFC 3339 with timezone offset.\"",{"type":42,"tag":394,"props":2761,"children":2762},{},[2763,2767,2769,2775,2777,2783,2785,2791,2793,2799],{"type":42,"tag":56,"props":2764,"children":2765},{},[2766],{"type":47,"value":2728},{"type":47,"value":2768}," \"Use a ",{"type":42,"tag":64,"props":2770,"children":2772},{"className":2771},[],[2773],{"type":47,"value":2774},"date",{"type":47,"value":2776}," processor with ",{"type":42,"tag":64,"props":2778,"children":2780},{"className":2779},[],[2781],{"type":47,"value":2782},"target_field: event.start",{"type":47,"value":2784}," and a fallback to ",{"type":42,"tag":64,"props":2786,"children":2788},{"className":2787},[],[2789],{"type":47,"value":2790},"@timestamp",{"type":47,"value":2792}," via ",{"type":42,"tag":64,"props":2794,"children":2796},{"className":2795},[],[2797],{"type":47,"value":2798},"on_failure",{"type":47,"value":2500},{"type":42,"tag":394,"props":2801,"children":2802},{},[2803,2805,2810],{"type":47,"value":2804},"The standard configuration variables for each input type are exhaustively listed in ",{"type":42,"tag":64,"props":2806,"children":2808},{"className":2807},[],[2809],{"type":47,"value":402},{"type":47,"value":2811},". Do not propose additional configuration variables outside that authoritative set unless the vendor's API genuinely requires a new product-specific variable (e.g., a tenant ID for a multi-tenant API). Even then, the variable must be tied to a documented vendor-side requirement, not a pipeline behavior toggle.",{"type":42,"tag":394,"props":2813,"children":2814},{},[2815],{"type":47,"value":2816},"If a product has multiple viable collection methods, document all of them with a recommendation and rationale, but produce detailed deep-dive material for the recommended method.",{"type":42,"tag":394,"props":2818,"children":2819},{},[2820],{"type":47,"value":2821},"If research reveals the product does not expose data in a way that Elastic can ingest, say so clearly in the brief.",{"type":42,"tag":133,"props":2823,"children":2825},{"id":2824},"handoff",[2826],{"type":47,"value":2827},"Handoff",{"type":42,"tag":50,"props":2829,"children":2830},{},[2831],{"type":47,"value":2832},"After this command completes, continue with:",{"type":42,"tag":390,"props":2834,"children":2835},{},[2836,2859,2870],{"type":42,"tag":394,"props":2837,"children":2838},{},[2839,2850,2852,2857],{"type":42,"tag":56,"props":2840,"children":2841},{},[2842,2843,2848],{"type":47,"value":2214},{"type":42,"tag":64,"props":2844,"children":2846},{"className":2845},[],[2847],{"type":47,"value":2220},{"type":47,"value":2849}," was generated",{"type":47,"value":2851}," (API\u002FCEL method): run the script against the real vendor API to validate connectivity and collect trace data. Share the resulting ",{"type":42,"tag":64,"props":2853,"children":2855},{"className":2854},[],[2856],{"type":47,"value":2165},{"type":47,"value":2858}," archive back — the trace file is valuable input for CEL program development and pipeline testing.",{"type":42,"tag":394,"props":2860,"children":2861},{},[2862,2868],{"type":42,"tag":64,"props":2863,"children":2865},{"className":2864},[],[2866],{"type":47,"value":2867},"\u002Fcreate-integration @research_results\u002F\u003Cproduct_slug>\u002Fresearch-brief.md",{"type":47,"value":2869}," to build the integration using the research brief as input.",{"type":42,"tag":394,"props":2871,"children":2872},{},[2873,2875,2881,2882,2887],{"type":47,"value":2874},"Provide additional sample data files from ",{"type":42,"tag":64,"props":2876,"children":2878},{"className":2877},[],[2879],{"type":47,"value":2880},"research_results\u002F\u003Cproduct_slug>\u002Freferences\u002Fsample-events\u002F",{"type":47,"value":2792},{"type":42,"tag":64,"props":2883,"children":2885},{"className":2884},[],[2886],{"type":47,"value":149},{"type":47,"value":2888},"-mentions.",{"items":2890,"total":2993},[2891,2910,2925,2934,2951,2964,2978],{"slug":2892,"name":2892,"fn":2893,"description":2894,"org":2895,"tags":2896,"stars":22,"repoUrl":23,"updatedAt":2909},"anonymize-logs","anonymize sensitive log data","Anonymize and sanitize customer-provided log files before they are committed as pipeline test fixtures or sample events. Performs a line-by-line review and replaces all sensitive values inline, preserving log structure and format exactly — never reformats, re-indents, or restructures content. Invoke manually with \u002Fanonymize-logs.