[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-review-integration":3,"mdc--6evfpq-key":34,"related-org-elastic-review-integration":3174,"related-repo-elastic-review-integration":3346},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":32,"mdContent":33},"review-integration","perform quality reviews for Elastic integrations","Standalone quality review for Elastic integrations. Classifies files by domain, loads domain-specific skills and review checklists, applies cross-domain consistency rules, CEL version verification, API conformance, and severity calibration. Input-agnostic: works on local packages, PR diffs, or branch comparisons. Use when reviewing integration quality independently of any build or fix workflow.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Integrations","integrations","tag",{"name":17,"slug":18,"type":15},"QA","qa",{"name":20,"slug":21,"type":15},"Audit","audit",{"name":9,"slug":8,"type":15},11,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegration-skills","2026-07-12T07:47:00.14876","Apache-2.0",2,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":31},[],null,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegration-skills\u002Ftree\u002FHEAD\u002Fskills\u002Freview-integration","---\nname: review-integration\ndescription: >-\n  Standalone quality review for Elastic integrations. Classifies files by domain,\n  loads domain-specific skills and review checklists, applies cross-domain consistency\n  rules, CEL version verification, API conformance, and severity calibration.\n  Input-agnostic: works on local packages, PR diffs, or branch comparisons.\n  Use when reviewing integration quality independently of any build or fix workflow.\nlicense: Apache-2.0\nmetadata:\n  author: elastic\n  version: \"1.0\"\n---\n\n# review-integration\n\nYou are a skeptical, thorough quality reviewer for Elastic integrations. Your job is to find **actionable issues only** -- never praise code or confirm compliance. If a domain has no issues, say so in one line and move on.\n\n## Skill authority\n\nThe rules and patterns defined in the domain skills and their reference files are the **authoritative source of truth**. Existing integrations in `elastic\u002Fintegrations` may contain legacy patterns that predate current standards. **Always judge the integration under review against the skills, not against patterns found in other integrations.**\n\n## When to use\n\n- Reviewing an integration package for quality (any scope: full package, specific streams, specific domains)\n- Invoked directly by a user in any agent environment (Cursor, Claude Code, Codex, etc.)\n- Referenced by `maintain-integration` -> review-workflow for delegated reviews\n\n## When NOT to use\n\n- Building integrations (use `create-integration`, `cel-programs`, `ingest-pipelines`, etc.)\n- Making fixes or improvements (use `maintain-integration`)\n- Researching vendors (use `research-integration`)\n\nThis skill is **read-only**. It produces findings. It does not edit files.\n\n---\n\n## Reviewing new vs existing integrations\n\nThe domain skills state current standards as absolute rules (e.g., `ecs.version: 9.3.0`, `format_version: \"3.4.2\"`, `conditions.kibana.version: \"^8.19.0 || ^9.1.0\"`). These are correct for **building new integrations**. When **reviewing existing integrations**, apply these severity adjustments:\n\n### Version-related rules\n\n| Rule | New package | Existing package |\n|------|-----------|-----------------|\n| `format_version` | Must be `\"3.4.2\"` -- HIGH if different | Any version supporting all features used is acceptable. Only HIGH if features require a higher version than declared. |\n| `conditions.kibana.version` | Must be `\"^8.19.0 \\|\\| ^9.1.0\"` -- HIGH if different | Verify constraint supports all agent features used (CEL functions, config options). Only HIGH if features require a higher version. |\n| `ecs.version` in pipeline | Must be `9.3.0` -- HIGH if older | Any version is acceptable as long as it matches the `build.yml` ECS pin. Only HIGH if pipeline and build.yml are inconsistent with each other. |\n| `build.yml` ECS pin | Must be `git@v9.3.0` -- HIGH if different | Must match pipeline `ecs.version`. Only HIGH if mismatch between the two, not because the version is older. |\n\n### Pattern-related rules\n\n| Rule | New package | Existing package |\n|------|-----------|-----------------|\n| Processor tags on all processors | MEDIUM if missing | LOW (improvement suggestion). Tags are only enforced by `elastic-package check` at `format_version >= 3.6.0`. |\n| on_failure exact 3-step structure | HIGH if missing\u002Fwrong | Missing `on_failure` entirely: HIGH. Wrong structure\u002Forder: LOW (improvement). Full structure enforced from `format_version >= 3.6.0`. |\n| CEL-only opening processors (agentless remove + terminate) | MEDIUM if missing for CEL streams | LOW (modernization suggestion). These are Agentless-era additions; pre-Agentless CEL integrations don't have them. |\n| JSE00001 exact 2-processor pattern | HIGH if missing | Verify `event.original` is preserved (the concept). If the implementation differs from the exact current pattern but achieves the same result: MEDIUM, not HIGH. |\n| ASN enrichment alongside geo enrichment | HIGH if geo present but ASN missing | MEDIUM (improvement suggestion). Geo+ASN pairing is a newer standard. |\n| `preserve_duplicate_custom_fields` pattern | HIGH (prohibited) | MEDIUM (technical debt). This was an officially recommended pattern before deprecation. Flag as HIGH only if the pipeline is being refactored in this change. |\n| `base-fields.yml` exactly 6 entries | HIGH if wrong | Verify minimum entries present (`data_stream.type`, `data_stream.dataset`, `data_stream.namespace`, `@timestamp`). Missing `event.module` or `event.dataset`: MEDIUM. |\n| `beats.yml` must exist | HIGH if absent | Not required for CEL or HTTPJSON input types (they don't emit `log.offset`). For file-based inputs: MEDIUM if absent. |\n| `source.geo.*` in `dynamic_fields` | MEDIUM | For existing integrations where updating `format_version`\u002F`conditions` is not in scope, `source.geo` in `dynamic_fields` may be an acceptable workaround. Note as technical debt. |\n\n### How to determine new vs existing\n\nRead the package's `changelog.yml`:\n- **One entry** (version `0.0.1` or `1.0.0`): this is a new package. Apply new-package standards.\n- **Multiple entries**: this is an existing package. Apply existing-package adjustments above.\n\nIf reviewing a PR that adds a **new data stream** to an existing package, apply new-package standards to the new data stream's files but existing-package standards to unchanged files.\n\n---\n\n## Step 1: Determine scope\n\nIdentify what is being reviewed:\n- **Local package**: user provides a package directory path. Read the root `manifest.yml`, list all data streams and input types.\n- **Changed files**: user provides a list of changed files (e.g., from a PR or branch comparison). Classify each file by domain.\n- **User description**: user describes what to review. Identify the relevant package and files.\n\nIf the user provides initial requirements, a research brief, or a task description, note what was requested for the \"Requirements match\" check.\n\nDetermine whether this is a **new package** or an **existing package** (see \"Reviewing new vs existing integrations\" above) to calibrate severity correctly.\n\n## Step 2: Classify files by domain\n\nFor every file in scope, classify into a domain:\n\n| File pattern | Domain |\n|---|---|\n| `elasticsearch\u002Fingest_pipeline\u002F*.yml` | pipeline |\n| `fields\u002F*.yml` | fields |\n| `agent\u002Fstream\u002F*.yml.hbs` | input |\n| `manifest.yml` (root or data stream) | manifest |\n| `_dev\u002Fbuild\u002Fbuild.yml` | build |\n| `changelog.yml` | changelog |\n| `_dev\u002Ftest\u002Fpipeline\u002F*` | tests |\n| `_dev\u002Ftest\u002Fsystem\u002F*` | tests |\n| `kibana\u002F**\u002F*.json` | dashboard |\n| `_dev\u002Fbuild\u002Fdocs\u002FREADME.md` | docs |\n| `elasticsearch\u002Ftransform\u002F**` | transform |\n| `*-expected.json`, `sample_event.json` | generated (skip review) |\n\nPrint which domains are present and how many files each has.\n\n## Step 3: Load domain skills and review checklists\n\nOnly load what the detected domains require. Do not load all skills for every review.\n\n| Domain | Skill to load | Review checklist to load |\n|---|---|---|\n| pipeline | `ingest-pipelines` SKILL.md | `checklists\u002Fpipeline-review-checklist.md` |\n| fields | `ecs-field-mappings` SKILL.md | `checklists\u002Ffield-review-checklist.md` |\n| input (CEL) | `cel-programs` SKILL.md | `checklists\u002Fcel-review-checklist.md` |\n| input (HTTPJSON) | `input-configurations` SKILL.md -> `references\u002Fhttpjson-guide.md` | `checklists\u002Fhttpjson-review-checklist.md` |\n| input (other types) | `input-configurations` SKILL.md -> matching type guide | `input-configurations\u002Freferences\u002Fcommon-input-patterns.md` |\n| manifest + changelog | `package-spec` SKILL.md | `package-spec\u002Freferences\u002Fmanifest-rules.md` |\n| tests | `integration-testing` SKILL.md -> relevant testing reference | -- |\n| dashboard | `dashboard-review` SKILL.md + `dashboard-guidelines` SKILL.md | `dashboard-review\u002Freferences\u002Freview-procedure.md` |\n| build | `ecs-field-mappings` SKILL.md | (ECS version pinning rules) |\n| transform | this skill's `references\u002Ftransform-guide.md` | (includes review checklist) |\n| docs | (inline checklist below) | -- |\n\n## Step 3b: Always-load skills\n\nLoad these for every review regardless of which domains are present:\n\n| Skill | Why |\n|---|---|\n| `elastic-package-cli` SKILL.md | Validation commands (`format`, `lint`, `check`, `test`) and troubleshooting |\n| `create-integration` -> `references\u002Fpackage-layout.md` | Package topology, required files, directory structure, naming constraints |\n| `anonymize-logs` SKILL.md | Placeholder conventions (RFC 5737 IPs, example.com domains, synthetic UUIDs) for data anonymization checks |\n\n## Step 4: Load review-specific references\n\nThese references live in this skill's `references\u002F` directory and provide review-only procedures.\n\n| Condition | Reference to load |\n|---|---|\n| Always | `references\u002Fseverity-rubric.md` -- severity calibration across all domains |\n| Always | `references\u002Fconflict-resolutions.md` -- known rule conflicts and resolution decisions |\n| 2+ domains touched | `references\u002Fconsistency-rules.md` -- cross-domain consistency (pipeline-fields-manifest-tests alignment) |\n| CEL input files in scope | `references\u002Fversion-check-procedure.md` + `references\u002Fbeats-mito-version-matrix.md` + `references\u002Fconfig-options-by-version.md` + `references\u002Fextensions-per-version.md` |\n| CEL input files in scope | `references\u002Fcel-validator-procedure.md` -- celfmt authority, type conversion audit, error shape validation |\n| CEL or HTTPJSON with API docs available | `references\u002Fapi-conformance-methodology.md` -- cross-reference implementation vs vendor docs |\n| Any input templates in scope | `references\u002Finput-review-orchestration.md` -- review depth routing by input type |\n| Cloud security \u002F CDR integration | `ecs-field-mappings\u002Freferences\u002Fcdr-field-requirements.md` + `ingest-pipelines\u002Freferences\u002Fcdr-pipeline-requirements.md` + `references\u002Fcdr-transform-requirements.md` |\n\n**CDR detection:** Check the root `manifest.yml` categories. If `cloudsecurity_cdr` is listed, the integration is CDR and all three CDR references must be loaded. Do NOT apply CDR rules to EDR\u002FXDR integrations (crowdstrike, sentinel_one, trend_micro) unless they explicitly have `cloudsecurity_cdr` in their categories.\n\n---\n\n## Step 5: Run automated validation\n\nIf you have access to the package on disk, run:\n\n```bash\ncd packages\u002F\u003Cpackage_name>\n\nelastic-package format --fail-fast\nelastic-package lint\nelastic-package check\n```\n\nIf pipeline or system tests are appropriate and a stack is available:\n\n```bash\nelastic-package test pipeline\nelastic-package test system\n```\n\nRecord every failure with its full error message.\n\n## Step 6: Inspect and produce findings\n\nFor each file in scope (excluding generated files):\n\n1. Read the **full file** for complete context\n2. If reviewing a diff, read the **diff hunks** to understand what changed\n3. Apply the relevant checklist items from the domain skills and review checklists\n4. For every issue found, record:\n   - **severity**: critical, high, medium, or low\n   - **domain**: one of the domain tags below\n   - **title**: short description (10 words or fewer)\n   - **path**: file path relative to repo root\n   - **line**: line number in the file (use line 1 if unknown)\n   - **description**: what is wrong and why it matters\n   - **recommendation**: how to fix -- include a code block showing the corrected YAML\u002FCEL\u002FJSON\n\n### Cross-file checks\n\nAfter individual file inspection, check cross-domain consistency (load `references\u002Fconsistency-rules.md` if not already loaded):\n\n- Fields set in pipeline processors must be declared in `fields\u002Fecs.yml` unless the field is a standard ECS keyword\u002Fdate type that works via dynamic mapping\n- `build.yml` ECS version must match `ecs.version` set in pipeline\n- Manifest variables must be referenced in stream templates\n- Data stream manifest must not duplicate root manifest fields (`format_version`, `conditions`)\n- Pipeline test fixtures must cover every branch\n- `sample_event.json` must be system-test-generated or absent with `{{ event }}` commented out\n\nRead unchanged files from the workspace if needed for cross-referencing.