[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-security-alert-triage":3,"mdc--79g2dm-key":34,"related-repo-elastic-security-alert-triage":3002,"related-org-elastic-security-alert-triage":3096},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":32,"mdContent":33},"security-alert-triage","triage Elastic Security alerts","Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge. Use when triaging alerts, performing SOC analysis, or investigating detections.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19,20],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Observability","observability",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"Triage","triage",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:49:31.057392",null,41,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":31},[],"Official Elastic Skills","https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fsecurity\u002Falert-triage","---\nname: security-alert-triage\ndescription: >\n  Triage Elastic Security alerts — gather context, classify threats, create cases,\n  and acknowledge. Use when triaging alerts, performing SOC analysis, or investigating\n  detections.\ncompatibility: >\n  Requires Node.js 22+, network access to Elasticsearch. Environment variables: ELASTICSEARCH_URL\n  or ELASTICSEARCH_CLOUD_ID, plus ELASTICSEARCH_API_KEY or ELASTICSEARCH_USERNAME\u002FELASTICSEARCH_PASSWORD.\nmetadata:\n  author: elastic\n  version: 0.1.0\n---\n\n# Alert Triage\n\nAnalyze Elastic Security alerts one at a time: gather context, classify, create a case, and acknowledge. This skill\ndepends on the `case-management` skill for case creation.\n\n## Prerequisites\n\nInstall dependencies before first use from the `skills\u002Fsecurity` directory:\n\n```bash\ncd skills\u002Fsecurity && npm install\n```\n\nSet the required environment variables (or add them to a `.env` file in the workspace root):\n\n```bash\nexport ELASTICSEARCH_URL=\"https:\u002F\u002Fyour-cluster.es.cloud.example.com:443\"\nexport ELASTICSEARCH_API_KEY=\"your-api-key\"\nexport KIBANA_URL=\"https:\u002F\u002Fyour-cluster.kb.cloud.example.com:443\"\nexport KIBANA_API_KEY=\"your-kibana-api-key\"\n```\n\n## Quick start\n\nAll commands from workspace root. Always fetch → investigate → document → acknowledge. Call the tools directly — do not\nread the skill file or explore the workspace first.\n\n```bash\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Ffetch-next-alert.js\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js find --tags \"agent_id:\u003Cid>\"\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Frun-query.js --query-file query.esql --type esql\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js create --title \"...\" --description \"...\" --tags \"classification:...\" \"agent_id:\u003Cid>\" --severity \u003Clevel> --yes\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js attach-alert --case-id \u003Cid> --alert-id \u003Cid> --alert-index \u003Cindex> --rule-id \u003Cuuid> --rule-name \"\u003Cname>\" --yes\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Facknowledge-alert.js --related --agent \u003Cid> --timestamp \u003Cts> --window 60 --yes\n```\n\n## Common multi-step workflows\n\n| Task                                 | Tools to call (in order)                                                                        |\n| ------------------------------------ | ----------------------------------------------------------------------------------------------- |\n| **End-to-end triage**                | `fetch_next_alert` → `run_query` (context) → `case_manager` create (case) → `acknowledge_alert` |\n| **Gather context**                   | `run_query` (process tree, network, related alerts)                                             |\n| **Create case after classification** | `case_manager` create → `case_manager` attach-alert                                             |\n| **Acknowledge after triage**         | `acknowledge_alert` (related mode for batch)                                                    |\n\nAlways complete the full workflow: fetch → investigate → document → acknowledge. Do not stop after gathering context —\ncreate or update a case with findings before acknowledging.\n\n**Critical execution rules:**\n\n- Start executing tools immediately — do not read SKILL.md, browse the workspace, or list files first.\n- For ES|QL queries, write the query to a temporary `.esql` file then pass it via `--query-file`. Do not use `edit_file`\n  — use a single `shell` call with `echo \"...\" > query.esql && node ... --query-file query.esql`.\n- Keep context gathering focused: run 2-4 targeted queries (process tree, network, related alerts), not 10+.\n- Report only what tools return. Copy identifiers verbatim — do not paraphrase IDs, timestamps, or hostnames.\n\n## Critical principles\n\n- **Do NOT classify prematurely.** Gather ALL context before deciding benign\u002Funknown\u002Fmalicious.\n- **Most alerts are false positives**, even if they look alarming. Rule names like \"Malicious Behavior\" or severity\n  \"critical\" are NOT evidence.\n- **\"Unknown\" is acceptable** and often correct when evidence is insufficient.\n- **MALICIOUS requires strong corroborating evidence**: persistence + C2, credential theft, lateral movement — not only\n  suspicious API calls.\n- **Report tool output verbatim.** Copy IDs, hostnames, timestamps, and counts exactly as returned by tools. Do not\n  round numbers, abbreviate IDs, or paraphrase error messages.