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2897,2900,2903,2906],{"name":2898,"slug":2899,"type":15},"Data Cleaning","data-cleaning",{"name":2901,"slug":2902,"type":15},"Logs","logs",{"name":2904,"slug":2905,"type":15},"Privacy","privacy",{"name":2907,"slug":2908,"type":15},"Security","security","2026-07-18T05:13:04.420121",{"slug":2911,"name":2911,"fn":2912,"description":2913,"org":2914,"tags":2915,"stars":22,"repoUrl":23,"updatedAt":2924},"cel-programs","write CEL programs for data collection","Use for all CEL and mito work on integrations that collect from APIs — writing CEL programs, cel.yml.hbs templates, manifest configuration, mock-first development with the mito CLI, system test mock setup, and answering CEL\u002Fmito questions. Load this skill whenever any data stream uses the cel input type.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2916,2919,2922,2923],{"name":2917,"slug":2918,"type":15},"API Development","api-development",{"name":2920,"slug":2921,"type":15},"Data Engineering","data-engineering",{"name":9,"slug":8,"type":15},{"name":17,"slug":18,"type":15},"2026-07-12T07:47:10.207064",{"slug":2926,"name":2926,"fn":2927,"description":2928,"org":2929,"tags":2930,"stars":22,"repoUrl":23,"updatedAt":2933},"create-integration","create Elastic integration packages","Use when creating a new Elastic integration package, scaffolding data streams, answering package layout or structure questions, or running the end-to-end integration build workflow. Covers package topology, scaffold commands, post-scaffold edits, and full orchestration of CEL\u002Fpipeline\u002Ftest subagents.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2931,2932],{"name":20,"slug":21,"type":15},{"name":17,"slug":18,"type":15},"2026-07-12T07:46:56.318866",{"slug":2935,"name":2935,"fn":2936,"description":2937,"org":2938,"tags":2939,"stars":22,"repoUrl":23,"updatedAt":2950},"dashboard-guidelines","create and review Kibana dashboard assets","Use when creating or reviewing Kibana assets in packages, including dashboard export structure, naming, and data stream alignment.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2940,2943,2944,2947],{"name":2941,"slug":2942,"type":15},"Dashboards","dashboards",{"name":20,"slug":21,"type":15},{"name":2945,"slug":2946,"type":15},"Kibana","kibana",{"name":2948,"slug":2949,"type":15},"UI Components","ui-components","2026-07-12T07:47:07.702332",{"slug":2952,"name":2952,"fn":2953,"description":2954,"org":2955,"tags":2956,"stars":22,"repoUrl":23,"updatedAt":2963},"dashboard-review","review Elastic dashboard JSON changes","Use when reviewing dashboard JSON changes in a PR or branch. Extracts structured descriptions with kbdash, compares before\u002Fafter, and checks guideline compliance.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2957,2960,2961,2962],{"name":2958,"slug":2959,"type":15},"Code Review","code-review",{"name":2941,"slug":2942,"type":15},{"name":9,"slug":8,"type":15},{"name":2945,"slug":2946,"type":15},"2026-07-12T07:47:06.493988",{"slug":499,"name":499,"fn":2965,"description":2966,"org":2967,"tags":2968,"stars":22,"repoUrl":23,"updatedAt":2977},"define ECS field mappings for integrations","Use when defining field mappings for data streams, populating ecs.yml with ECS field references, selecting ECS categorization values, choosing custom field types, or troubleshooting mapping validation failures.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2969,2972,2975,2976],{"name":2970,"slug":2971,"type":15},"Data Modeling","data-modeling",{"name":2973,"slug":2974,"type":15},"Data Quality","data-quality",{"name":9,"slug":8,"type":15},{"name":17,"slug":18,"type":15},"2026-07-12T07:47:13.472534",{"slug":2979,"name":2979,"fn":2980,"description":2981,"org":2982,"tags":2983,"stars":22,"repoUrl":23,"updatedAt":2992},"elastic-package-cli","develop and validate Elastic integrations","Use when developing or validating Elastic integrations with elastic-package commands such as build, check, lint, format, test, stack, service, install, profiles, and benchmark.