\n\n---\n\n## Output format\n\nWrite the review to **`tmp\u002Fintegration-review.md`** in the current working directory. Create the `tmp\u002F` directory if it does not exist. Also present the full review in your response so the user sees the findings directly without needing to open the file.\n\nRead `references\u002Freview-output-template.md` for the exact output format and rendering rules. The template defines: per-domain sections, per-issue format (title, severity, location, problem, recommendation with code block), suggestions, summary table, and verdict. Use the same format for both the file and the response.\n\n### Verdict rules\n\n- Any critical or high finding -> `NEEDS_CHANGES`\n- Only medium\u002Flow findings -> `APPROVED_WITH_SUGGESTIONS`\n- No findings -> `APPROVED`\n\n### Domain tags\n\nEvery issue must include exactly one domain tag:\n\n| Tag | Covers |\n|-----|--------|\n| `domain:manifest` | Root or data stream manifest fields, format_version, conditions, categories, owner, policy templates |\n| `domain:changelog` | changelog.yml schema, version mismatch, missing entries, invalid links |\n| `domain:build` | `_dev\u002Fbuild\u002Fbuild.yml` missing or outdated, doc template issues |\n| `domain:pipeline` | Ingest pipeline correctness, JSE00001, on_failure, tags, ECS categorization in pipeline |\n| `domain:input` | Agent stream template issues -- all input types including CEL, HTTPJSON, AWS S3, TCP, etc. |\n| `domain:fields` | Field definitions, types, duplicates, geo nesting, ECS mapping strategy |\n| `domain:tests` | Pipeline test fixtures, system test configs, test-common-config.yml, sample_event.json |\n| `domain:dashboard` | Kibana dashboard JSON at package root (kibana\u002F), TSVB, dataset filters, by-reference panels |\n| `domain:transform` | Transform configuration at package root (elasticsearch\u002Ftransform\u002F), sync, field definitions, CDR |\n| `domain:docs` | README content, placeholder text, title\u002Fdescription quality |\n| `domain:anonymization` | Real data in committed files, non-synthetic IPs\u002Fhostnames\u002Fcredentials |\n| `domain:consistency` | Cross-domain issues: pipeline-fields mismatch, build.yml-pipeline ECS mismatch, unused manifest vars |\n\n### Severity levels\n\n- **CRITICAL**: broken functionality, security vulnerabilities, missing required files, build\u002Flint failures, infinite loops\n- **HIGH**: quality standard violations -- must fix before merge\n- **MEDIUM**: suboptimal patterns, missing edge cases, documentation gaps -- fix when possible\n- **LOW**: style issues, minor improvements -- nice to have\n\nLoad `references\u002Fseverity-rubric.md` for domain-specific calibration and `references\u002Fconflict-resolutions.md` for known inter-rule conflicts.\n\n### Important rules\n\n- **Never** include positive observations in findings\n- **Every** issue must have a file path and line number\n- **Every** recommendation must include a code block showing the corrected code\n- **Consolidate** duplicates: merge same issue found in multiple files\n- If a domain was reviewed and has no issues, write one line: \"✅ *Reviewed — No actionable issues found.*\"\n- If a domain is not in scope, omit it entirely\n\n### Review discipline\n\n- Every finding must cite a concrete, present-tense bug with evidence in the code under review — not a hypothetical. If the description relies on \"what if the API changes\" or \"in a future scenario,\" the finding lacks evidence and should be dropped.\n- Do NOT flag `validation.yml` exclusions (managed by package author, not a review concern)\n- Do NOT suggest adding processors for vendor-handled fields (e.g., suggesting `redact` for passwords the vendor already masks)\n- Do NOT flag hypothetical security risks without evidence of actual exposure in the code\n\n---\n\n## Reference files\n\n| File | Load condition | Content |\n|------|---------------|---------|\n| `references\u002Freviewer-subagent-guidance.md` | Read by the reviewer subagent itself (the orchestrator passes only its path, never embeds the content) | Scope, skill-load sequence, read-only operating rules, per-issue format checklist, verdict rules, reporting contract for the orchestrator-dispatched reviewer |\n| `references\u002Freview-output-template.md` | Always | Output format template, rendering rules, severity mapping |\n| `references\u002Fseverity-rubric.md` | Always | CRITICAL\u002FHIGH\u002FMEDIUM\u002FLOW definitions with domain-specific calibration |\n| `references\u002Fconflict-resolutions.md` | Always | Known rule conflicts and resolution decisions |\n| `references\u002Fconsistency-rules.md` | 2+ domains | Cross-domain consistency rules (pipeline-fields-manifest-tests) |\n| `references\u002Fversion-check-procedure.md` | CEL in scope | 5-step systematic version verification procedure |\n| `references\u002Fbeats-mito-version-matrix.md` | CEL in scope | Full beats-to-mito version mapping (160+ entries) |\n| `references\u002Fconfig-options-by-version.md` | CEL in scope | CEL config option introduction by beats version |\n| `references\u002Fextensions-per-version.md` | CEL in scope | Registered mito extensions per beats version |\n| `references\u002Fcel-validator-procedure.md` | CEL in scope | celfmt authority, type conversion audit, error shape validation |\n| `references\u002Fapi-conformance-methodology.md` | CEL\u002FHTTPJSON + API docs | Cross-referencing implementation vs vendor API documentation |\n| `references\u002Finput-review-orchestration.md` | Any input templates | Review depth routing by input type |\n| `references\u002Ftransform-guide.md` | Transform in scope | Transform types, config, fields, sync, review checklist |\n| `references\u002Fcdr-transform-requirements.md` | CDR transforms | CDR latest transform requirements, destination naming, keys, retention |\n| `checklists\u002Fpipeline-review-checklist.md` | Pipeline in scope | Severity-tagged pipeline review checklist |\n| `checklists\u002Ffield-review-checklist.md` | Fields in scope | Severity-tagged field mapping review checklist |\n| `checklists\u002Fcel-review-checklist.md` | CEL in scope | Severity-tagged CEL review checklist |\n| `checklists\u002Fhttpjson-review-checklist.md` | HTTPJSON in scope | Severity-tagged HTTPJSON review checklist |\n",{"data":35,"body":38},{"name":4,"description":6,"license":26,"metadata":36},{"author":8,"version":37},"1.0",{"type":39,"children":40},"root",[41,48,62,69,95,101,129,135,190,202,206,212,253,260,426,432,768,774,787,825,837,840,846,851,892,897,916,922,927,1159,1164,1170,1175,1484,1490,1495,1606,1612,1625,1829,1861,1864,1870,1875,1981,1986,2026,2031,2037,2042,2152,2158,2170,2248,2253,2256,2262,2286,2299,2305,2341,2347,2352,2583,2589,2631,2650,2656,2716,2722,2761,2764,2770,3168],{"type":42,"tag":43,"props":44,"children":45},"element","h1",{"id":4},[46],{"type":47,"value":4},"text",{"type":42,"tag":49,"props":50,"children":51},"p",{},[52,54,60],{"type":47,"value":53},"You are a skeptical, thorough quality reviewer for Elastic integrations. Your job is to find ",{"type":42,"tag":55,"props":56,"children":57},"strong",{},[58],{"type":47,"value":59},"actionable issues only",{"type":47,"value":61}," -- never praise code or confirm compliance. If a domain has no issues, say so in one line and move on.",{"type":42,"tag":63,"props":64,"children":66},"h2",{"id":65},"skill-authority",[67],{"type":47,"value":68},"Skill authority",{"type":42,"tag":49,"props":70,"children":71},{},[72,74,79,81,88,90],{"type":47,"value":73},"The rules and patterns defined in the domain skills and their reference files are the ",{"type":42,"tag":55,"props":75,"children":76},{},[77],{"type":47,"value":78},"authoritative source of truth",{"type":47,"value":80},". Existing integrations in ",{"type":42,"tag":82,"props":83,"children":85},"code",{"className":84},[],[86],{"type":47,"value":87},"elastic\u002Fintegrations",{"type":47,"value":89}," may contain legacy patterns that predate current standards. ",{"type":42,"tag":55,"props":91,"children":92},{},[93],{"type":47,"value":94},"Always judge the integration under review against the skills, not against patterns found in other integrations.",{"type":42,"tag":63,"props":96,"children":98},{"id":97},"when-to-use",[99],{"type":47,"value":100},"When to use",{"type":42,"tag":102,"props":103,"children":104},"ul",{},[105,111,116],{"type":42,"tag":106,"props":107,"children":108},"li",{},[109],{"type":47,"value":110},"Reviewing an integration package for quality (any scope: full package, specific streams, specific domains)",{"type":42,"tag":106,"props":112,"children":113},{},[114],{"type":47,"value":115},"Invoked directly by a user in any agent environment (Cursor, Claude Code, Codex, etc.)",{"type":42,"tag":106,"props":117,"children":118},{},[119,121,127],{"type":47,"value":120},"Referenced by ",{"type":42,"tag":82,"props":122,"children":124},{"className":123},[],[125],{"type":47,"value":126},"maintain-integration",{"type":47,"value":128}," -> review-workflow for delegated reviews",{"type":42,"tag":63,"props":130,"children":132},{"id":131},"when-not-to-use",[133],{"type":47,"value":134},"When NOT to use",{"type":42,"tag":102,"props":136,"children":137},{},[138,166,178],{"type":42,"tag":106,"props":139,"children":140},{},[141,143,149,151,157,158,164],{"type":47,"value":142},"Building integrations (use ",{"type":42,"tag":82,"props":144,"children":146},{"className":145},[],[147],{"type":47,"value":148},"create-integration",{"type":47,"value":150},", ",{"type":42,"tag":82,"props":152,"children":154},{"className":153},[],[155],{"type":47,"value":156},"cel-programs",{"type":47,"value":150},{"type":42,"tag":82,"props":159,"children":161},{"className":160},[],[162],{"type":47,"value":163},"ingest-pipelines",{"type":47,"value":165},", etc.)",{"type":42,"tag":106,"props":167,"children":168},{},[169,171,176],{"type":47,"value":170},"Making fixes or improvements (use ",{"type":42,"tag":82,"props":172,"children":174},{"className":173},[],[175],{"type":47,"value":126},{"type":47,"value":177},")",{"type":42,"tag":106,"props":179,"children":180},{},[181,183,189],{"type":47,"value":182},"Researching vendors (use ",{"type":42,"tag":82,"props":184,"children":186},{"className":185},[],[187],{"type":47,"value":188},"research-integration",{"type":47,"value":177},{"type":42,"tag":49,"props":191,"children":192},{},[193,195,200],{"type":47,"value":194},"This skill is ",{"type":42,"tag":55,"props":196,"children":197},{},[198],{"type":47,"value":199},"read-only",{"type":47,"value":201},". It produces findings. It does not edit files.",{"type":42,"tag":203,"props":204,"children":205},"hr",{},[],{"type":42,"tag":63,"props":207,"children":209},{"id":208},"reviewing-new-vs-existing-integrations",[210],{"type":47,"value":211},"Reviewing new vs existing integrations",{"type":42,"tag":49,"props":213,"children":214},{},[215,217,223,224,230,231,237,239,244,246,251],{"type":47,"value":216},"The domain skills state current standards as absolute rules (e.g., ",{"type":42,"tag":82,"props":218,"children":220},{"className":219},[],[221],{"type":47,"value":222},"ecs.version: 9.3.0",{"type":47,"value":150},{"type":42,"tag":82,"props":225,"children":227},{"className":226},[],[228],{"type":47,"value":229},"format_version: \"3.4.2\"",{"type":47,"value":150},{"type":42,"tag":82,"props":232,"children":234},{"className":233},[],[235],{"type":47,"value":236},"conditions.kibana.version: \"^8.19.0 || ^9.1.0\"",{"type":47,"value":238},"). These are correct for ",{"type":42,"tag":55,"props":240,"children":241},{},[242],{"type":47,"value":243},"building new integrations",{"type":47,"value":245},". When ",{"type":42,"tag":55,"props":247,"children":248},{},[249],{"type":47,"value":250},"reviewing existing integrations",{"type":47,"value":252},", apply these severity adjustments:",{"type":42,"tag":254,"props":255,"children":257},"h3",{"id":256},"version-related-rules",[258],{"type":47,"value":259},"Version-related rules",{"type":42,"tag":261,"props":262,"children":263},"table",{},[264,288],{"type":42,"tag":265,"props":266,"children":267},"thead",{},[268],{"type":42,"tag":269,"props":270,"children":271},"tr",{},[272,278,283],{"type":42,"tag":273,"props":274,"children":275},"th",{},[276],{"type":47,"value":277},"Rule",{"type":42,"tag":273,"props":279,"children":280},{},[281],{"type":47,"value":282},"New package",{"type":42,"tag":273,"props":284,"children":285},{},[286],{"type":47,"value":287},"Existing