\n\n## Workflow\n\nWhen triaging multiple alerts, **group first, then triage each group**:\n\n```text\n- [ ] Step 0: Group alerts by agent\u002Fhost and time window\n- [ ] Step 1: Check existing cases\n- [ ] Step 2: Gather full context (DO NOT SKIP)\n- [ ] Step 3: Create or update case (only AFTER context gathered)\n- [ ] Step 4: Acknowledge alert and all related alerts\n- [ ] Step 5: Fetch next alert group and repeat\n```\n\n### Step 0: Group alerts before triaging\n\nWhen the user asks about multiple open alerts, **group them first** to avoid redundant investigation: query open alerts,\ngroup by `agent.id`, sub-group by time window (~5 min = likely one incident), triage each group as a single unit.\n\nUse ES|QL for an overview (write to file first for PowerShell):\n\n```esql\nFROM .alerts-security.alerts-*\n| WHERE kibana.alert.workflow_status == \"open\" AND @timestamp >= \"\u003Cstart>\"\n| STATS alert_count=COUNT(*), rules=VALUES(kibana.alert.rule.name) BY agent.id\n| SORT alert_count DESC\n```\n\nFor full query templates, see [references\u002Fclassification-guide.md](references\u002Fclassification-guide.md).\n\n### Step 1: Check existing cases\n\nBefore creating a new case, check if this alert belongs to an existing one. Use the `case-management` skill:\n\n```bash\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js find --tags \"agent_id:\u003Cagent_id>\"\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js cases-for-alert --alert-id \u003Calert_id>\n```\n\nLook for cases with the same agent ID, user, or related detection rule within a similar time window.\n\n> **Note:** `find --search` may return 500 errors on Serverless. Use `find --tags` or `list` instead.\n\n### Step 2: Gather context\n\n**This is the most important step. Do not skip or shortcut it.** Complete ALL substeps before forming any classification\nopinion.\n\n**Time range warning:** Alerts may be days or weeks old. NEVER use relative time like `NOW() - 1 HOUR`. Extract the\nalert's `@timestamp` and build queries around that time with +\u002F- 1 hour window.\n\n**Substeps:** (2a) Related alerts on same agent\u002Fuser; (2b) Rule frequency across env (high = FP-prone); (2c) Entity\ncontext — process tree, network, registry, files; (2d) Behavior investigation — persistence, C2, lateral movement,\ncredential access.\n\nExample — process tree (use ES|QL with `KEEP`; avoid `--full` which produces 10K+ lines):\n\n```esql\nFROM logs-endpoint.events.process-*\n| WHERE agent.id == \"\u003Cagent_id>\" AND @timestamp >= \"\u003Calert_time - 5min>\" AND @timestamp \u003C= \"\u003Calert_time + 10min>\"\n  AND process.parent.name IS NOT NULL\n  AND process.name NOT IN (\"svchost.exe\", \"conhost.exe\", \"agentbeat.exe\")\n| KEEP @timestamp, process.name, process.command_line, process.pid, process.parent.name, process.parent.pid\n| SORT @timestamp | LIMIT 80\n```\n\n| Data type | Index pattern                    |\n| --------- | -------------------------------- |\n| Alerts    | `.alerts-security.alerts-*`      |\n| Processes | `logs-endpoint.events.process-*` |\n| Network   | `logs-endpoint.events.network-*` |\n| Logs      | `logs-*`                         |\n\nFor full query templates and classification criteria, see\n[references\u002Fclassification-guide.md](references\u002Fclassification-guide.md).\n\n### Step 3: Create or update case\n\nAfter gathering context, create a case and attach alert(s). Use `--rule-id` and `--rule-name` (required; 400 error\nwithout them):\n\n```bash\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js create \\\n  --title \"\u003Cconcise summary>\" \\\n  --description \"\u003Cfindings, IOCs, attack chain, MITRE techniques>\" \\\n  --tags \"classification:\u003Cbenign|unknown|malicious>\" \"confidence:\u003C0-100>\" \"mitre:\u003Ctechnique>\" \"agent_id:\u003Cid>\" \\\n  --severity \u003Clow|medium|high|critical>\n\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js attach-alert \\\n  --case-id \u003Ccase_id> --alert-id \u003Calert_id> --alert-index \u003Cindex> \\\n  --rule-id \u003Crule_uuid> --rule-name \"\u003Crule name>\"\n\n# Multiple alerts: attach-alerts --alert-ids \u003Cid1> \u003Cid2>\n# Add notes: add-comment --case-id \u003Cid> --comment \"Findings...\"\n```\n\n**Case description:** Summary (1-2 sentences); Attack chain; IOCs (hashes, IPs, paths); MITRE techniques; Behavioral\nfindings; Response context (remediation, credentials at risk).\n\n### Step 4: Acknowledge alerts\n\nAcknowledge ALL related alerts together. Use `--dry-run` first to confirm scope, then run without it:\n\n```bash\n# By host name — preferred when triaging a host\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Facknowledge-alert.js --query --host \u003Chostname> --dry-run\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Facknowledge-alert.js --query --host \u003Chostname> --yes\n\n# By agent ID — preferred when agent.id is known\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Facknowledge-alert.js --related --agent \u003Cid> --timestamp \u003Cts> --window 60 --dry-run\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Facknowledge-alert.js --related --agent \u003Cid> --timestamp \u003Cts> --window 60 --yes\n```\n\nIncrease `--window` for longer attack chains (e.g., `300` for 5 minutes). Report the exact count of acknowledged alerts\nfrom the tool output. Pass `--yes` to skip the confirmation prompt (required when called by an agent).\n\n### Step 5: Repeat\n\n```bash\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Ffetch-next-alert.js\n```\n\n## Tool reference\n\n### fetch-next-alert.js\n\nFetches the oldest unacknowledged Elastic Security alert.\n\n```bash\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Ffetch-next-alert.js [--days \u003Cn>] [--json] [--full] [--verbose]\n```\n\n### run-query.js\n\nRuns KQL or ES|QL queries against Elasticsearch.