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2984,2987,2988,2989],{"name":2985,"slug":2986,"type":15},"CLI","cli",{"name":9,"slug":8,"type":15},{"name":17,"slug":18,"type":15},{"name":2990,"slug":2991,"type":15},"Testing","testing","2026-07-12T07:46:57.647395",14,{"items":2995,"total":3159},[2996,3015,3032,3043,3062,3074,3084,3097,3109,3122,3133,3146],{"slug":2997,"name":2997,"fn":2998,"description":2999,"org":3000,"tags":3001,"stars":3012,"repoUrl":3013,"updatedAt":3014},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3002,3005,3008,3009],{"name":3003,"slug":3004,"type":15},"Analytics","analytics",{"name":3006,"slug":3007,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":3010,"slug":3011,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":3016,"name":3016,"fn":3017,"description":3018,"org":3019,"tags":3020,"stars":3012,"repoUrl":3013,"updatedAt":3031},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3021,3024,3025,3028],{"name":3022,"slug":3023,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":3026,"slug":3027,"type":15},"Engineering","engineering",{"name":3029,"slug":3030,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":3033,"name":3033,"fn":3034,"description":3035,"org":3036,"tags":3037,"stars":3012,"repoUrl":3013,"updatedAt":3042},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3038,3039,3040,3041],{"name":9,"slug":8,"type":15},{"name":20,"slug":21,"type":15},{"name":3010,"slug":3011,"type":15},{"name":2990,"slug":2991,"type":15},"2026-07-12T07:46:37.277964",{"slug":3044,"name":3044,"fn":3045,"description":3046,"org":3047,"tags":3048,"stars":3059,"repoUrl":3060,"updatedAt":3061},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3049,3052,3053,3056],{"name":3050,"slug":3051,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":3054,"slug":3055,"type":15},"Operations","operations",{"name":3057,"slug":3058,"type":15},"Permissions","permissions",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:44.946285",{"slug":3063,"name":3063,"fn":3064,"description":3065,"org":3066,"tags":3067,"stars":3059,"repoUrl":3060,"updatedAt":3073},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3068,3069,3072],{"name":3050,"slug":3051,"type":15},{"name":3070,"slug":3071,"type":15},"Deployment","deployment",{"name":20,"slug":21,"type":15},"2026-07-12T07:46:42.353362",{"slug":3075,"name":3075,"fn":3076,"description":3077,"org":3078,"tags":3079,"stars":3059,"repoUrl":3060,"updatedAt":3083},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3080,3081,3082],{"name":3050,"slug":3051,"type":15},{"name":20,"slug":21,"type":15},{"name":3054,"slug":3055,"type":15},"2026-07-12T07:46:41.097412",{"slug":3085,"name":3085,"fn":3086,"description":3087,"org":3088,"tags":3089,"stars":3059,"repoUrl":3060,"updatedAt":3096},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3090,3091,3092,3095],{"name":3050,"slug":3051,"type":15},{"name":20,"slug":21,"type":15},{"name":3093,"slug":3094,"type":15},"Networking","networking",{"name":2907,"slug":2908,"type":15},"2026-07-12T07:46:43.675992",{"slug":3098,"name":3098,"fn":3099,"description":3100,"org":3101,"tags":3102,"stars":3059,"repoUrl":3060,"updatedAt":3108},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3103,3106,3107],{"name":3104,"slug":3105,"type":15},"Authentication","authentication",{"name":3050,"slug":3051,"type":15},{"name":20,"slug":21,"type":15},"2026-07-12T07:46:39.783105",{"slug":3110,"name":3110,"fn":3111,"description":3112,"org":3113,"tags":3114,"stars":3059,"repoUrl":3060,"updatedAt":3121},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3115,3118,3119,3120],{"name":3116,"slug":3117,"type":15},"Audit","audit",{"name":20,"slug":21,"type":15},{"name":2901,"slug":2902,"type":15},{"name":2907,"slug":2908,"type":15},"2026-07-12T07:47:35.092599",{"slug":3123,"name":3123,"fn":3124,"description":3125,"org":3126,"tags":3127,"stars":3059,"repoUrl":3060,"updatedAt":3132},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3128,3129,3130,3131],{"name":3104,"slug":3105,"type":15},{"name":9,"slug":8,"type":15},{"name":20,"slug":21,"type":15},{"name":2907,"slug":2908,"type":15},"2026-07-12T07:47:41.474547",{"slug":3134,"name":3134,"fn":3135,"description":3136,"org":3137,"tags":3138,"stars":3059,"repoUrl":3060,"updatedAt":3145},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3139,3140,3141,3144],{"name":9,"slug":8,"type":15},{"name":20,"slug":21,"type":15},{"name":3142,"slug":3143,"type":15},"RBAC","rbac",{"name":2907,"slug":2908,"type":15},"2026-07-12T07:47:36.394177",{"slug":3147,"name":3147,"fn":3148,"description":3149,"org":3150,"tags":3151,"stars":3059,"repoUrl":3060,"updatedAt":3158},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3152,3153,3154,3155],{"name":3003,"slug":3004,"type":15},{"name":3006,"slug":3007,"type":15},{"name":20,"slug":21,"type":15},{"name":3156,"slug":3157,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86]