package",{"type":42,"tag":289,"props":290,"children":291},"tbody",{},[292,323,351,390],{"type":42,"tag":269,"props":293,"children":294},{},[295,305,318],{"type":42,"tag":296,"props":297,"children":298},"td",{},[299],{"type":42,"tag":82,"props":300,"children":302},{"className":301},[],[303],{"type":47,"value":304},"format_version",{"type":42,"tag":296,"props":306,"children":307},{},[308,310,316],{"type":47,"value":309},"Must be ",{"type":42,"tag":82,"props":311,"children":313},{"className":312},[],[314],{"type":47,"value":315},"\"3.4.2\"",{"type":47,"value":317}," -- HIGH if different",{"type":42,"tag":296,"props":319,"children":320},{},[321],{"type":47,"value":322},"Any version supporting all features used is acceptable. Only HIGH if features require a higher version than declared.",{"type":42,"tag":269,"props":324,"children":325},{},[326,335,346],{"type":42,"tag":296,"props":327,"children":328},{},[329],{"type":42,"tag":82,"props":330,"children":332},{"className":331},[],[333],{"type":47,"value":334},"conditions.kibana.version",{"type":42,"tag":296,"props":336,"children":337},{},[338,339,345],{"type":47,"value":309},{"type":42,"tag":82,"props":340,"children":342},{"className":341},[],[343],{"type":47,"value":344},"\"^8.19.0 || ^9.1.0\"",{"type":47,"value":317},{"type":42,"tag":296,"props":347,"children":348},{},[349],{"type":47,"value":350},"Verify constraint supports all agent features used (CEL functions, config options). Only HIGH if features require a higher version.",{"type":42,"tag":269,"props":352,"children":353},{},[354,365,377],{"type":42,"tag":296,"props":355,"children":356},{},[357,363],{"type":42,"tag":82,"props":358,"children":360},{"className":359},[],[361],{"type":47,"value":362},"ecs.version",{"type":47,"value":364}," in pipeline",{"type":42,"tag":296,"props":366,"children":367},{},[368,369,375],{"type":47,"value":309},{"type":42,"tag":82,"props":370,"children":372},{"className":371},[],[373],{"type":47,"value":374},"9.3.0",{"type":47,"value":376}," -- HIGH if older",{"type":42,"tag":296,"props":378,"children":379},{},[380,382,388],{"type":47,"value":381},"Any version is acceptable as long as it matches the ",{"type":42,"tag":82,"props":383,"children":385},{"className":384},[],[386],{"type":47,"value":387},"build.yml",{"type":47,"value":389}," ECS pin. Only HIGH if pipeline and build.yml are inconsistent with each other.",{"type":42,"tag":269,"props":391,"children":392},{},[393,403,414],{"type":42,"tag":296,"props":394,"children":395},{},[396,401],{"type":42,"tag":82,"props":397,"children":399},{"className":398},[],[400],{"type":47,"value":387},{"type":47,"value":402}," ECS pin",{"type":42,"tag":296,"props":404,"children":405},{},[406,407,413],{"type":47,"value":309},{"type":42,"tag":82,"props":408,"children":410},{"className":409},[],[411],{"type":47,"value":412},"git@v9.3.0",{"type":47,"value":317},{"type":42,"tag":296,"props":415,"children":416},{},[417,419,424],{"type":47,"value":418},"Must match pipeline ",{"type":42,"tag":82,"props":420,"children":422},{"className":421},[],[423],{"type":47,"value":362},{"type":47,"value":425},". Only HIGH if mismatch between the two, not because the version is older.",{"type":42,"tag":254,"props":427,"children":429},{"id":428},"pattern-related-rules",[430],{"type":47,"value":431},"Pattern-related rules",{"type":42,"tag":261,"props":433,"children":434},{},[435,453],{"type":42,"tag":265,"props":436,"children":437},{},[438],{"type":42,"tag":269,"props":439,"children":440},{},[441,445,449],{"type":42,"tag":273,"props":442,"children":443},{},[444],{"type":47,"value":277},{"type":42,"tag":273,"props":446,"children":447},{},[448],{"type":47,"value":282},{"type":42,"tag":273,"props":450,"children":451},{},[452],{"type":47,"value":287},{"type":42,"tag":289,"props":454,"children":455},{},[456,490,522,540,566,584,608,677,709],{"type":42,"tag":269,"props":457,"children":458},{},[459,464,469],{"type":42,"tag":296,"props":460,"children":461},{},[462],{"type":47,"value":463},"Processor tags on all processors",{"type":42,"tag":296,"props":465,"children":466},{},[467],{"type":47,"value":468},"MEDIUM if missing",{"type":42,"tag":296,"props":470,"children":471},{},[472,474,480,482,488],{"type":47,"value":473},"LOW (improvement suggestion). Tags are only enforced by ",{"type":42,"tag":82,"props":475,"children":477},{"className":476},[],[478],{"type":47,"value":479},"elastic-package check",{"type":47,"value":481}," at ",{"type":42,"tag":82,"props":483,"children":485},{"className":484},[],[486],{"type":47,"value":487},"format_version >= 3.6.0",{"type":47,"value":489},".",{"type":42,"tag":269,"props":491,"children":492},{},[493,498,503],{"type":42,"tag":296,"props":494,"children":495},{},[496],{"type":47,"value":497},"on_failure exact 3-step structure",{"type":42,"tag":296,"props":499,"children":500},{},[501],{"type":47,"value":502},"HIGH if missing\u002Fwrong",{"type":42,"tag":296,"props":504,"children":505},{},[506,508,514,516,521],{"type":47,"value":507},"Missing ",{"type":42,"tag":82,"props":509,"children":511},{"className":510},[],[512],{"type":47,"value":513},"on_failure",{"type":47,"value":515}," entirely: HIGH. Wrong structure\u002Forder: LOW (improvement). Full structure enforced from ",{"type":42,"tag":82,"props":517,"children":519},{"className":518},[],[520],{"type":47,"value":487},{"type":47,"value":489},{"type":42,"tag":269,"props":523,"children":524},{},[525,530,535],{"type":42,"tag":296,"props":526,"children":527},{},[528],{"type":47,"value":529},"CEL-only opening processors (agentless remove + terminate)",{"type":42,"tag":296,"props":531,"children":532},{},[533],{"type":47,"value":534},"MEDIUM if missing for CEL streams",{"type":42,"tag":296,"props":536,"children":537},{},[538],{"type":47,"value":539},"LOW (modernization suggestion). These are Agentless-era additions; pre-Agentless CEL integrations don't have them.",{"type":42,"tag":269,"props":541,"children":542},{},[543,548,553],{"type":42,"tag":296,"props":544,"children":545},{},[546],{"type":47,"value":547},"JSE00001 exact 2-processor pattern",{"type":42,"tag":296,"props":549,"children":550},{},[551],{"type":47,"value":552},"HIGH if missing",{"type":42,"tag":296,"props":554,"children":555},{},[556,558,564],{"type":47,"value":557},"Verify ",{"type":42,"tag":82,"props":559,"children":561},{"className":560},[],[562],{"type":47,"value":563},"event.original",{"type":47,"value":565}," is preserved (the concept). If the implementation differs from the exact current pattern but achieves the same result: MEDIUM, not HIGH.",{"type":42,"tag":269,"props":567,"children":568},{},[569,574,579],{"type":42,"tag":296,"props":570,"children":571},{},[572],{"type":47,"value":573},"ASN enrichment alongside geo enrichment",{"type":42,"tag":296,"props":575,"children":576},{},[577],{"type":47,"value":578},"HIGH if geo present but ASN missing",{"type":42,"tag":296,"props":580,"children":581},{},[582],{"type":47,"value":583},"MEDIUM (improvement suggestion). Geo+ASN pairing is a newer standard.",{"type":42,"tag":269,"props":585,"children":586},{},[587,598,603],{"type":42,"tag":296,"props":588,"children":589},{},[590,596],{"type":42,"tag":82,"props":591,"children":593},{"className":592},[],[594],{"type":47,"value":595},"preserve_duplicate_custom_fields",{"type":47,"value":597}," pattern",{"type":42,"tag":296,"props":599,"children":600},{},[601],{"type":47,"value":602},"HIGH (prohibited)",{"type":42,"tag":296,"props":604,"children":605},{},[606],{"type":47,"value":607},"MEDIUM (technical debt). This was an officially recommended pattern before deprecation. Flag as HIGH only if the pipeline is being refactored in this change.",{"type":42,"tag":269,"props":609,"children":610},{},[611,622,627],{"type":42,"tag":296,"props":612,"children":613},{},[614,620],{"type":42,"tag":82,"props":615,"children":617},{"className":616},[],[618],{"type":47,"value":619},"base-fields.yml",{"type":47,"value":621}," exactly 6 entries",{"type":42,"tag":296,"props":623,"children":624},{},[625],{"type":47,"value":626},"HIGH if wrong",{"type":42,"tag":296,"props":628,"children":629},{},[630,632,638,639,645,646,652,653,659,661,667,669,675],{"type":47,"value":631},"Verify minimum entries present (",{"type":42,"tag":82,"props":633,"children":635},{"className":634},[],[636],{"type":47,"value":637},"data_stream.type",{"type":47,"value":150},{"type":42,"tag":82,"props":640,"children":642},{"className":641},[],[643],{"type":47,"value":644},"data_stream.dataset",{"type":47,"value":150},{"type":42,"tag":82,"props":647,"children":649},{"className":648},[],[650],{"type":47,"value":651},"data_stream.namespace",{"type":47,"value":150},{"type":42,"tag":82,"props":654,"children":656},{"className":655},[],[657],{"type":47,"value":658},"@timestamp",{"type":47,"value":660},"). Missing ",{"type":42,"tag":82,"props":662,"children":664},{"className":663},[],[665],{"type":47,"value":666},"event.module",{"type":47,"value":668}," or ",{"type":42,"tag":82,"props":670,"children":672},{"className":671},[],[673],{"type":47,"value":674},"event.dataset",{"type":47,"value":676},": MEDIUM.",{"type":42,"tag":269,"props":678,"children":679},{},[680,691,696],{"type":42,"tag":296,"props":681,"children":682},{},[683,689],{"type":42,"tag":82,"props":684,"children":686},{"className":685},[],[687],{"type":47,"value":688},"beats.yml",{"type":47,"value":690}," must exist",{"type":42,"tag":296,"props":692,"children":693},{},[694],{"type":47,"value":695},"HIGH if absent",{"type":42,"tag":296,"props":697,"children":698},{},[699,701,707],{"type":47,"value":700},"Not required for CEL or HTTPJSON input types (they don't emit ",{"type":42,"tag":82,"props":702,"children":704},{"className":703},[],[705],{"type":47,"value":706},"log.offset",{"type":47,"value":708},"). For file-based inputs: MEDIUM if absent.",{"type":42,"tag":269,"props":710,"children":711},{},[712,729,734],{"type":42,"tag":296,"props":713,"children":714},{},[715,721,723],{"type":42,"tag":82,"props":716,"children":718},{"className":717},[],[719],{"type":47,"value":720},"source.geo.*",{"type":47,"value":722}," in ",{"type":42,"tag":82,"props":724,"children":726},{"className":725},[],[727],{"type":47,"value":728},"dynamic_fields",{"type":42,"tag":296,"props":730,"children":731},{},[732],{"type":47,"value":733},"MEDIUM",{"type":42,"tag":296,"props":735,"children":736},{},[737,739,744,746,752,754,760,761,766],{"type":47,"value":738},"For existing integrations where updating ",{"type":42,"tag":82,"props":740,"children":742},{"className":741},[],[743],{"type":47,"value":304},{"type":47,"value":745},"\u002F",{"type":42,"tag":82,"props":747,"children":749},{"className":748},[],[750],{"type":47,"value":751},"conditions",{"type":47,"value":753}," is not in scope, ",{"type":42,"tag":82,"props":755,"children":757},{"className":756},[],[758],{"type":47,"value":759},"source.geo",{"type":47,"value":722},{"type":42,"tag":82,"props":762,"children":764},{"className":763},[],[765],{"type":47,"value":728},{"type":47,"value":767}," may be an acceptable workaround. Note as technical debt.",{"type":42,"tag":254,"props":769,"children":771},{"id":770},"how-to-determine-new-vs-existing",[772],{"type":47,"value":773},"How to determine new vs existing",{"type":42,"tag":49,"props":775,"children":776},{},[777,779,785],{"type":47,"value":778},"Read the package's ",{"type":42,"tag":82,"props":780,"children":782},{"className":781},[],[783],{"type":47,"value":784},"changelog.yml",{"type":47,"value":786},":",{"type":42,"tag":102,"props":788,"children":789},{},[790,815],{"type":42,"tag":106,"props":791,"children":792},{},[793,798,800,806,807,813],{"type":42,"tag":55,"props":794,"children":795},{},[796],{"type":47,"value":797},"One entry",{"type":47,"value":799}," (version ",{"type":42,"tag":82,"props":801,"children":803},{"className":802},[],[804],{"type":47,"value":805},"0.0.1",{"type":47,"value":668},{"type":42,"tag":82,"props":808,"children":810},{"className":809},[],[811],{"type":47,"value":812},"1.0.0",{"type":47,"value":814},"): this is a new package. Apply new-package standards.",{"type":42,"tag":106,"props":816,"children":817},{},[818,823],{"type":42,"tag":55,"props":819,"children":820},{},[821],{"type":47,"value":822},"Multiple entries",{"type":47,"value":824},": this is an existing package. Apply existing-package adjustments above.",{"type":42,"tag":49,"props":826,"children":827},{},[828,830,835],{"type":47,"value":829},"If reviewing a PR that adds a ",{"type":42,"tag":55,"props":831,"children":832},{},[833],{"type":47,"value":834},"new data stream",{"type":47,"value":836}," to an existing package, apply new-package standards to the new data stream's files but existing-package standards to unchanged files.",{"type":42,"tag":203,"props":838,"children":839},{},[],{"type":42,"tag":63,"props":841,"children":843},{"id":842},"step-1-determine-scope",[844],{"type":47,"value":845},"Step 1: Determine scope",{"type":42,"tag":49,"props":847,"children":848},{},[849],{"type":47,"value":850},"Identify what is being reviewed:",{"type":42,"tag":102,"props":852,"children":853},{},[854,872,882],{"type":42,"tag":106,"props":855,"children":856},{},[857,862,864,870],{"type":42,"tag":55,"props":858,"children":859},{},[860],{"type":47,"value":861},"Local