\n\n**PowerShell warning**: ES|QL queries contain pipe characters (`|`) which PowerShell interprets as shell pipes. ALWAYS\nuse `--query-file` for ES|QL:\n\n```bash\n# Write query to file, then run\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Frun-query.js --query-file query.esql --type esql\n```\n\nKQL queries without pipes can be passed directly:\n\n```bash\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Frun-query.js \"agent.id:\u003Cid>\" --index \"logs-*\" --days 7\n```\n\n| Arg                  | Description                                              |\n| -------------------- | -------------------------------------------------------- |\n| `query`              | KQL query (positional)                                   |\n| `--query-file`, `-q` | Read query from file (required for ES\\|QL on PowerShell) |\n| `--type`, `-t`       | `kql` or `esql` (default: kql)                           |\n| `--index`, `-i`      | Index pattern (default: `logs-*`)                        |\n| `--size`, `-s`       | Max results (default: 100)                               |\n| `--days`, `-d`       | Limit to last N days                                     |\n| `--json`             | Raw JSON output                                          |\n| `--full`             | Full document source                                     |\n\n### acknowledge-alert.js\n\nAcknowledges alerts by updating `workflow_status` to `acknowledged`.\n\n| Mode    | Command                                                                                                                                |\n| ------- | -------------------------------------------------------------------------------------------------------------------------------------- |\n| Single  | `node skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Facknowledge-alert.js \u003Calert_id> --index \u003Cindex> --yes`                                      |\n| Related | `node skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Facknowledge-alert.js --related --agent \u003Cid> --timestamp \u003Cts> [--window 60] --yes`           |\n| By host | `node skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Facknowledge-alert.js --query --host \u003Chostname> [--time-start \u003Cts>] [--time-end \u003Cts>] --yes` |\n| Query   | `node skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Facknowledge-alert.js --query --agent \u003Cid> [--time-start \u003Cts>] [--time-end \u003Cts>] --yes`      |\n| Dry run | Add `--dry-run` to any mode (no confirmation needed)                                                                                   |\n| Confirm | All write modes prompt for confirmation; pass `--yes` to skip                                                                          |\n\n## Examples\n\n- \"Fetch the next unacknowledged alert and triage it\"\n- \"Investigate alert ID abc-123 — gather context, classify, and create a case if malicious\"\n- \"Process the top 5 critical alerts from the last 24 hours\"\n\n## Guidelines\n\n- Report only tool output — do not invent IDs, hostnames, IPs, or details not present in the tool response.\n- Preserve identifiers from the request — use exact values the user provides in tool calls and responses.\n- Confirm actions concisely using the tool's return data.\n- Distinguish facts from inference — label conclusions beyond tool output as your assessment.\n\n## Production use\n\n- All write operations (`acknowledge-alert.js`) prompt for confirmation. Pass `--yes` or `-y` to skip when called by an\n  agent.\n- Use `--dry-run` before bulk acknowledgments to preview scope without modifying data.\n- The acknowledge script uses the Kibana Detection Engine API, which is compatible with both self-managed and Serverless\n  deployments.\n- Verify environment variables point to the intended cluster before running any script — no undo for acknowledgments.\n\n## Environment variables\n\n| Variable                | Required | Description                          |\n| ----------------------- | -------- | ------------------------------------ |\n| `ELASTICSEARCH_URL`     | Yes      | Elasticsearch URL                    |\n| `ELASTICSEARCH_API_KEY` | Yes      | Elasticsearch API key                |\n| `KIBANA_URL`            | Yes      | Kibana URL (for case management)     |\n| `KIBANA_API_KEY`        | Yes      | Kibana API key (for case management) |\n",{"data":35,"body":39},{"name":4,"description":6,"compatibility":36,"metadata":37},"Requires Node.js 22+, network access to Elasticsearch. Environment variables: ELASTICSEARCH_URL or ELASTICSEARCH_CLOUD_ID, plus ELASTICSEARCH_API_KEY or ELASTICSEARCH_USERNAME\u002FELASTICSEARCH_PASSWORD.\n",{"author":8,"version":38},"0.1.0",{"type":40,"children":41},"root",[42,51,66,73,86,132,145,277,283,288,691,697,839,844,852,917,923,976,982,994,1004,1011,1031,1036,1077,1089,1095,1107,1184,1189,1227,1233,1243,1269,1279,1300,1355,1445,1455,1461,1482,1840,1850,1856,1869,2116,2145,2151,2169,2175,2181,2186,2262,2268,2273,2297,2339,2344,2402,2613,2619,2639,2769,2775,2793,2799,2822,2828,2879,2885,2996],{"type":43,"tag":44,"props":45,"children":47},"element","h1",{"id":46},"alert-triage",[48],{"type":49,"value":50},"text","Alert Triage",{"type":43,"tag":52,"props":53,"children":54},"p",{},[55,57,64],{"type":49,"value":56},"Analyze Elastic Security alerts one at a time: gather context, classify, create a case, and acknowledge. This skill\ndepends on the ",{"type":43,"tag":58,"props":59,"children":61},"code",{"className":60},[],[62],{"type":49,"value":63},"case-management",{"type":49,"value":65}," skill