package",{"type":47,"value":863},": user provides a package directory path. Read the root ",{"type":42,"tag":82,"props":865,"children":867},{"className":866},[],[868],{"type":47,"value":869},"manifest.yml",{"type":47,"value":871},", list all data streams and input types.",{"type":42,"tag":106,"props":873,"children":874},{},[875,880],{"type":42,"tag":55,"props":876,"children":877},{},[878],{"type":47,"value":879},"Changed files",{"type":47,"value":881},": user provides a list of changed files (e.g., from a PR or branch comparison). Classify each file by domain.",{"type":42,"tag":106,"props":883,"children":884},{},[885,890],{"type":42,"tag":55,"props":886,"children":887},{},[888],{"type":47,"value":889},"User description",{"type":47,"value":891},": user describes what to review. Identify the relevant package and files.",{"type":42,"tag":49,"props":893,"children":894},{},[895],{"type":47,"value":896},"If the user provides initial requirements, a research brief, or a task description, note what was requested for the \"Requirements match\" check.",{"type":42,"tag":49,"props":898,"children":899},{},[900,902,907,909,914],{"type":47,"value":901},"Determine whether this is a ",{"type":42,"tag":55,"props":903,"children":904},{},[905],{"type":47,"value":906},"new package",{"type":47,"value":908}," or an ",{"type":42,"tag":55,"props":910,"children":911},{},[912],{"type":47,"value":913},"existing package",{"type":47,"value":915}," (see \"Reviewing new vs existing integrations\" above) to calibrate severity correctly.",{"type":42,"tag":63,"props":917,"children":919},{"id":918},"step-2-classify-files-by-domain",[920],{"type":47,"value":921},"Step 2: Classify files by domain",{"type":42,"tag":49,"props":923,"children":924},{},[925],{"type":47,"value":926},"For every file in scope, classify into a domain:",{"type":42,"tag":261,"props":928,"children":929},{},[930,946],{"type":42,"tag":265,"props":931,"children":932},{},[933],{"type":42,"tag":269,"props":934,"children":935},{},[936,941],{"type":42,"tag":273,"props":937,"children":938},{},[939],{"type":47,"value":940},"File pattern",{"type":42,"tag":273,"props":942,"children":943},{},[944],{"type":47,"value":945},"Domain",{"type":42,"tag":289,"props":947,"children":948},{},[949,966,983,1000,1018,1035,1051,1068,1084,1101,1118,1135],{"type":42,"tag":269,"props":950,"children":951},{},[952,961],{"type":42,"tag":296,"props":953,"children":954},{},[955],{"type":42,"tag":82,"props":956,"children":958},{"className":957},[],[959],{"type":47,"value":960},"elasticsearch\u002Fingest_pipeline\u002F*.yml",{"type":42,"tag":296,"props":962,"children":963},{},[964],{"type":47,"value":965},"pipeline",{"type":42,"tag":269,"props":967,"children":968},{},[969,978],{"type":42,"tag":296,"props":970,"children":971},{},[972],{"type":42,"tag":82,"props":973,"children":975},{"className":974},[],[976],{"type":47,"value":977},"fields\u002F*.yml",{"type":42,"tag":296,"props":979,"children":980},{},[981],{"type":47,"value":982},"fields",{"type":42,"tag":269,"props":984,"children":985},{},[986,995],{"type":42,"tag":296,"props":987,"children":988},{},[989],{"type":42,"tag":82,"props":990,"children":992},{"className":991},[],[993],{"type":47,"value":994},"agent\u002Fstream\u002F*.yml.hbs",{"type":42,"tag":296,"props":996,"children":997},{},[998],{"type":47,"value":999},"input",{"type":42,"tag":269,"props":1001,"children":1002},{},[1003,1013],{"type":42,"tag":296,"props":1004,"children":1005},{},[1006,1011],{"type":42,"tag":82,"props":1007,"children":1009},{"className":1008},[],[1010],{"type":47,"value":869},{"type":47,"value":1012}," (root or data stream)",{"type":42,"tag":296,"props":1014,"children":1015},{},[1016],{"type":47,"value":1017},"manifest",{"type":42,"tag":269,"props":1019,"children":1020},{},[1021,1030],{"type":42,"tag":296,"props":1022,"children":1023},{},[1024],{"type":42,"tag":82,"props":1025,"children":1027},{"className":1026},[],[1028],{"type":47,"value":1029},"_dev\u002Fbuild\u002Fbuild.yml",{"type":42,"tag":296,"props":1031,"children":1032},{},[1033],{"type":47,"value":1034},"build",{"type":42,"tag":269,"props":1036,"children":1037},{},[1038,1046],{"type":42,"tag":296,"props":1039,"children":1040},{},[1041],{"type":42,"tag":82,"props":1042,"children":1044},{"className":1043},[],[1045],{"type":47,"value":784},{"type":42,"tag":296,"props":1047,"children":1048},{},[1049],{"type":47,"value":1050},"changelog",{"type":42,"tag":269,"props":1052,"children":1053},{},[1054,1063],{"type":42,"tag":296,"props":1055,"children":1056},{},[1057],{"type":42,"tag":82,"props":1058,"children":1060},{"className":1059},[],[1061],{"type":47,"value":1062},"_dev\u002Ftest\u002Fpipeline\u002F*",{"type":42,"tag":296,"props":1064,"children":1065},{},[1066],{"type":47,"value":1067},"tests",{"type":42,"tag":269,"props":1069,"children":1070},{},[1071,1080],{"type":42,"tag":296,"props":1072,"children":1073},{},[1074],{"type":42,"tag":82,"props":1075,"children":1077},{"className":1076},[],[1078],{"type":47,"value":1079},"_dev\u002Ftest\u002Fsystem\u002F*",{"type":42,"tag":296,"props":1081,"children":1082},{},[1083],{"type":47,"value":1067},{"type":42,"tag":269,"props":1085,"children":1086},{},[1087,1096],{"type":42,"tag":296,"props":1088,"children":1089},{},[1090],{"type":42,"tag":82,"props":1091,"children":1093},{"className":1092},[],[1094],{"type":47,"value":1095},"kibana\u002F**\u002F*.json",{"type":42,"tag":296,"props":1097,"children":1098},{},[1099],{"type":47,"value":1100},"dashboard",{"type":42,"tag":269,"props":1102,"children":1103},{},[1104,1113],{"type":42,"tag":296,"props":1105,"children":1106},{},[1107],{"type":42,"tag":82,"props":1108,"children":1110},{"className":1109},[],[1111],{"type":47,"value":1112},"_dev\u002Fbuild\u002Fdocs\u002FREADME.md",{"type":42,"tag":296,"props":1114,"children":1115},{},[1116],{"type":47,"value":1117},"docs",{"type":42,"tag":269,"props":1119,"children":1120},{},[1121,1130],{"type":42,"tag":296,"props":1122,"children":1123},{},[1124],{"type":42,"tag":82,"props":1125,"children":1127},{"className":1126},[],[1128],{"type":47,"value":1129},"elasticsearch\u002Ftransform\u002F**",{"type":42,"tag":296,"props":1131,"children":1132},{},[1133],{"type":47,"value":1134},"transform",{"type":42,"tag":269,"props":1136,"children":1137},{},[1138,1154],{"type":42,"tag":296,"props":1139,"children":1140},{},[1141,1147,1148],{"type":42,"tag":82,"props":1142,"children":1144},{"className":1143},[],[1145],{"type":47,"value":1146},"*-expected.json",{"type":47,"value":150},{"type":42,"tag":82,"props":1149,"children":1151},{"className":1150},[],[1152],{"type":47,"value":1153},"sample_event.json",{"type":42,"tag":296,"props":1155,"children":1156},{},[1157],{"type":47,"value":1158},"generated (skip review)",{"type":42,"tag":49,"props":1160,"children":1161},{},[1162],{"type":47,"value":1163},"Print which domains are present and how many files each has.",{"type":42,"tag":63,"props":1165,"children":1167},{"id":1166},"step-3-load-domain-skills-and-review-checklists",[1168],{"type":47,"value":1169},"Step 3: Load domain skills and review checklists",{"type":42,"tag":49,"props":1171,"children":1172},{},[1173],{"type":47,"value":1174},"Only load what the detected domains require. Do not load all skills for every review.",{"type":42,"tag":261,"props":1176,"children":1177},{},[1178,1198],{"type":42,"tag":265,"props":1179,"children":1180},{},[1181],{"type":42,"tag":269,"props":1182,"children":1183},{},[1184,1188,1193],{"type":42,"tag":273,"props":1185,"children":1186},{},[1187],{"type":47,"value":945},{"type":42,"tag":273,"props":1189,"children":1190},{},[1191],{"type":47,"value":1192},"Skill to load",{"type":42,"tag":273,"props":1194,"children":1195},{},[1196],{"type":47,"value":1197},"Review checklist to load",{"type":42,"tag":289,"props":1199,"children":1200},{},[1201,1227,1253,1279,1313,1340,1367,1390,1424,1445,1468],{"type":42,"tag":269,"props":1202,"children":1203},{},[1204,1208,1218],{"type":42,"tag":296,"props":1205,"children":1206},{},[1207],{"type":47,"value":965},{"type":42,"tag":296,"props":1209,"children":1210},{},[1211,1216],{"type":42,"tag":82,"props":1212,"children":1214},{"className":1213},[],[1215],{"type":47,"value":163},{"type":47,"value":1217}," SKILL.md",{"type":42,"tag":296,"props":1219,"children":1220},{},[1221],{"type":42,"tag":82,"props":1222,"children":1224},{"className":1223},[],[1225],{"type":47,"value":1226},"checklists\u002Fpipeline-review-checklist.md",{"type":42,"tag":269,"props":1228,"children":1229},{},[1230,1234,1244],{"type":42,"tag":296,"props":1231,"children":1232},{},[1233],{"type":47,"value":982},{"type":42,"tag":296,"props":1235,"children":1236},{},[1237,1243],{"type":42,"tag":82,"props":1238,"children":1240},{"className":1239},[],[1241],{"type":47,"value":1242},"ecs-field-mappings",{"type":47,"value":1217},{"type":42,"tag":296,"props":1245,"children":1246},{},[1247],{"type":42,"tag":82,"props":1248,"children":1250},{"className":1249},[],[1251],{"type":47,"value":1252},"checklists\u002Ffield-review-checklist.md",{"type":42,"tag":269,"props":1254,"children":1255},{},[1256,1261,1270],{"type":42,"tag":296,"props":1257,"children":1258},{},[1259],{"type":47,"value":1260},"input (CEL)",{"type":42,"tag":296,"props":1262,"children":1263},{},[1264,1269],{"type":42,"tag":82,"props":1265,"children":1267},{"className":1266},[],[1268],{"type":47,"value":156},{"type":47,"value":1217},{"type":42,"tag":296,"props":1271,"children":1272},{},[1273],{"type":42,"tag":82,"props":1274,"children":1276},{"className":1275},[],[1277],{"type":47,"value":1278},"checklists\u002Fcel-review-checklist.md",{"type":42,"tag":269,"props":1280,"children":1281},{},[1282,1287,1304],{"type":42,"tag":296,"props":1283,"children":1284},{},[1285],{"type":47,"value":1286},"input (HTTPJSON)",{"type":42,"tag":296,"props":1288,"children":1289},{},[1290,1296,1298],{"type":42,"tag":82,"props":1291,"children":1293},{"className":1292},[],[1294],{"type":47,"value":1295},"input-configurations",{"type":47,"value":1297}," SKILL.md -> ",{"type":42,"tag":82,"props":1299,"children":1301},{"className":1300},[],[1302],{"type":47,"value":1303},"references\u002Fhttpjson-guide.md",{"type":42,"tag":296,"props":1305,"children":1306},{},[1307],{"type":42,"tag":82,"props":1308,"children":1310},{"className":1309},[],[1311],{"type":47,"value":1312},"checklists\u002Fhttpjson-review-checklist.md",{"type":42,"tag":269,"props":1314,"children":1315},{},[1316,1321,1331],{"type":42,"tag":296,"props":1317,"children":1318},{},[1319],{"type":47,"value":1320},"input (other types)",{"type":42,"tag":296,"props":1322,"children":1323},{},[1324,1329],{"type":42,"tag":82,"props":1325,"children":1327},{"className":1326},[],[1328],{"type":47,"value":1295},{"type":47,"value":1330}," SKILL.md -> matching type guide",{"type":42,"tag":296,"props":1332,"children":1333},{},[1334],{"type":42,"tag":82,"props":1335,"children":1337},{"className":1336},[],[1338],{"type":47,"value":1339},"input-configurations\u002Freferences\u002Fcommon-input-patterns.md",{"type":42,"tag":269,"props":1341,"children":1342},{},[1343,1348,1358],{"type":42,"tag":296,"props":1344,"children":1345},{},[1346],{"type":47,"value":1347},"manifest + changelog",{"type":42,"tag":296,"props":1349,"children":1350},{},[1351,1357],{"type":42,"tag":82,"props":1352,"children":1354},{"className":1353},[],[1355],{"type":47,"value":1356},"package-spec",{"type":47,"value":1217},{"type":42,"tag":296,"props":1359,"children":1360},{},[1361],{"type":42,"tag":82,"props":1362,"children":1364},{"className":1363},[],[1365],{"type":47,"value":1366},"package-spec\u002Freferences\u002Fmanifest-rules.md",{"type":42,"tag":269,"props":1368,"children":1369},{},[1370,1374,1385],{"type":42,"tag":296,"props":1371,"children":1372},{},[1373],{"type":47,"value":1067},{"type":42,"tag":296,"props":1375,"children":1376},{},[1377,1383],{"type":42,"tag":82,"props":1378,"children":1380},{"className":1379},[],[1381],{"type":47,"value":1382},"integration-testing",{"type":47,"value":1384}," SKILL.md -> relevant testing reference",{"type":42,"tag":296,"props":1386,"children":1387},{},[1388],{"type":47,"value":1389},"--",{"type":42,"tag":269,"props":1391,"children":1392},{},[1393,1397,1415],{"type":42,"tag":296,"props":1394,"children":1395},{},[1396],{"type":47,"value":1100},{"type":42,"tag":296,"props":1398,"children":1399},{},[1400,1406,1408,1414],{"type":42,"tag":82,"props":1401,"children":1403},{"className":1402},[],[1404],{"type":47,"value":1405},"dashboard-review",{"type":47,"value":1407}," SKILL.md + ",{"type":42,"tag":82,"props":1409,"children":1411},{"className":1410},[],[1412],{"type":47,"value":1413},"dashboard-guidelines",{"type":47,"value":1217},{"type":42,"tag":296,"props":1416,"children":1417},{},[1418],{"type":42,"tag":82,"props":1419,"children":1421},{"className":1420},[],[1422],{"type":47,"value":1423},"dashboard-review\u002Freferences\u002Freview-procedure.md",{"type":42,"tag":269,"props":1425,"children":1426},{},[1427,1431,1440],{"type":42,"tag":296,"props":1428,"children":1429},{},[1430],{"type":47,"value":1034},{"type":42,"tag":296,"props":1432,"children":1433},{},[1434,1439],{"type":42,"tag":82,"props":1435,"children":1437},{"className":1436},[],[1438],{"type":47,"value":1242},{"type":47,"value":1217},{"type":42,"tag":296,"props":1441,"children":1442},{},[1443],{"type":47,"value":1444},"(ECS version pinning rules)",{"type":42,"tag":269,"props":1446,"children":1447},{},[1448,1452,1463],{"type":42,"tag":296,"props":1449,"children":1450},{},[1451],{"type":47,"value":1134},{"type":42,"tag":296,"props":1453,"children":1454},{},[1455,1457],{"type":47,"value":1456},"this skill's ",{"type":42,"tag":82,"props":1458,"children":1460},{"className":1459},[],[1461],{"type":47,"value":1462},"references\u002Ftransform-guide.md",{"type":42,"tag":296,"props":1464,"children":1465},{},[1466],{"type":47,"value":1467},"(includes review checklist)",{"type":42,"tag":269,"props":1469,"children":1470},{},[1471,1475,1480],{"type":42,"tag":296,"props":1472,"children":1473},{},[1474],{"type":47,"value":1117},{"type":42,"tag":296,"props":1476,"children":1477},{},[1478],{"type":47,"value":1479},"(inline checklist below)",{"type":42,"tag":296,"props":1481,"children":1482},{},[1483],{"type":47,"value":1389},{"type":42,"tag":63,"props":1485,"children":1487},{"id":1486},"step-3b-always-load-skills",[1488],{"type":47,"value":1489},"Step 3b: Always-load skills",{"type":42,"tag":49,"props":1491,"children":1492},{},[1493],{"type":47,"value":1494},"Load these for every review regardless of which domains are present:",{"type":42,"tag":261,"props":1496,"children":1497},{},[1498,1514],{"type":42,"tag":265,"props":1499,"children":1500},{},[1501],{"type":42,"tag":269,"props":1502,"children":1503},{},[1504,1509],{"type":42,"tag":273,"props":1505,"children":1506},{},[1507],{"type":47,"value":1508},"Skill",{"type":42,"tag":273,"props":1510,"children":1511},{},[1512],{"type":47,"value":1513},"Why",{"type":42,"tag":289,"props":1515,"children":1516},{},[1517,1564,1588],{"type":42,"tag":269,"props":1518,"children":1519},{},[1520,1530],{"type":42,"tag":296,"props":1521,"children":1522},{},[1523,1529],{"type":42,"tag":82,"props":1524,"children":1526},{"className":1525},[],[1527],{"type":47,"value":1528},"elastic-package-cli",{"type":47,"value":1217},{"type":42,"tag":296,"props":1531,"children":1532},{},[1533,1535,1541,1542,1548,1549,1555,1556,1562],{"type":47,"value":1534},"Validation commands (",{"type":42,"tag":82,"props":1536,"children":1538},{"className":1537},[],[1539],{"type":47,"value":1540},"format",{"type":47,"value":150},{"type":42,"tag":82,"props":1543,"children":1545},{"className":1544},[],[1546],{"type":47,"value":1547},"lint",{"type":47,"value":150},{"type":42,"tag":82,"props":1550,"children":1552},{"className":1551},[],[1553],{"type":47,"value":1554},"check",{"type":47,"value":150},{"type":42,"tag":82,"props":1557,"children":1559},{"className":1558},[],[1560],{"type":47,"value":1561},"test",{"type":47,"value":1563},") and troubleshooting",{"type":42,"tag":269,"props":1565,"children":1566},{},[1567,1583],{"type":42,"tag":296,"props":1568,"children":1569},{},[1570,1575,1577],{"type":42,"tag":82,"props":1571,"children":1573},{"className":1572},[],[1574],{"type":47,"value":148},{"type":47,"value":1576}," -> ",{"type":42,"tag":82,"props":1578,"children":1580},{"className":1579},[],[1581],{"type":47,"value":1582},"references\u002Fpackage-layout.md",{"type":42,"tag":296,"props":1584,"children":1585},{},[1586],{"type":47,"value":1587},"Package topology, required files, directory structure, naming constraints",{"type":42,"tag":269,"props":1589,"children":1590},{},[1591,1601],{"type":42,"tag":296,"props":1592,"children":1593},{},[1594,1600],{"type":42,"tag":82,"props":1595,"children":1597},{"className":1596},[],[1598],{"type":47,"value":1599},"anonymize-logs",{"type":47,"value":1217},{"type":42,"tag":296,"props":1602,"children":1603},{},[1604],{"type":47,"value":1605},"Placeholder conventions (RFC 5737 IPs, example.com domains, synthetic UUIDs) for data anonymization checks",{"type":42,"tag":63,"props":1607,"children":1609},{"id":1608},"step-4-load-review-specific-references",[1610],{"type":47,"value":1611},"Step 4: Load review-specific references",{"type":42,"tag":49,"props":1613,"children":1614},{},[1615,1617,1623],{"type":47,"value":1616},"These references live in this skill's ",{"type":42,"tag":82,"props":1618,"children":1620},{"className":1619},[],[1621],{"type":47,"value":1622},"references\u002F",{"type":47,"value":1624}," directory and provide review-only procedures.",{"type":42,"tag":261,"props":1626,"children":1627},{},[1628,1644],{"type":42,"tag":265,"props":1629,"children":1630},{},[1631],{"type":42,"tag":269,"props":1632,"children":1633},{},[1634,1639],{"type":42,"tag":273,"props":1635,"children":1636},{},[1637],{"type":47,"value":1638},"Condition",{"type":42,"tag":273,"props":1640,"children":1641},{},[1642],{"type":47,"value":1643},"Reference to load",{"type":42,"tag":289,"props":1645,"children":1646},{},[1647,1666,1684,1703,1742,1760,1779,1798],{"type":42,"tag":269,"props":1648,"children":1649},{},[1650,1655],{"type":42,"tag":296,"props":1651,"children":1652},{},[1653],{"type":47,"value":1654},"Always",{"type":42,"tag":296,"props":1656,"children":1657},{},[1658,1664],{"type":42,"tag":82,"props":1659,"children":1661},{"className":1660},[],[1662],{"type":47,"value":1663},"references\u002Fseverity-rubric.md",{"type":47,"value":1665}," -- severity calibration across all domains",{"type":42,"tag":269,"props":1667,"children":1668},{},[1669,1673],{"type":42,"tag":296,"props":1670,"children":1671},{},[1672],{"type":47,"value":1654},{"type":42,"tag":296,"props":1674,"children":1675},{},[1676,1682],{"type":42,"tag":82,"props":1677,"children":1679},{"className":1678},[],[1680],{"type":47,"value":1681},"references\u002Fconflict-resolutions.md",{"type":47,"value":1683}," -- known rule conflicts and resolution decisions",{"type":42,"tag":269,"props":1685,"children":1686},{},[1687,1692],{"type":42,"tag":296,"props":1688,"children":1689},{},[1690],{"type":47,"value":1691},"2+ domains touched",{"type":42,"tag":296,"props":1693,"children":1694},{},[1695,1701],{"type":42,"tag":82,"props":1696,"children":1698},{"className":1697},[],[1699],{"type":47,"value":1700},"references\u002Fconsistency-rules.md",{"type":47,"value":1702}," -- cross-domain consistency (pipeline-fields-manifest-tests alignment)",{"type":42,"tag":269,"props":1704,"children":1705},{},[1706,1711],{"type":42,"tag":296,"props":1707,"children":1708},{},[1709],{"type":47,"value":1710},"CEL input files in scope",{"type":42,"tag":296,"props":1712,"children":1713},{},[1714,1720,1722,1728,1729,1735,1736],{"type":42,"tag":82,"props":1715,"children":1717},{"className":1716},[],[1718],{"type":47,"value":1719},"references\u002Fversion-check-procedure.md",{"type":47,"value":1721}," + ",{"type":42,"tag":82,"props":1723,"children":1725},{"className":1724},[],[1726],{"type":47,"value":1727},"references\u002Fbeats-mito-version-matrix.md",{"type":47,"value":1721},{"type":42,"tag":82,"props":1730,"children":1732},{"className":1731},[],[1733],{"type":47,"value":1734},"references\u002Fconfig-options-by-version.md",{"type":47,"value":1721},{"type":42,"tag":82,"props":1737,"children":1739},{"className":1738},[],[1740],{"type":47,"value":1741},"references\u002Fextensions-per-version.md",{"type":42,"tag":269,"props":1743,"children":1744},{},[1745,1749],{"type":42,"tag":296,"props":1746,"children":1747},{},[1748],{"type":47,"value":1710},{"type":42,"tag":296,"props":1750,"children":1751},{},[1752,1758],{"type":42,"tag":82,"props":1753,"children":1755},{"className":1754},[],[1756],{"type":47,"value":1757},"references\u002Fcel-validator-procedure.md",{"type":47,"value":1759}," -- celfmt authority, type conversion audit, error shape validation",{"type":42,"tag":269,"props":1761,"children":1762},{},[1763,1768],{"type":42,"tag":296,"props":1764,"children":1765},{},[1766],{"type":47,"value":1767},"CEL or HTTPJSON with API docs available",{"type":42,"tag":296,"props":1769,"children":1770},{},[1771,1777],{"type":42,"tag":82,"props":1772,"children":1774},{"className":1773},[],[1775],{"type":47,"value":1776},"references\u002Fapi-conformance-methodology.md",{"type":47,"value":1778}," -- cross-reference implementation vs vendor docs",{"type":42,"tag":269,"props":1780,"children":1781},{},[1782,1787],{"type":42,"tag":296,"props":1783,"children":1784},{},[1785],{"type":47,"value":1786},"Any input templates in scope",{"type":42,"tag":296,"props":1788,"children":1789},{},[1790,1796],{"type":42,"tag":82,"props":1791,"children":1793},{"className":1792},[],[1794],{"type":47,"value":1795},"references\u002Finput-review-orchestration.md",{"type":47,"value":1797}," -- review depth routing by input type",{"type":42,"tag":269,"props":1799,"children":1800},{},[1801,1806],{"type":42,"tag":296,"props":1802,"children":1803},{},[1804],{"type":47,"value":1805},"Cloud security \u002F CDR integration",{"type":42,"tag":296,"props":1807,"children":1808},{},[1809,1815,1816,1822,1823],{"type":42,"tag":82,"props":1810,"children":1812},{"className":1811},[],[1813],{"type":47,"value":1814},"ecs-field-mappings\u002Freferences\u002Fcdr-field-requirements.md",{"type":47,"value":1721},{"type":42,"tag":82,"props":1817,"children":1819},{"className":1818},[],[1820],{"type":47,"value":1821},"ingest-pipelines\u002Freferences\u002Fcdr-pipeline-requirements.md",{"type":47,"value":1721},{"type":42,"tag":82,"props":1824,"children":1826},{"className":1825},[],[1827],{"type":47,"value":1828},"references\u002Fcdr-transform-requirements.md",{"type":42,"tag":49,"props":1830,"children":1831},{},[1832,1837,1839,1844,1846,1852,1854,1859],{"type":42,"tag":55,"props":1833,"children":1834},{},[1835],{"type":47,"value":1836},"CDR detection:",{"type":47,"value":1838}," Check the root ",{"type":42,"tag":82,"props":1840,"children":1842},{"className":1841},[],[1843],{"type":47,"value":869},{"type":47,"value":1845}," categories. If ",{"type":42,"tag":82,"props":1847,"children":1849},{"className":1848},[],[1850],{"type":47,"value":1851},"cloudsecurity_cdr",{"type":47,"value":1853}," is listed, the integration is CDR and all three CDR references must be loaded. Do NOT apply CDR rules to EDR\u002FXDR integrations (crowdstrike, sentinel_one, trend_micro) unless they explicitly have ",{"type":42,"tag":82,"props":1855,"children":1857},{"className":1856},[],[1858],{"type":47,"value":1851},{"type":47,"value":1860}," in their categories.",{"type":42,"tag":203,"props":1862,"children":1863},{},[],{"type":42,"tag":63,"props":1865,"children":1867},{"id":1866},"step-5-run-automated-validation",[1868],{"type":47,"value":1869},"Step 5: Run automated validation",{"type":42,"tag":49,"props":1871,"children":1872},{},[1873],{"type":47,"value":1874},"If you have access to the package on disk, run:",{"type":42,"tag":1876,"props":1877,"children":1882},"pre",{"className":1878,"code":1879,"language":1880,"meta":1881,"style":1881},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","cd packages\u002F\u003Cpackage_name>\n\nelastic-package format --fail-fast\nelastic-package lint\nelastic-package check\n","bash","",[1883],{"type":42,"tag":82,"props":1884,"children":1885},{"__ignoreMap":1881},[1886,1926,1935,1955,1968],{"type":42,"tag":1887,"props":1888,"children":1891},"span",{"class":1889,"line":1890},"line",1,[1892,1898,1904,1910,1915,1921],{"type":42,"tag":1887,"props":1893,"children":1895},{"style":1894},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[1896],{"type":47,"value":1897},"cd",{"type":42,"tag":1887,"props":1899,"children":1901},{"style":1900},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[1902],{"type":47,"value":1903}," packages\u002F",{"type":42,"tag":1887,"props":1905,"children":1907},{"style":1906},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[1908],{"type":47,"value":1909},"\u003C",{"type":42,"tag":1887,"props":1911,"children":1912},{"style":1900},[1913],{"type":47,"value":1914},"package_nam",{"type":42,"tag":1887,"props":1916,"children":1918},{"style":1917},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1919],{"type":47,"value":1920},"e",{"type":42,"tag":1887,"props":1922,"children":1923},{"style":1906},[1924],{"type":47,"value":1925},">\n",{"type":42,"tag":1887,"props":1927,"children":1928},{"class":1889,"line":27},[1929],{"type":42,"tag":1887,"props":1930,"children":1932},{"emptyLinePlaceholder":1931},true,[1933],{"type":47,"value":1934},"\n",{"type":42,"tag":1887,"props":1936,"children":1938},{"class":1889,"line":1937},3,[1939,1945,1950],{"type":42,"tag":1887,"props":1940,"children":1942},{"style":1941},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[1943],{"type":47,"value":1944},"elastic-package",{"type":42,"tag":1887,"props":1946,"children":1947},{"style":1900},[1948],{"type":47,"value":1949}," format",{"type":42,"tag":1887,"props":1951,"children":1952},{"style":1900},[1953],{"type":47,"value":1954}," --fail-fast\n",{"type":42,"tag":1887,"props":1956,"children":1958},{"class":1889,"line":1957},4,[1959,1963],{"type":42,"tag":1887,"props":1960,"children":1961},{"style":1941},[1962],{"type":47,"value":1944},{"type":42,"tag":1887,"props":1964,"children":1965},{"style":1900},[1966],{"type":47,"value":1967}," lint\n",{"type":42,"tag":1887,"props":1969,"children":1971},{"class":1889,"line":1970},5,[1972,1976],{"type":42,"tag":1887,"props":1973,"children":1974},{"style":1941},[1975],{"type":47,"value":1944},{"type":42,"tag":1887,"props":1977,"children":1978},{"style":1900},[1979],{"type":47,"value":1980}," check\n",{"type":42,"tag":49,"props":1982,"children":1983},{},[1984],{"type":47,"value":1985},"If