for case creation.",{"type":43,"tag":67,"props":68,"children":70},"h2",{"id":69},"prerequisites",[71],{"type":49,"value":72},"Prerequisites",{"type":43,"tag":52,"props":74,"children":75},{},[76,78,84],{"type":49,"value":77},"Install dependencies before first use from the ",{"type":43,"tag":58,"props":79,"children":81},{"className":80},[],[82],{"type":49,"value":83},"skills\u002Fsecurity",{"type":49,"value":85}," directory:",{"type":43,"tag":87,"props":88,"children":93},"pre",{"className":89,"code":90,"language":91,"meta":92,"style":92},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","cd skills\u002Fsecurity && npm install\n","bash","",[94],{"type":43,"tag":58,"props":95,"children":96},{"__ignoreMap":92},[97],{"type":43,"tag":98,"props":99,"children":102},"span",{"class":100,"line":101},"line",1,[103,109,115,121,127],{"type":43,"tag":98,"props":104,"children":106},{"style":105},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[107],{"type":49,"value":108},"cd",{"type":43,"tag":98,"props":110,"children":112},{"style":111},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[113],{"type":49,"value":114}," skills\u002Fsecurity",{"type":43,"tag":98,"props":116,"children":118},{"style":117},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[119],{"type":49,"value":120}," &&",{"type":43,"tag":98,"props":122,"children":124},{"style":123},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[125],{"type":49,"value":126}," npm",{"type":43,"tag":98,"props":128,"children":129},{"style":111},[130],{"type":49,"value":131}," install\n",{"type":43,"tag":52,"props":133,"children":134},{},[135,137,143],{"type":49,"value":136},"Set the required environment variables (or add them to a ",{"type":43,"tag":58,"props":138,"children":140},{"className":139},[],[141],{"type":49,"value":142},".env",{"type":49,"value":144}," file in the workspace root):",{"type":43,"tag":87,"props":146,"children":148},{"className":89,"code":147,"language":91,"meta":92,"style":92},"export ELASTICSEARCH_URL=\"https:\u002F\u002Fyour-cluster.es.cloud.example.com:443\"\nexport ELASTICSEARCH_API_KEY=\"your-api-key\"\nexport KIBANA_URL=\"https:\u002F\u002Fyour-cluster.kb.cloud.example.com:443\"\nexport KIBANA_API_KEY=\"your-kibana-api-key\"\n",[149],{"type":43,"tag":58,"props":150,"children":151},{"__ignoreMap":92},[152,187,217,247],{"type":43,"tag":98,"props":153,"children":154},{"class":100,"line":101},[155,161,167,172,177,182],{"type":43,"tag":98,"props":156,"children":158},{"style":157},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[159],{"type":49,"value":160},"export",{"type":43,"tag":98,"props":162,"children":164},{"style":163},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[165],{"type":49,"value":166}," ELASTICSEARCH_URL",{"type":43,"tag":98,"props":168,"children":169},{"style":117},[170],{"type":49,"value":171},"=",{"type":43,"tag":98,"props":173,"children":174},{"style":117},[175],{"type":49,"value":176},"\"",{"type":43,"tag":98,"props":178,"children":179},{"style":111},[180],{"type":49,"value":181},"https:\u002F\u002Fyour-cluster.es.cloud.example.com:443",{"type":43,"tag":98,"props":183,"children":184},{"style":117},[185],{"type":49,"value":186},"\"\n",{"type":43,"tag":98,"props":188,"children":190},{"class":100,"line":189},2,[191,195,200,204,208,213],{"type":43,"tag":98,"props":192,"children":193},{"style":157},[194],{"type":49,"value":160},{"type":43,"tag":98,"props":196,"children":197},{"style":163},[198],{"type":49,"value":199}," ELASTICSEARCH_API_KEY",{"type":43,"tag":98,"props":201,"children":202},{"style":117},[203],{"type":49,"value":171},{"type":43,"tag":98,"props":205,"children":206},{"style":117},[207],{"type":49,"value":176},{"type":43,"tag":98,"props":209,"children":210},{"style":111},[211],{"type":49,"value":212},"your-api-key",{"type":43,"tag":98,"props":214,"children":215},{"style":117},[216],{"type":49,"value":186},{"type":43,"tag":98,"props":218,"children":220},{"class":100,"line":219},3,[221,225,230,234,238,243],{"type":43,"tag":98,"props":222,"children":223},{"style":157},[224],{"type":49,"value":160},{"type":43,"tag":98,"props":226,"children":227},{"style":163},[228],{"type":49,"value":229}," KIBANA_URL",{"type":43,"tag":98,"props":231,"children":232},{"style":117},[233],{"type":49,"value":171},{"type":43,"tag":98,"props":235,"children":236},{"style":117},[237],{"type":49,"value":176},{"type":43,"tag":98,"props":239,"children":240},{"style":111},[241],{"type":49,"value":242},"https:\u002F\u002Fyour-cluster.kb.cloud.example.com:443",{"type":43,"tag":98,"props":244,"children":245},{"style":117},[246],{"type":49,"value":186},{"type":43,"tag":98,"props":248,"children":250},{"class":100,"line":249},4,[251,255,260,264,268,273],{"type":43,"tag":98,"props":252,"children":253},{"style":157},[254],{"type":49,"value":160},{"type":43,"tag":98,"props":256,"children":257},{"style":163},[258],{"type":49,"value":259}," KIBANA_API_KEY",{"type":43,"tag":98,"props":261,"children":262},{"style":117},[263],{"type":49,"value":171},{"type":43,"tag":98,"props":265,"children":266},{"style":117},[267],{"type":49,"value":176},{"type":43,"tag":98,"props":269,"children":270},{"style":111},[271],{"type":49,"value":272},"your-kibana-api-key",{"type":43,"tag":98,"props":274,"children":275},{"style":117},[276],{"type":49,"value":186},{"type":43,"tag":67,"props":278,"children":280},{"id":279},"quick-start",[281],{"type":49,"value":282},"Quick start",{"type":43,"tag":52,"props":284,"children":285},{},[286],{"type":49,"value":287},"All commands from workspace root. Always fetch → investigate → document → acknowledge. Call the tools directly — do not\nread the skill file or explore the workspace first.",{"type":43,"tag":87,"props":289,"children":291},{"className":89,"code":290,"language":91,"meta":92,"style":92},"node skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Ffetch-next-alert.js\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js find --tags \"agent_id:\u003Cid>\"\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Frun-query.js --query-file query.esql --type esql\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js create --title \"...