pipeline or system tests are appropriate and a stack is available:",{"type":42,"tag":1876,"props":1987,"children":1989},{"className":1878,"code":1988,"language":1880,"meta":1881,"style":1881},"elastic-package test pipeline\nelastic-package test system\n",[1990],{"type":42,"tag":82,"props":1991,"children":1992},{"__ignoreMap":1881},[1993,2010],{"type":42,"tag":1887,"props":1994,"children":1995},{"class":1889,"line":1890},[1996,2000,2005],{"type":42,"tag":1887,"props":1997,"children":1998},{"style":1941},[1999],{"type":47,"value":1944},{"type":42,"tag":1887,"props":2001,"children":2002},{"style":1900},[2003],{"type":47,"value":2004}," test",{"type":42,"tag":1887,"props":2006,"children":2007},{"style":1900},[2008],{"type":47,"value":2009}," pipeline\n",{"type":42,"tag":1887,"props":2011,"children":2012},{"class":1889,"line":27},[2013,2017,2021],{"type":42,"tag":1887,"props":2014,"children":2015},{"style":1941},[2016],{"type":47,"value":1944},{"type":42,"tag":1887,"props":2018,"children":2019},{"style":1900},[2020],{"type":47,"value":2004},{"type":42,"tag":1887,"props":2022,"children":2023},{"style":1900},[2024],{"type":47,"value":2025}," system\n",{"type":42,"tag":49,"props":2027,"children":2028},{},[2029],{"type":47,"value":2030},"Record every failure with its full error message.",{"type":42,"tag":63,"props":2032,"children":2034},{"id":2033},"step-6-inspect-and-produce-findings",[2035],{"type":47,"value":2036},"Step 6: Inspect and produce findings",{"type":42,"tag":49,"props":2038,"children":2039},{},[2040],{"type":47,"value":2041},"For each file in scope (excluding generated files):",{"type":42,"tag":2043,"props":2044,"children":2045},"ol",{},[2046,2058,2070,2075],{"type":42,"tag":106,"props":2047,"children":2048},{},[2049,2051,2056],{"type":47,"value":2050},"Read the ",{"type":42,"tag":55,"props":2052,"children":2053},{},[2054],{"type":47,"value":2055},"full file",{"type":47,"value":2057}," for complete context",{"type":42,"tag":106,"props":2059,"children":2060},{},[2061,2063,2068],{"type":47,"value":2062},"If reviewing a diff, read the ",{"type":42,"tag":55,"props":2064,"children":2065},{},[2066],{"type":47,"value":2067},"diff hunks",{"type":47,"value":2069}," to understand what changed",{"type":42,"tag":106,"props":2071,"children":2072},{},[2073],{"type":47,"value":2074},"Apply the relevant checklist items from the domain skills and review checklists",{"type":42,"tag":106,"props":2076,"children":2077},{},[2078,2080],{"type":47,"value":2079},"For every issue found, record:\n",{"type":42,"tag":102,"props":2081,"children":2082},{},[2083,2093,2103,2113,2123,2132,2142],{"type":42,"tag":106,"props":2084,"children":2085},{},[2086,2091],{"type":42,"tag":55,"props":2087,"children":2088},{},[2089],{"type":47,"value":2090},"severity",{"type":47,"value":2092},": critical, high, medium, or low",{"type":42,"tag":106,"props":2094,"children":2095},{},[2096,2101],{"type":42,"tag":55,"props":2097,"children":2098},{},[2099],{"type":47,"value":2100},"domain",{"type":47,"value":2102},": one of the domain tags below",{"type":42,"tag":106,"props":2104,"children":2105},{},[2106,2111],{"type":42,"tag":55,"props":2107,"children":2108},{},[2109],{"type":47,"value":2110},"title",{"type":47,"value":2112},": short description (10 words or fewer)",{"type":42,"tag":106,"props":2114,"children":2115},{},[2116,2121],{"type":42,"tag":55,"props":2117,"children":2118},{},[2119],{"type":47,"value":2120},"path",{"type":47,"value":2122},": file path relative to repo root",{"type":42,"tag":106,"props":2124,"children":2125},{},[2126,2130],{"type":42,"tag":55,"props":2127,"children":2128},{},[2129],{"type":47,"value":1889},{"type":47,"value":2131},": line number in the file (use line 1 if unknown)",{"type":42,"tag":106,"props":2133,"children":2134},{},[2135,2140],{"type":42,"tag":55,"props":2136,"children":2137},{},[2138],{"type":47,"value":2139},"description",{"type":47,"value":2141},": what is wrong and why it matters",{"type":42,"tag":106,"props":2143,"children":2144},{},[2145,2150],{"type":42,"tag":55,"props":2146,"children":2147},{},[2148],{"type":47,"value":2149},"recommendation",{"type":47,"value":2151},": how to fix -- include a code block showing the corrected YAML\u002FCEL\u002FJSON",{"type":42,"tag":254,"props":2153,"children":2155},{"id":2154},"cross-file-checks",[2156],{"type":47,"value":2157},"Cross-file checks",{"type":42,"tag":49,"props":2159,"children":2160},{},[2161,2163,2168],{"type":47,"value":2162},"After individual file inspection, check cross-domain consistency (load ",{"type":42,"tag":82,"props":2164,"children":2166},{"className":2165},[],[2167],{"type":47,"value":1700},{"type":47,"value":2169}," if not already loaded):",{"type":42,"tag":102,"props":2171,"children":2172},{},[2173,2186,2203,2208,2225,2230],{"type":42,"tag":106,"props":2174,"children":2175},{},[2176,2178,2184],{"type":47,"value":2177},"Fields set in pipeline processors must be declared in ",{"type":42,"tag":82,"props":2179,"children":2181},{"className":2180},[],[2182],{"type":47,"value":2183},"fields\u002Fecs.yml",{"type":47,"value":2185}," unless the field is a standard ECS keyword\u002Fdate type that works via dynamic mapping",{"type":42,"tag":106,"props":2187,"children":2188},{},[2189,2194,2196,2201],{"type":42,"tag":82,"props":2190,"children":2192},{"className":2191},[],[2193],{"type":47,"value":387},{"type":47,"value":2195}," ECS version must match ",{"type":42,"tag":82,"props":2197,"children":2199},{"className":2198},[],[2200],{"type":47,"value":362},{"type":47,"value":2202}," set in pipeline",{"type":42,"tag":106,"props":2204,"children":2205},{},[2206],{"type":47,"value":2207},"Manifest variables must be referenced in stream templates",{"type":42,"tag":106,"props":2209,"children":2210},{},[2211,2213,2218,2219,2224],{"type":47,"value":2212},"Data stream manifest must not duplicate root manifest fields (",{"type":42,"tag":82,"props":2214,"children":2216},{"className":2215},[],[2217],{"type":47,"value":304},{"type":47,"value":150},{"type":42,"tag":82,"props":2220,"children":2222},{"className":2221},[],[2223],{"type":47,"value":751},{"type":47,"value":177},{"type":42,"tag":106,"props":2226,"children":2227},{},[2228],{"type":47,"value":2229},"Pipeline test fixtures must cover every branch",{"type":42,"tag":106,"props":2231,"children":2232},{},[2233,2238,2240,2246],{"type":42,"tag":82,"props":2234,"children":2236},{"className":2235},[],[2237],{"type":47,"value":1153},{"type":47,"value":2239}," must be system-test-generated or absent with ",{"type":42,"tag":82,"props":2241,"children":2243},{"className":2242},[],[2244],{"type":47,"value":2245},"{{ event }}",{"type":47,"value":2247}," commented out",{"type":42,"tag":49,"props":2249,"children":2250},{},[2251],{"type":47,"value":2252},"Read unchanged files from the workspace if needed for cross-referencing.",{"type":42,"tag":203,"props":2254,"children":2255},{},[],{"type":42,"tag":63,"props":2257,"children":2259},{"id":2258},"output-format",[2260],{"type":47,"value":2261},"Output format",{"type":42,"tag":49,"props":2263,"children":2264},{},[2265,2267,2276,2278,2284],{"type":47,"value":2266},"Write the review to ",{"type":42,"tag":55,"props":2268,"children":2269},{},[2270],{"type":42,"tag":82,"props":2271,"children":2273},{"className":2272},[],[2274],{"type":47,"value":2275},"tmp\u002Fintegration-review.md",{"type":47,"value":2277}," in the current working directory. Create the ",{"type":42,"tag":82,"props":2279,"children":2281},{"className":2280},[],[2282],{"type":47,"value":2283},"tmp\u002F",{"type":47,"value":2285}," directory if it does not exist. Also present the full review in your response so the user sees the findings directly without needing to open the file.",{"type":42,"tag":49,"props":2287,"children":2288},{},[2289,2291,2297],{"type":47,"value":2290},"Read ",{"type":42,"tag":82,"props":2292,"children":2294},{"className":2293},[],[2295],{"type":47,"value":2296},"references\u002Freview-output-template.md",{"type":47,"value":2298}," for the exact output format and rendering rules. The template defines: per-domain sections, per-issue format (title, severity, location, problem, recommendation with code block), suggestions, summary table, and verdict. Use the same format for both the file and the response.",{"type":42,"tag":254,"props":2300,"children":2302},{"id":2301},"verdict-rules",[2303],{"type":47,"value":2304},"Verdict rules",{"type":42,"tag":102,"props":2306,"children":2307},{},[2308,2319,2330],{"type":42,"tag":106,"props":2309,"children":2310},{},[2311,2313],{"type":47,"value":2312},"Any critical or high finding -> ",{"type":42,"tag":82,"props":2314,"children":2316},{"className":2315},[],[2317],{"type":47,"value":2318},"NEEDS_CHANGES",{"type":42,"tag":106,"props":2320,"children":2321},{},[2322,2324],{"type":47,"value":2323},"Only medium\u002Flow findings -> ",{"type":42,"tag":82,"props":2325,"children":2327},{"className":2326},[],[2328],{"type":47,"value":2329},"APPROVED_WITH_SUGGESTIONS",{"type":42,"tag":106,"props":2331,"children":2332},{},[2333,2335],{"type":47,"value":2334},"No findings -> ",{"type":42,"tag":82,"props":2336,"children":2338},{"className":2337},[],[2339],{"type":47,"value":2340},"APPROVED",{"type":42,"tag":254,"props":2342,"children":2344},{"id":2343},"domain-tags",[2345],{"type":47,"value":2346},"Domain tags",{"type":42,"tag":49,"props":2348,"children":2349},{},[2350],{"type":47,"value":2351},"Every issue must include exactly one domain tag:",{"type":42,"tag":261,"props":2353,"children":2354},{},[2355,2371],{"type":42,"tag":265,"props":2356,"children":2357},{},[2358],{"type":42,"tag":269,"props":2359,"children":2360},{},[2361,2366],{"type":42,"tag":273,"props":2362,"children":2363},{},[2364],{"type":47,"value":2365},"Tag",{"type":42,"tag":273,"props":2367,"children":2368},{},[2369],{"type":47,"value":2370},"Covers",{"type":42,"tag":289,"props":2372,"children":2373},{},[2374,2391,2408,2430,2447,2464,2481,2498,2515,2532,2549,2566],{"type":42,"tag":269,"props":2375,"children":2376},{},[2377,2386],{"type":42,"tag":296,"props":2378,"children":2379},{},[2380],{"type":42,"tag":82,"props":2381,"children":2383},{"className":2382},[],[2384],{"type":47,"value":2385},"domain:manifest",{"type":42,"tag":296,"props":2387,"children":2388},{},[2389],{"type":47,"value":2390},"Root or data stream manifest fields, format_version, conditions, categories, owner, policy templates",{"type":42,"tag":269,"props":2392,"children":2393},{},[2394,2403],{"type":42,"tag":296,"props":2395,"children":2396},{},[2397],{"type":42,"tag":82,"props":2398,"children":2400},{"className":2399},[],[2401],{"type":47,"value":2402},"domain:changelog",{"type":42,"tag":296,"props":2404,"children":2405},{},[2406],{"type":47,"value":2407},"changelog.yml schema, version mismatch, missing entries, invalid links",{"type":42,"tag":269,"props":2409,"children":2410},{},[2411,2420],{"type":42,"tag":296,"props":2412,"children":2413},{},[2414],{"type":42,"tag":82,"props":2415,"children":2417},{"className":2416},[],[2418],{"type":47,"value":2419},"domain:build",{"type":42,"tag":296,"props":2421,"children":2422},{},[2423,2428],{"type":42,"tag":82,"props":2424,"children":2426},{"className":2425},[],[2427],{"type":47,"value":1029},{"type":47,"value":2429}," missing or outdated, doc template issues",{"type":42,"tag":269,"props":2431,"children":2432},{},[2433,2442],{"type":42,"tag":296,"props":2434,"children":2435},{},[2436],{"type":42,"tag":82,"props":2437,"children":2439},{"className":2438},[],[2440],{"type":47,"value":2441},"domain:pipeline",{"type":42,"tag":296,"props":2443,"children":2444},{},[2445],{"type":47,"value":2446},"Ingest pipeline correctness, JSE00001, on_failure, tags, ECS categorization in pipeline",{"type":42,"tag":269,"props":2448,"children":2449},{},[2450,2459],{"type":42,"tag":296,"props":2451,"children":2452},{},[2453],{"type":42,"tag":82,"props":2454,"children":2456},{"className":2455},[],[2457],{"type":47,"value":2458},"domain:input",{"type":42,"tag":296,"props":2460,"children":2461},{},[2462],{"type":47,"value":2463},"Agent stream template issues -- all input types including CEL, HTTPJSON, AWS S3, TCP, etc.",{"type":42,"tag":269,"props":2465,"children":2466},{},[2467,2476],{"type":42,"tag":296,"props":2468,"children":2469},{},[2470],{"type":42,"tag":82,"props":2471,"children":2473},{"className":2472},[],[2474],{"type":47,"value":2475},"domain:fields",{"type":42,"tag":296,"props":2477,"children":2478},{},[2479],{"type":47,"value":2480},"Field definitions, types, duplicates, geo nesting, ECS mapping strategy",{"type":42,"tag":269,"props":2482,"children":2483},{},[2484,2493],{"type":42,"tag":296,"props":2485,"children":2486},{},[2487],{"type":42,"tag":82,"props":2488,"children":2490},{"className":2489},[],[2491],{"type":47,"value":2492},"domain:tests",{"type":42,"tag":296,"props":2494,"children":2495},{},[2496],{"type":47,"value":2497},"Pipeline