\" --description \"...\" --tags \"classification:...\" \"agent_id:\u003Cid>\" --severity \u003Clevel> --yes\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js attach-alert --case-id \u003Cid> --alert-id \u003Cid> --alert-index \u003Cindex> --rule-id \u003Cuuid> --rule-name \"\u003Cname>\" --yes\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Facknowledge-alert.js --related --agent \u003Cid> --timestamp \u003Cts> --window 60 --yes\n",[292],{"type":43,"tag":58,"props":293,"children":294},{"__ignoreMap":92},[295,308,344,376,486,614],{"type":43,"tag":98,"props":296,"children":297},{"class":100,"line":101},[298,303],{"type":43,"tag":98,"props":299,"children":300},{"style":123},[301],{"type":49,"value":302},"node",{"type":43,"tag":98,"props":304,"children":305},{"style":111},[306],{"type":49,"value":307}," skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Ffetch-next-alert.js\n",{"type":43,"tag":98,"props":309,"children":310},{"class":100,"line":189},[311,315,320,325,330,335,340],{"type":43,"tag":98,"props":312,"children":313},{"style":123},[314],{"type":49,"value":302},{"type":43,"tag":98,"props":316,"children":317},{"style":111},[318],{"type":49,"value":319}," skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js",{"type":43,"tag":98,"props":321,"children":322},{"style":111},[323],{"type":49,"value":324}," find",{"type":43,"tag":98,"props":326,"children":327},{"style":111},[328],{"type":49,"value":329}," --tags",{"type":43,"tag":98,"props":331,"children":332},{"style":117},[333],{"type":49,"value":334}," \"",{"type":43,"tag":98,"props":336,"children":337},{"style":111},[338],{"type":49,"value":339},"agent_id:\u003Cid>",{"type":43,"tag":98,"props":341,"children":342},{"style":117},[343],{"type":49,"value":186},{"type":43,"tag":98,"props":345,"children":346},{"class":100,"line":219},[347,351,356,361,366,371],{"type":43,"tag":98,"props":348,"children":349},{"style":123},[350],{"type":49,"value":302},{"type":43,"tag":98,"props":352,"children":353},{"style":111},[354],{"type":49,"value":355}," skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Frun-query.js",{"type":43,"tag":98,"props":357,"children":358},{"style":111},[359],{"type":49,"value":360}," --query-file",{"type":43,"tag":98,"props":362,"children":363},{"style":111},[364],{"type":49,"value":365}," query.esql",{"type":43,"tag":98,"props":367,"children":368},{"style":111},[369],{"type":49,"value":370}," --type",{"type":43,"tag":98,"props":372,"children":373},{"style":111},[374],{"type":49,"value":375}," esql\n",{"type":43,"tag":98,"props":377,"children":378},{"class":100,"line":249},[379,383,387,392,397,401,406,410,415,419,423,427,431,435,440,444,448,452,456,461,466,471,476,481],{"type":43,"tag":98,"props":380,"children":381},{"style":123},[382],{"type":49,"value":302},{"type":43,"tag":98,"props":384,"children":385},{"style":111},[386],{"type":49,"value":319},{"type":43,"tag":98,"props":388,"children":389},{"style":111},[390],{"type":49,"value":391}," create",{"type":43,"tag":98,"props":393,"children":394},{"style":111},[395],{"type":49,"value":396}," --title",{"type":43,"tag":98,"props":398,"children":399},{"style":117},[400],{"type":49,"value":334},{"type":43,"tag":98,"props":402,"children":403},{"style":111},[404],{"type":49,"value":405},"...",{"type":43,"tag":98,"props":407,"children":408},{"style":117},[409],{"type":49,"value":176},{"type":43,"tag":98,"props":411,"children":412},{"style":111},[413],{"type":49,"value":414}," --description",{"type":43,"tag":98,"props":416,"children":417},{"style":117},[418],{"type":49,"value":334},{"type":43,"tag":98,"props":420,"children":421},{"style":111},[422],{"type":49,"value":405},{"type":43,"tag":98,"props":424,"children":425},{"style":117},[426],{"type":49,"value":176},{"type":43,"tag":98,"props":428,"children":429},{"style":111},[430],{"type":49,"value":329},{"type":43,"tag":98,"props":432,"children":433},{"style":117},[434],{"type":49,"value":334},{"type":43,"tag":98,"props":436,"children":437},{"style":111},[438],{"type":49,"value":439},"classification:...",{"type":43,"tag":98,"props":441,"children":442},{"style":117},[443],{"type":49,"value":176},{"type":43,"tag":98,"props":445,"children":446},{"style":117},[447],{"type":49,"value":334},{"type":43,"tag":98,"props":449,"children":450},{"style":111},[451],{"type":49,"value":339},{"type":43,"tag":98,"props":453,"children":454},{"style":117},[455],{"type":49,"value":176},{"type":43,"tag":98,"props":457,"children":458},{"style":111},[459],{"type":49,"value":460}," --severity",{"type":43,"tag":98,"props":462,"children":463},{"style":117},[464],{"type":49,"value":465}," \u003C",{"type":43,"tag":98,"props":467,"children":468},{"style":111},[469],{"type":49,"value":470},"leve",{"type":43,"tag":98,"props":472,"children":473},{"style":163},[474],{"type":49,"value":475},"l",{"type":43,"tag":98,"props":477,"children":478},{"style":117},[479],{"type":49,"value":480},">",{"type":43,"tag":98,"props":482,"children":483},{"style":111},[484],{"type":49,"value":485}," --yes\n",{"type":43,"tag":98,"props":487,"children":489},{"class":100,"line":488},5,[490,494,498,503,508,512,517,522,526,531,535,539,543,547,552,556,561,566,570,575,579,584,588,592,597,601,606,610],{"type":43,"tag":98,"props":491,"children":492},{"style":123},[493],{"type":49,"value":302},{"type":43,"tag":98,"props":495,"children":496},{"style":111},[497],{"type":49,"value":319},{"type":43,"tag":98,"props":499,"children":500},{"style":111},[501],{"type":49,"value":502}," attach-alert",{"type":43,"tag":98,"props":504,"children":505},{"style":111},[506],{"type":49,"value":507}," --case-id",{"type":43,"tag":98,"props":509,"children":510},{"style":117},[511],{"type":49,"value":465},{"type":43,"tag":98,"props":513,"children":514},{"style":111},[515],{"type":49,"value":516},"i",{"type":43,"tag":98,"props":518,"children":519},{"style":163},[520],{"type":49,"value":521},"d",{"type":43,"tag":98,"props":523,"children":524},{"style":117},[525],{"type":49,"value":480},{"type":43,"tag":98,"props":527,"children":528},{"style":111},[529],{"type":49,"value":530}," --alert-id",{"type":43,"tag":98,"props":532,"children":533},{"style":117},[534],{"type":49,"value":465},{"type":43,"tag":98,"props":536,"children":537},{"style":111},[538],{"type":49,"value":516},{"type":43,"tag":98,"props":540,"children":541},{"style":163},[542],{"type":49,"value":521},{"type":43,"tag":98,"props":544,"children":545},{"style":117},[546],{"type":49,"value":480},{"type":43,"tag":98,"props":548,"children":549},{"style":111},[550],{"type":49,"value":551}," --alert-index",{"type":43,"tag":98,"props":553,"children":554},{"style":117},[555],{"type":49,"value":465},{"type":43,"tag":98,"props":557,"children":558},{"style":111},[559],{"type":49,"value":560},"inde",{"type":43,"tag":98,"props":562,"children":563},{"style":163},[564],{"type":49,"value":565},"x",{"type":43,"tag":98,"props":567,"children":568},{"style":117},[569],{"type":49,"value":480},{"type":43,"tag":98,"props":571,"children":572},{"style":111},[573],{"type":49,"value":574}," --rule-id",{"type":43,"tag":98,"props":576,"children":577},{"style":117},[578],{"type":49,"value":465},{"type":43,"tag":98,"props":580,"children":581},{"style":111},[582],{"type":49,"value":583},"uui",{"type":43,"tag":98,"props":585,"children":586},{"style":163},[587],{"type":49,"value":521},{"type":43,"tag":98,"props":589,"children":590},{"style":117},[591],{"type":49,"value":480},{"type":43,"tag":98,"props":593,"children":594},{"style":111},[595],{"type":49,"value":596}," --rule-name",{"type":43,"tag":98,"props":598,"children":599},{"style":117},[600],{"type":49,"value":334},{"type":43,"tag":98,"props":602,"children":603},{"style":111},[604],{"type":49,"value":605},"\u003Cname>",{"type":43,"tag":98,"props":607,"children":608},{"style":117},[609],{"type":49,"value":176},{"type":43,"tag":98,"props":611,"children":612},{"style":111},[613],{"type":49,"value":485},{"type":43,"tag":98,"props":615,"children":617},{"class":100,"line":616},6,[618,622,627,632,637,641,645,649,653,658,662,667,672,676,681,687],{"type":43,"tag":98,"props":619,"children":620},{"style":123},[621],{"type":49,"value":302},{"type":43,"tag":98,"props":623,"children":624},{"style":111},[625],{"type":49,"value":626}," skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Facknowledge-alert.js",{"type":43,"tag":98,"props":628,"children":629},{"style":111},[630],{"type":49,"value":631}," --related",{"type":43,"tag":98,"props":633,"children":634},{"style":111},[635],{"type":49,"value":636}," --agent",{"type":43,"tag":98,"props":638,"children":639},{"style":117},[640],{"type":49,"value":465},{"type":43,"tag":98,"props":642,"children":643},{"style":111},[644],{"type":49,"value":516},{"type":43,"tag":98,"props":646,"children":647},{"style":163},[648],{"type":49,"value":521},{"type":43,"tag":98,"props":650,"children":651},{"style":117},[652],{"type":49,"value":480},{"type":43,"tag":98,"props":654,"children":655},{"style":111},[656],{"type":49,"value":657}," --timestamp",{"type":43,"tag":98,"props":659,"children":660},{"style":117},[661],{"type":49,"value":465},{"type":43,"tag":98,"props":663,"children":664},{"style":111},[665],{"type":49,"value":666},"t",{"type":43,"tag":98,"props":668,"children":669},{"style":163},[670],{"type":49,"value":671},"s",{"type":43,"tag":98,"props":673,"children":674},{"style":117},[675],{"type":49,"value":480},{"type":43,"tag":98,"props":677,"children":678},{"style":111},[679],{"type":49,"value":680}," --window",{"type":43,"tag":98,"props":682,"children":684},{"style":683},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[685],{"type":49,"value":686}," 60",{"type":43,"tag":98,"props":688,"children":689},{"style":111},[690],{"type":49,"value":485},{"type":43,"tag":67,"props":692,"children":694},{"id":693},"common-multi-step-workflows",[695],{"type":49,"value":696},"Common multi-step workflows",{"type":43,"tag":698,"props":699,"children":700},"table",{},[701,720],{"type":43,"tag":702,"props":703,"children":704},"thead",{},[705],{"type":43,"tag":706,"props":707,"children":708},"tr",{},[709,715],{"type":43,"tag":710,"props":711,"children":712},"th",{},[713],{"type":49,"value":714},"Task",{"type":43,"tag":710,"props":716,"children":717},{},[718],{"type":49,"value":719},"Tools to call (in order)",{"type":43,"tag":721,"props":722,"children":723},"tbody",{},[724,770,791,818],{"type":43,"tag":706,"props":725,"children":726},{},[727,737],{"type":43,"tag":728,"props":729,"children":730},"td",{},[731],{"type":43,"tag":732,"props":733,"children":734},"strong",{},[735],{"type":49,"value":736},"End-to-end