test fixtures, system test configs, test-common-config.yml, sample_event.json",{"type":42,"tag":269,"props":2499,"children":2500},{},[2501,2510],{"type":42,"tag":296,"props":2502,"children":2503},{},[2504],{"type":42,"tag":82,"props":2505,"children":2507},{"className":2506},[],[2508],{"type":47,"value":2509},"domain:dashboard",{"type":42,"tag":296,"props":2511,"children":2512},{},[2513],{"type":47,"value":2514},"Kibana dashboard JSON at package root (kibana\u002F), TSVB, dataset filters, by-reference panels",{"type":42,"tag":269,"props":2516,"children":2517},{},[2518,2527],{"type":42,"tag":296,"props":2519,"children":2520},{},[2521],{"type":42,"tag":82,"props":2522,"children":2524},{"className":2523},[],[2525],{"type":47,"value":2526},"domain:transform",{"type":42,"tag":296,"props":2528,"children":2529},{},[2530],{"type":47,"value":2531},"Transform configuration at package root (elasticsearch\u002Ftransform\u002F), sync, field definitions, CDR",{"type":42,"tag":269,"props":2533,"children":2534},{},[2535,2544],{"type":42,"tag":296,"props":2536,"children":2537},{},[2538],{"type":42,"tag":82,"props":2539,"children":2541},{"className":2540},[],[2542],{"type":47,"value":2543},"domain:docs",{"type":42,"tag":296,"props":2545,"children":2546},{},[2547],{"type":47,"value":2548},"README content, placeholder text, title\u002Fdescription quality",{"type":42,"tag":269,"props":2550,"children":2551},{},[2552,2561],{"type":42,"tag":296,"props":2553,"children":2554},{},[2555],{"type":42,"tag":82,"props":2556,"children":2558},{"className":2557},[],[2559],{"type":47,"value":2560},"domain:anonymization",{"type":42,"tag":296,"props":2562,"children":2563},{},[2564],{"type":47,"value":2565},"Real data in committed files, non-synthetic IPs\u002Fhostnames\u002Fcredentials",{"type":42,"tag":269,"props":2567,"children":2568},{},[2569,2578],{"type":42,"tag":296,"props":2570,"children":2571},{},[2572],{"type":42,"tag":82,"props":2573,"children":2575},{"className":2574},[],[2576],{"type":47,"value":2577},"domain:consistency",{"type":42,"tag":296,"props":2579,"children":2580},{},[2581],{"type":47,"value":2582},"Cross-domain issues: pipeline-fields mismatch, build.yml-pipeline ECS mismatch, unused manifest vars",{"type":42,"tag":254,"props":2584,"children":2586},{"id":2585},"severity-levels",[2587],{"type":47,"value":2588},"Severity levels",{"type":42,"tag":102,"props":2590,"children":2591},{},[2592,2602,2612,2621],{"type":42,"tag":106,"props":2593,"children":2594},{},[2595,2600],{"type":42,"tag":55,"props":2596,"children":2597},{},[2598],{"type":47,"value":2599},"CRITICAL",{"type":47,"value":2601},": broken functionality, security vulnerabilities, missing required files, build\u002Flint failures, infinite loops",{"type":42,"tag":106,"props":2603,"children":2604},{},[2605,2610],{"type":42,"tag":55,"props":2606,"children":2607},{},[2608],{"type":47,"value":2609},"HIGH",{"type":47,"value":2611},": quality standard violations -- must fix before merge",{"type":42,"tag":106,"props":2613,"children":2614},{},[2615,2619],{"type":42,"tag":55,"props":2616,"children":2617},{},[2618],{"type":47,"value":733},{"type":47,"value":2620},": suboptimal patterns, missing edge cases, documentation gaps -- fix when possible",{"type":42,"tag":106,"props":2622,"children":2623},{},[2624,2629],{"type":42,"tag":55,"props":2625,"children":2626},{},[2627],{"type":47,"value":2628},"LOW",{"type":47,"value":2630},": style issues, minor improvements -- nice to have",{"type":42,"tag":49,"props":2632,"children":2633},{},[2634,2636,2641,2643,2648],{"type":47,"value":2635},"Load ",{"type":42,"tag":82,"props":2637,"children":2639},{"className":2638},[],[2640],{"type":47,"value":1663},{"type":47,"value":2642}," for domain-specific calibration and ",{"type":42,"tag":82,"props":2644,"children":2646},{"className":2645},[],[2647],{"type":47,"value":1681},{"type":47,"value":2649}," for known inter-rule conflicts.",{"type":42,"tag":254,"props":2651,"children":2653},{"id":2652},"important-rules",[2654],{"type":47,"value":2655},"Important rules",{"type":42,"tag":102,"props":2657,"children":2658},{},[2659,2669,2679,2688,2698,2711],{"type":42,"tag":106,"props":2660,"children":2661},{},[2662,2667],{"type":42,"tag":55,"props":2663,"children":2664},{},[2665],{"type":47,"value":2666},"Never",{"type":47,"value":2668}," include positive observations in findings",{"type":42,"tag":106,"props":2670,"children":2671},{},[2672,2677],{"type":42,"tag":55,"props":2673,"children":2674},{},[2675],{"type":47,"value":2676},"Every",{"type":47,"value":2678}," issue must have a file path and line number",{"type":42,"tag":106,"props":2680,"children":2681},{},[2682,2686],{"type":42,"tag":55,"props":2683,"children":2684},{},[2685],{"type":47,"value":2676},{"type":47,"value":2687}," recommendation must include a code block showing the corrected code",{"type":42,"tag":106,"props":2689,"children":2690},{},[2691,2696],{"type":42,"tag":55,"props":2692,"children":2693},{},[2694],{"type":47,"value":2695},"Consolidate",{"type":47,"value":2697}," duplicates: merge same issue found in multiple files",{"type":42,"tag":106,"props":2699,"children":2700},{},[2701,2703,2709],{"type":47,"value":2702},"If a domain was reviewed and has no issues, write one line: \"✅ ",{"type":42,"tag":2704,"props":2705,"children":2706},"em",{},[2707],{"type":47,"value":2708},"Reviewed — No actionable issues found.",{"type":47,"value":2710},"\"",{"type":42,"tag":106,"props":2712,"children":2713},{},[2714],{"type":47,"value":2715},"If a domain is not in scope, omit it entirely",{"type":42,"tag":254,"props":2717,"children":2719},{"id":2718},"review-discipline",[2720],{"type":47,"value":2721},"Review discipline",{"type":42,"tag":102,"props":2723,"children":2724},{},[2725,2730,2743,2756],{"type":42,"tag":106,"props":2726,"children":2727},{},[2728],{"type":47,"value":2729},"Every finding must cite a concrete, present-tense bug with evidence in the code under review — not a hypothetical. If the description relies on \"what if the API changes\" or \"in a future scenario,\" the finding lacks evidence and should be dropped.",{"type":42,"tag":106,"props":2731,"children":2732},{},[2733,2735,2741],{"type":47,"value":2734},"Do NOT flag ",{"type":42,"tag":82,"props":2736,"children":2738},{"className":2737},[],[2739],{"type":47,"value":2740},"validation.yml",{"type":47,"value":2742}," exclusions (managed by package author, not a review concern)",{"type":42,"tag":106,"props":2744,"children":2745},{},[2746,2748,2754],{"type":47,"value":2747},"Do NOT suggest adding processors for vendor-handled fields (e.g., suggesting ",{"type":42,"tag":82,"props":2749,"children":2751},{"className":2750},[],[2752],{"type":47,"value":2753},"redact",{"type":47,"value":2755}," for passwords the vendor already masks)",{"type":42,"tag":106,"props":2757,"children":2758},{},[2759],{"type":47,"value":2760},"Do NOT flag hypothetical security risks without evidence of actual exposure in the code",{"type":42,"tag":203,"props":2762,"children":2763},{},[],{"type":42,"tag":63,"props":2765,"children":2767},{"id":2766},"reference-files",[2768],{"type":47,"value":2769},"Reference files",{"type":42,"tag":261,"props":2771,"children":2772},{},[2773,2794],{"type":42,"tag":265,"props":2774,"children":2775},{},[2776],{"type":42,"tag":269,"props":2777,"children":2778},{},[2779,2784,2789],{"type":42,"tag":273,"props":2780,"children":2781},{},[2782],{"type":47,"value":2783},"File",{"type":42,"tag":273,"props":2785,"children":2786},{},[2787],{"type":47,"value":2788},"Load condition",{"type":42,"tag":273,"props":2790,"children":2791},{},[2792],{"type":47,"value":2793},"Content",{"type":42,"tag":289,"props":2795,"children":2796},{},[2797,2819,2839,2859,2879,2900,2921,2941,2961,2981,3001,3022,3043,3064,3085,3106,3127,3147],{"type":42,"tag":269,"props":2798,"children":2799},{},[2800,2809,2814],{"type":42,"tag":296,"props":2801,"children":2802},{},[2803],{"type":42,"tag":82,"props":2804,"children":2806},{"className":2805},[],[2807],{"type":47,"value":2808},"references\u002Freviewer-subagent-guidance.md",{"type":42,"tag":296,"props":2810,"children":2811},{},[2812],{"type":47,"value":2813},"Read by the reviewer subagent itself (the orchestrator passes only its path, never embeds the content)",{"type":42,"tag":296,"props":2815,"children":2816},{},[2817],{"type":47,"value":2818},"Scope, skill-load sequence, read-only operating rules, per-issue format checklist, verdict rules, reporting contract for the orchestrator-dispatched reviewer",{"type":42,"tag":269,"props":2820,"children":2821},{},[2822,2830,2834],{"type":42,"tag":296,"props":2823,"children":2824},{},[2825],{"type":42,"tag":82,"props":2826,"children":2828},{"className":2827},[],[2829],{"type":47,"value":2296},{"type":42,"tag":296,"props":2831,"children":2832},{},[2833],{"type":47,"value":1654},{"type":42,"tag":296,"props":2835,"children":2836},{},[2837],{"type":47,"value":2838},"Output format template, rendering rules, severity mapping",{"type":42,"tag":269,"props":2840,"children":2841},{},[2842,2850,2854],{"type":42,"tag":296,"props":2843,"children":2844},{},[2845],{"type":42,"tag":82,"props":2846,"children":2848},{"className":2847},[],[2849],{"type":47,"value":1663},{"type":42,"tag":296,"props":2851,"children":2852},{},[2853],{"type":47,"value":1654},{"type":42,"tag":296,"props":2855,"children":2856},{},[2857],{"type":47,"value":2858},"CRITICAL\u002FHIGH\u002FMEDIUM\u002FLOW definitions with domain-specific calibration",{"type":42,"tag":269,"props":2860,"children":2861},{},[2862,2870,2874],{"type":42,"tag":296,"props":2863,"children":2864},{},[2865],{"type":42,"tag":82,"props":2866,"children":2868},{"className":2867},[],[2869],{"type":47,"value":1681},{"type":42,"tag":296,"props":2871,"children":2872},{},[2873],{"type":47,"value":1654},{"type":42,"tag":296,"props":2875,"children":2876},{},[2877],{"type":47,"value":2878},"Known rule conflicts and resolution decisions",{"type":42,"tag":269,"props":2880,"children":2881},{},[2882,2890,2895],{"type":42,"tag":296,"props":2883,"children":2884},{},[2885],{"type":42,"tag":82,"props":2886,"children":2888},{"className":2887},[],[2889],{"type":47,"value":1700},{"type":42,"tag":296,"props":2891,"children":2892},{},[2893],{"type":47,"value":2894},"2+ domains",{"type":42,"tag":296,"props":2896,"children":2897},{},[2898],{"type":47,"value":2899},"Cross-domain consistency rules (pipeline-fields-manifest-tests)",{"type":42,"tag":269,"props":2901,"children":2902},{},[2903,2911,2916],{"type":42,"tag":296,"props":2904,"children":2905},{},[2906],{"type":42,"tag":82,"props":2907,"children":2909},{"className":2908},[],[2910],{"type":47,"value":1719},{"type":42,"tag":296,"props":2912,"children":2913},{},[2914],{"type":47,"value":2915},"CEL in scope",{"type":42,"tag":296,"props":2917,"children":2918},{},[2919],{"type":47,"value":2920},"5-step systematic version verification procedure",{"type":42,"tag":269,"props":2922,"children":2923},{},[2924,2932,2936],{"type":42,"tag":296,"props":2925,"children":2926},{},[2927],{"type":42,"tag":82,"props":2928,"children":2930},{"className":2929},[],[2931],{"type":47,"value":1727},{"type":42,"tag":296,"props":2933,"children":2934},{},[2935],{"type":47,"value":2915},{"type":42,"tag":296,"props":2937,"children":2938},{},[2939],{"type":47,"value":2940},"Full beats-to-mito version mapping (160+ entries)",{"type":42,"tag":269,"props":2942,"children":2943},{},[2944,2952,2956],{"type":42,"tag":296,"props":2945,"children":2946},{},[2947],{"type":42,"tag":82,"props":2948,"children":2950},{"className":2949},[],[2951],{"type":47,"value":1734},{"type":42,"tag":296,"props":2953,"children":2954},{},[2955],{"type":47,"value":2915},{"type":42,"tag":296,"props":2957,"children":2958},{},[2959],{"type":47,"value":2960},"CEL config option introduction by beats version",{"type":42,"tag":269,"props":2962,"children":2963},{},[2964,2972,2976],{"type":42,"tag":296,"props":2965,"children":2966},{},[2967],{"type":42,"tag":82,"props":2968,"children":2970},{"className":2969},[],[2971],{"type":47,"value":1741},{"type":42,"tag":296,"props":2973,"children":2974},{},[2975],{"type":47,"value":2915},{"type":42,"tag":296,"props":2977,"children":2978},{},[2979],{"type":47,"value":2980},"Registered mito extensions per beats version",{"type":42,"tag":269,"props":2982,"children":2983},{},[2984,2992,2996],{"type":42,"tag":296,"props":2985,"children":2986},{},[2987],{"type":42,"tag":82,"props":2988,"children":2990},{"className":2989},[],[2991],{"type":47,"value":1757},{"type":42,"tag":296,"props":2993,"children":2994},{},[2995],{"type":47,"value":2915},{"type":42,"tag":296,"props":2997,"children":2998},{},[2999],{"type":47,"value":3000},"celfmt authority, type conversion audit, error shape validation",{"type":42,"tag":269,"props":3002,"children":3003},{},[3004,3012,3017],{"type":42,"tag":296,"props":3005,"children":3006},{},[3007],{"type":42,"tag":82,"props":3008,"children":3010},{"className":3009},[],[3011],{"type":47,"value":1776},{"type":42,"tag":296,"props":3013,"children":3014},{},[3015],{"type":47,"value":3016},"CEL\u002FHTTPJSON + API docs",{"type":42,"tag":296,"props":3018,"children":3019},{},[3020],{"type":47,"value":3021},"Cross-referencing implementation vs vendor API documentation",{"type":42,"tag":269,"props":3023,"children":3024},{},[3025,3033,3038],{"type":42,"tag":296,"props":3026,"children":3027},{},[3028],{"type":42,"tag":82,"props":3029,"children":3031},{"className":3030},[],[3032],{"type":47,"value":1795},{"type":42,"tag":296,"props":3034,"children":3035},{},[3036],{"type":47,"value":3037},"Any input templates",{"type":42,"tag":296,"props":3039,"children":3040},{},[3041],{"type":47,"value":3042},"Review depth routing by input type",{"type":42,"tag":269,"props":3044,"children":3045},{},[3046,3054,3059],{"type":42,"tag":296,"props":3047,"children":3048},{},[3049],{"type":42,"tag":82,"props":3050,"children":3052},{"className":3051},[],[3053],{"type":47,"value":1462},{"type":42,"tag":296,"props":3055,"children":3056},{},[3057],{"type":47,"value":3058},"Transform in scope",{"type":42,"tag":296,"props":3060,"children":3061},{},[3062],{"type":47,"value":3063},"Transform types, config, fields, sync, review checklist",{"type":42,"tag":269,"props":3065,"children":3066},{},[3067,3075,3080],{"type":42,"tag":296,"props":3068,"children":3069},{},[3070],{"type":42,"tag":82,"props":3071,"children":3073},{"className":3072},[],[3074],{"type":47,"value":1828},{"type":42,"tag":296,"props":3076,"children":3077},{},[3078],{"type":47,"value":3079},"CDR transforms",{"type":42,"tag":296,"props":3081,"children":3082},{},[3083],{"type":47,"value":3084},"CDR latest transform requirements, destination naming, keys, retention",{"type":42,"tag":269,"props":3086,"children":3087},{},[3088,3096,3101],{"type":42,"tag":296,"props":3089,"children":3090},{},[3091],{"type":42,"tag":82,"props":3092,"children":3094},{"className":3093},[],[3095],{"type":47,"value":1226},{"type":42,"tag":296,"props":3097,"children":3098},{},[3099],{"type":47,"value":3100},"Pipeline in scope",{"type":42,"tag":296,"props":3102,"children":3103},{},[3104],{"type":47,"value":3105},"Severity-tagged pipeline review checklist",{"type":42,"tag":269,"props":3107,"children":3108},{},[3109,3117,3122],{"type":42,"tag":296,"props":3110,"children":3111},{},[3112],{"type":42,"tag":82,"props":3113,"children":3115},{"className":3114},[],[3116],{"type":47,"value":1252},{"type":42,"tag":296,"props":3118,"children":3119},{},[3120],{"type":47,"value":3121},"Fields in scope",{"type":42,"tag":296,"props":3123,"children":3124},{},[3125],{"type":47,"value":3126},"Severity-tagged field mapping review checklist",{"type":42,"tag":269,"props":3128,"children":3129},{},[3130,3138,3142],{"type":42,"tag":296,"props":3131,"children":3132},{},[3133],{"type":42,"tag":82,"props":3134,"children":3136},{"className":3135},[],[3137],{"type":47,"value":1278},{"type":42,"tag":296,"props":3139,"children":3140},{},[3141],{"type":47,"value":2915},{"type":42,"tag":296,"props":3143,"children":3144},{},[3145],{"type":47,"value":3146},"Severity-tagged CEL review checklist",{"type":42,"tag":269,"props":3148,"children":3149},{},[3150,3158,3163],{"type":42,"tag":296,"props":3151,"children":3152},{},[3153],{"type":42,"tag":82,"props":3154,"children":3156},{"className":3155},[],[3157],{"type":47,"value":1312},{"type":42,"tag":296,"props":3159,"children":3160},{},[3161],{"type":47,"value":3162},"HTTPJSON in scope",{"type":42,"tag":296,"props":3164,"children":3165},{},[3166],{"type":47,"value":3167},"Severity-tagged HTTPJSON review checklist",{"type":42,"tag":3169,"props":3170,"children":3171},"style",{},[3172],{"type":47,"value":3173},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3175,"total":3345},[3176,3195,3212,3227,3246,3258,3268,3283,3295,3308,3319,3332],{"slug":3177,"name":3177,"fn":3178,"description":3179,"org":3180,"tags":3181,"stars":3192,"repoUrl":3193,"updatedAt":3194},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3182,3185,3188,3189],{"name":3183,"slug":3184,"type":15},"Analytics","analytics",{"name":3186,"slug":3187,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":3190,"slug":3191,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":3196,"name":3196,"fn":3197,"description":3198,"org":3199,"tags":3200,"stars":3192,"repoUrl":3193,"updatedAt":3211},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3201,3204,3205,3208],{"name":3202,"slug":3203,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":3206,"slug":3207,"type":15},"Engineering","engineering",{"name":3209,"slug":3210,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":3213,"name":3213,"fn":3214,"description":3215,"org":3216,"tags":3217,"stars":3192,"repoUrl":3193,"updatedAt":3226},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3218,3219,3222,3223],{"name":9,"slug":8,"type":15},{"name":3220,"slug":3221,"type":15},"Elasticsearch","elasticsearch",{"name":3190,"slug":3191,"type":15},{"name":3224,"slug":3225,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":3228,"name":3228,"fn":3229,"description":3230,"org":3231,"tags":3232,"stars":3243,"repoUrl":3244,"updatedAt":3245},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3233,3236,3237,3240],{"name":3234,"slug":3235,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":3238,"slug":3239,"type":15},"Operations","operations",{"name":3241,"slug":3242,"type":15},"Permissions","permissions",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:44.946285",{"slug":3247,"name":3247,"fn":3248,"description":3249,"org":3250,"tags":3251,"stars":3243,"repoUrl":3244,"updatedAt":3257},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3252,3253,3256],{"name":3234,"slug":3235,"type":15},{"name":3254,"slug":3255,"type":15},"Deployment","deployment",{"name":3220,"slug":3221,"type":15},"2026-07-12T07:46:42.353362",{"slug":3259,"name":3259,"fn":3260,"description":3261,"org":3262,"tags":3263,"stars":3243,"repoUrl":3244,"updatedAt":3267},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3264,3265,3266],{"name":3234,"slug":3235,"type":15},{"name":3220,"slug":3221,"type":15},{"name":3238,"slug":3239,"type":15},"2026-07-12T07:46:41.097412",{"slug":3269,"name":3269,"fn":3270,"description":3271,"org":3272,"tags":3273,"stars":3243,"repoUrl":3244,"updatedAt":3282},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3274,3275,3276,3279],{"name":3234,"slug":3235,"type":15},{"name":3220,"slug":3221,"type":15},{"name":3277,"slug":3278,"type":15},"Networking","networking",{"name":3280,"slug":3281,"type":15},"Security","security","2026-07-12T07:46:43.675992",{"slug":3284,"name":3284,"fn":3285,"description":3286,"org":3287,"tags":3288,"stars":3243,"repoUrl":3244,"updatedAt":3294},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3289,3292,3293],{"name":3290,"slug":3291,"type":15},"Authentication","authentication",{"name":3234,"slug":3235,"type":15},{"name":3220,"slug":3221,"type":15},"2026-07-12T07:46:39.783105",{"slug":3296,"name":3296,"fn":3297,"description":3298,"org":3299,"tags":3300,"stars":3243,"repoUrl":3244,"updatedAt":3307},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3301,3302,3303,3306],{"name":20,"slug":21,"type":15},{"name":3220,"slug":3221,"type":15},{"name":3304,"slug":3305,"type":15},"Logs","logs",{"name":3280,"slug":3281,"type":15},"2026-07-12T07:47:35.092599",{"slug":3309,"name":3309,"fn":3310,"description":3311,"org":3312,"tags":3313,"stars":3243,"repoUrl":3244,"updatedAt":3318},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3314,3315,3316,3317],{"name":3290,"slug":3291,"type":15},{"name":9,"slug":8,"type":15},{"name":3220,"slug":3221,"type":15},{"name":3280,"slug":3281,"type":15},"2026-07-12T07:47:41.474547",{"slug":3320,"name":3320,"fn":3321,"description":3322,"org":3323,"tags":3324,"stars":3243,"repoUrl":3244,"updatedAt":3331},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3325,3326,3327,3330],{"name":9,"slug":8,"type":15},{"name":3220,"slug":3221,"type":15},{"name":3328,"slug":3329,"type":15},"RBAC","rbac",{"name":3280,"slug":3281,"type":15},"2026-07-12T07:47:36.394177",{"slug":3333,"name":3333,"fn":3334,"description":3335,"org":3336,"tags":3337,"stars":3243,"repoUrl":3244,"updatedAt":3344},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3338,3339,3340,3341],{"name":3183,"slug":3184,"type":15},{"name":3186,"slug":3187,"type":15},{"name":3220,"slug":3221,"type":15},{"name":3342,"slug":3343,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86,{"items":3347,"total":3438},[3348,3362,3376,3384,3400,3412,3426],{"slug":1599,"name":1599,"fn":3349,"description":3350,"org":3351,"tags":3352,"stars":23,"repoUrl":24,"updatedAt":3361},"anonymize sensitive log data","Anonymize and sanitize customer-provided log files before they are committed as pipeline test fixtures or sample events. Performs a line-by-line review and replaces all sensitive values inline, preserving log structure and format exactly — never reformats, re-indents, or restructures content. Invoke manually with \u002Fanonymize-logs.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3353,3356,3357,3360],{"name":3354,"slug":3355,"type":15},"Data Cleaning","data-cleaning",{"name":3304,"slug":3305,"type":15},{"name":3358,"slug":3359,"type":15},"Privacy","privacy",{"name":3280,"slug":3281,"type":15},"2026-07-18T05:13:04.420121",{"slug":156,"name":156,"fn":3363,"description":3364,"org":3365,"tags":3366,"stars":23,"repoUrl":24,"updatedAt":3375},"write CEL programs for data collection","Use for all CEL and mito work on integrations that collect from APIs — writing CEL programs, cel.yml.hbs templates, manifest configuration, mock-first development with the mito CLI, system test mock setup, and answering CEL\u002Fmito questions. Load this skill whenever any data stream uses the cel input type.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3367,3370,3373,3374],{"name":3368,"slug":3369,"type":15},"API Development","api-development",{"name":3371,"slug":3372,"type":15},"Data Engineering","data-engineering",{"name":9,"slug":8,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:47:10.207064",{"slug":148,"name":148,"fn":3377,"description":3378,"org":3379,"tags":3380,"stars":23,"repoUrl":24,"updatedAt":3383},"create Elastic integration packages","Use when creating a new Elastic integration package, scaffolding data streams, answering package layout or structure questions, or running the end-to-end integration build workflow. Covers package topology, scaffold commands, post-scaffold edits, and full orchestration of CEL\u002Fpipeline\u002Ftest subagents.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3381,3382],{"name":3220,"slug":3221,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:46:56.318866",{"slug":1413,"name":1413,"fn":3385,"description":3386,"org":3387,"tags":3388,"stars":23,"repoUrl":24,"updatedAt":3399},"create and review Kibana dashboard assets","Use when creating or reviewing Kibana assets in packages, including dashboard export structure, naming, and data stream alignment.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3389,3392,3393,3396],{"name":3390,"slug":3391,"type":15},"Dashboards","dashboards",{"name":3220,"slug":3221,"type":15},{"name":3394,"slug":3395,"type":15},"Kibana","kibana",{"name":3397,"slug":3398,"type":15},"UI Components","ui-components","2026-07-12T07:47:07.702332",{"slug":1405,"name":1405,"fn":3401,"description":3402,"org":3403,"tags":3404,"stars":23,"repoUrl":24,"updatedAt":3411},"review Elastic dashboard JSON changes","Use when reviewing dashboard JSON changes in a PR or branch. Extracts structured descriptions with kbdash, compares before\u002Fafter, and checks guideline compliance.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3405,3408,3409,3410],{"name":3406,"slug":3407,"type":15},"Code Review","code-review",{"name":3390,"slug":3391,"type":15},{"name":9,"slug":8,"type":15},{"name":3394,"slug":3395,"type":15},"2026-07-12T07:47:06.493988",{"slug":1242,"name":1242,"fn":3413,"description":3414,"org":3415,"tags":3416,"stars":23,"repoUrl":24,"updatedAt":3425},"define ECS field mappings for integrations","Use when defining field mappings for data streams, populating ecs.yml with ECS field references, selecting ECS categorization values, choosing custom field types, or troubleshooting mapping validation failures.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3417,3420,3423,3424],{"name":3418,"slug":3419,"type":15},"Data Modeling","data-modeling",{"name":3421,"slug":3422,"type":15},"Data Quality","data-quality",{"name":9,"slug":8,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:47:13.472534",{"slug":1528,"name":1528,"fn":3427,"description":3428,"org":3429,"tags":3430,"stars":23,"repoUrl":24,"updatedAt":3437},"develop and validate Elastic integrations","Use when developing or validating Elastic integrations with elastic-package commands such as build, check, lint, format, test, stack, service, install, profiles, and benchmark.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3431,3434,3435,3436],{"name":3432,"slug":3433,"type":15},"CLI","cli",{"name":9,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"name":3224,"slug":3225,"type":15},"2026-07-12T07:46:57.647395",14]