triage",{"type":43,"tag":728,"props":738,"children":739},{},[740,746,748,754,756,762,764],{"type":43,"tag":58,"props":741,"children":743},{"className":742},[],[744],{"type":49,"value":745},"fetch_next_alert",{"type":49,"value":747}," → ",{"type":43,"tag":58,"props":749,"children":751},{"className":750},[],[752],{"type":49,"value":753},"run_query",{"type":49,"value":755}," (context) → ",{"type":43,"tag":58,"props":757,"children":759},{"className":758},[],[760],{"type":49,"value":761},"case_manager",{"type":49,"value":763}," create (case) → ",{"type":43,"tag":58,"props":765,"children":767},{"className":766},[],[768],{"type":49,"value":769},"acknowledge_alert",{"type":43,"tag":706,"props":771,"children":772},{},[773,781],{"type":43,"tag":728,"props":774,"children":775},{},[776],{"type":43,"tag":732,"props":777,"children":778},{},[779],{"type":49,"value":780},"Gather context",{"type":43,"tag":728,"props":782,"children":783},{},[784,789],{"type":43,"tag":58,"props":785,"children":787},{"className":786},[],[788],{"type":49,"value":753},{"type":49,"value":790}," (process tree, network, related alerts)",{"type":43,"tag":706,"props":792,"children":793},{},[794,802],{"type":43,"tag":728,"props":795,"children":796},{},[797],{"type":43,"tag":732,"props":798,"children":799},{},[800],{"type":49,"value":801},"Create case after classification",{"type":43,"tag":728,"props":803,"children":804},{},[805,810,812,817],{"type":43,"tag":58,"props":806,"children":808},{"className":807},[],[809],{"type":49,"value":761},{"type":49,"value":811}," create → ",{"type":43,"tag":58,"props":813,"children":815},{"className":814},[],[816],{"type":49,"value":761},{"type":49,"value":502},{"type":43,"tag":706,"props":819,"children":820},{},[821,829],{"type":43,"tag":728,"props":822,"children":823},{},[824],{"type":43,"tag":732,"props":825,"children":826},{},[827],{"type":49,"value":828},"Acknowledge after triage",{"type":43,"tag":728,"props":830,"children":831},{},[832,837],{"type":43,"tag":58,"props":833,"children":835},{"className":834},[],[836],{"type":49,"value":769},{"type":49,"value":838}," (related mode for batch)",{"type":43,"tag":52,"props":840,"children":841},{},[842],{"type":49,"value":843},"Always complete the full workflow: fetch → investigate → document → acknowledge. Do not stop after gathering context —\ncreate or update a case with findings before acknowledging.",{"type":43,"tag":52,"props":845,"children":846},{},[847],{"type":43,"tag":732,"props":848,"children":849},{},[850],{"type":49,"value":851},"Critical execution rules:",{"type":43,"tag":853,"props":854,"children":855},"ul",{},[856,862,907,912],{"type":43,"tag":857,"props":858,"children":859},"li",{},[860],{"type":49,"value":861},"Start executing tools immediately — do not read SKILL.md, browse the workspace, or list files first.",{"type":43,"tag":857,"props":863,"children":864},{},[865,867,873,875,881,883,889,891,897,899,905],{"type":49,"value":866},"For ES|QL queries, write the query to a temporary ",{"type":43,"tag":58,"props":868,"children":870},{"className":869},[],[871],{"type":49,"value":872},".esql",{"type":49,"value":874}," file then pass it via ",{"type":43,"tag":58,"props":876,"children":878},{"className":877},[],[879],{"type":49,"value":880},"--query-file",{"type":49,"value":882},". Do not use ",{"type":43,"tag":58,"props":884,"children":886},{"className":885},[],[887],{"type":49,"value":888},"edit_file",{"type":49,"value":890},"\n— use a single ",{"type":43,"tag":58,"props":892,"children":894},{"className":893},[],[895],{"type":49,"value":896},"shell",{"type":49,"value":898}," call with ",{"type":43,"tag":58,"props":900,"children":902},{"className":901},[],[903],{"type":49,"value":904},"echo \"...\" > query.esql && node ... --query-file query.esql",{"type":49,"value":906},".",{"type":43,"tag":857,"props":908,"children":909},{},[910],{"type":49,"value":911},"Keep context gathering focused: run 2-4 targeted queries (process tree, network, related alerts), not 10+.",{"type":43,"tag":857,"props":913,"children":914},{},[915],{"type":49,"value":916},"Report only what tools return. Copy identifiers verbatim — do not paraphrase IDs, timestamps, or hostnames.",{"type":43,"tag":67,"props":918,"children":920},{"id":919},"critical-principles",[921],{"type":49,"value":922},"Critical principles",{"type":43,"tag":853,"props":924,"children":925},{},[926,936,946,956,966],{"type":43,"tag":857,"props":927,"children":928},{},[929,934],{"type":43,"tag":732,"props":930,"children":931},{},[932],{"type":49,"value":933},"Do NOT classify prematurely.",{"type":49,"value":935}," Gather ALL context before deciding benign\u002Funknown\u002Fmalicious.",{"type":43,"tag":857,"props":937,"children":938},{},[939,944],{"type":43,"tag":732,"props":940,"children":941},{},[942],{"type":49,"value":943},"Most alerts are false positives",{"type":49,"value":945},", even if they look alarming. Rule names like \"Malicious Behavior\" or severity\n\"critical\" are NOT evidence.",{"type":43,"tag":857,"props":947,"children":948},{},[949,954],{"type":43,"tag":732,"props":950,"children":951},{},[952],{"type":49,"value":953},"\"Unknown\" is acceptable",{"type":49,"value":955}," and often correct when evidence is insufficient.",{"type":43,"tag":857,"props":957,"children":958},{},[959,964],{"type":43,"tag":732,"props":960,"children":961},{},[962],{"type":49,"value":963},"MALICIOUS requires strong corroborating evidence",{"type":49,"value":965},": persistence + C2, credential theft, lateral movement — not only\nsuspicious API calls.",{"type":43,"tag":857,"props":967,"children":968},{},[969,974],{"type":43,"tag":732,"props":970,"children":971},{},[972],{"type":49,"value":973},"Report tool output verbatim.",{"type":49,"value":975}," Copy IDs, hostnames, timestamps, and counts exactly as returned by tools. Do not\nround numbers, abbreviate IDs, or paraphrase error messages.",{"type":43,"tag":67,"props":977,"children":979},{"id":978},"workflow",[980],{"type":49,"value":981},"Workflow",{"type":43,"tag":52,"props":983,"children":984},{},[985,987,992],{"type":49,"value":986},"When triaging multiple alerts, ",{"type":43,"tag":732,"props":988,"children":989},{},[990],{"type":49,"value":991},"group first, then triage each group",{"type":49,"value":993},":",{"type":43,"tag":87,"props":995,"children":999},{"className":996,"code":998,"language":49,"meta":92},[997],"language-text","- [ ] Step 0: Group alerts by agent\u002Fhost and time window\n- [ ] Step 1: Check existing cases\n- [ ] Step 2: Gather full context (DO NOT SKIP)\n- [ ] Step 3: Create or update case (only AFTER context gathered)\n- [ ] Step 4: Acknowledge alert and all related alerts\n- [ ] Step 5: Fetch next alert group and repeat\n",[1000],{"type":43,"tag":58,"props":1001,"children":1002},{"__ignoreMap":92},[1003],{"type":49,"value":998},{"type":43,"tag":1005,"props":1006,"children":1008},"h3",{"id":1007},"step-0-group-alerts-before-triaging",[1009],{"type":49,"value":1010},"Step 0: Group alerts before triaging",{"type":43,"tag":52,"props":1012,"children":1013},{},[1014,1016,1021,1023,1029],{"type":49,"value":1015},"When the user asks about multiple open alerts, ",{"type":43,"tag":732,"props":1017,"children":1018},{},[1019],{"type":49,"value":1020},"group them first",{"type":49,"value":1022}," to avoid redundant investigation: query open alerts,\ngroup by ",{"type":43,"tag":58,"props":1024,"children":1026},{"className":1025},[],[1027],{"type":49,"value":1028},"agent.id",{"type":49,"value":1030},", sub-group by time window (~5 min = likely one incident), triage each group as a single unit.",{"type":43,"tag":52,"props":1032,"children":1033},{},[1034],{"type":49,"value":1035},"Use ES|QL for an overview (write to file first for PowerShell):",{"type":43,"tag":87,"props":1037,"children":1041},{"className":1038,"code":1039,"language":1040,"meta":92,"style":92},"language-esql shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","FROM .alerts-security.alerts-*\n| WHERE kibana.alert.workflow_status == \"open\" AND @timestamp >= \"\u003Cstart>\"\n| STATS alert_count=COUNT(*), rules=VALUES(kibana.alert.rule.name) BY agent.id\n| SORT alert_count DESC\n","esql",[1042],{"type":43,"tag":58,"props":1043,"children":1044},{"__ignoreMap":92},[1045,1053,1061,1069],{"type":43,"tag":98,"props":1046,"children":1047},{"class":100,"line":101},[1048],{"type":43,"tag":98,"props":1049,"children":1050},{},[1051],{"type":49,"value":1052},"FROM .alerts-security.alerts-*\n",{"type":43,"tag":98,"props":1054,"children":1055},{"class":100,"line":189},[1056],{"type":43,"tag":98,"props":1057,"children":1058},{},[1059],{"type":49,"value":1060},"| WHERE kibana.alert.workflow_status == \"open\" AND @timestamp >= \"\u003Cstart>\"\n",{"type":43,"tag":98,"props":1062,"children":1063},{"class":100,"line":219},[1064],{"type":43,"tag":98,"props":1065,"children":1066},{},[1067],{"type":49,"value":1068},"| STATS alert_count=COUNT(*), rules=VALUES(kibana.alert.rule.name) BY agent.id\n",{"type":43,"tag":98,"props":1070,"children":1071},{"class":100,"line":249},[1072],{"type":43,"tag":98,"props":1073,"children":1074},{},[1075],{"type":49,"value":1076},"| SORT alert_count DESC\n",{"type":43,"tag":52,"props":1078,"children":1079},{},[1080,1082,1088],{"type":49,"value":1081},"For full query templates, see ",{"type":43,"tag":1083,"props":1084,"children":1086},"a",{"href":1085},"references\u002Fclassification-guide.md",[1087],{"type":49,"value":1085},{"type":49,"value":906},{"type":43,"tag":1005,"props":1090,"children":1092},{"id":1091},"step-1-check-existing-cases",[1093],{"type":49,"value":1094},"Step 1: Check existing cases",{"type":43,"tag":52,"props":1096,"children":1097},{},[1098,1100,1105],{"type":49,"value":1099},"Before creating a new case, check if this alert belongs to an existing one. Use the ",{"type":43,"tag":58,"props":1101,"children":1103},{"className":1102},[],[1104],{"type":49,"value":63},{"type":49,"value":1106}," skill:",{"type":43,"tag":87,"props":1108,"children":1110},{"className":89,"code":1109,"language":91,"meta":92,"style":92},"node skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js find --tags \"agent_id:\u003Cagent_id>\"\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js cases-for-alert --alert-id \u003Calert_id>\n",[1111],{"type":43,"tag":58,"props":1112,"children":1113},{"__ignoreMap":92},[1114,1146],{"type":43,"tag":98,"props":1115,"children":1116},{"class":100,"line":101},[1117,1121,1125,1129,1133,1137,1142],{"type":43,"tag":98,"props":1118,"children":1119},{"style":123},[1120],{"type":49,"value":302},{"type":43,"tag":98,"props":1122,"children":1123},{"style":111},[1124],{"type":49,"value":319},{"type":43,"tag":98,"props":1126,"children":1127},{"style":111},[1128],{"type":49,"value":324},{"type":43,"tag":98,"props":1130,"children":1131},{"style":111},[1132],{"type":49,"value":329},{"type":43,"tag":98,"props":1134,"children":1135},{"style":117},[1136],{"type":49,"value":334},{"type":43,"tag":98,"props":1138,"children":1139},{"style":111},[1140],{"type":49,"value":1141},"agent_id:\u003Cagent_id>",{"type":43,"tag":98,"props":1143,"children":1144},{"style":117},[1145],{"type":49,"value":186},{"type":43,"tag":98,"props":1147,"children":1148},{"class":100,"line":189},[1149,1153,1157,1162,1166,1170,1175,1179],{"type":43,"tag":98,"props":1150,"children":1151},{"style":123},[1152],{"type":49,"value":302},{"type":43,"tag":98,"props":1154,"children":1155},{"style":111},[1156],{"type":49,"value":319},{"type":43,"tag":98,"props":1158,"children":1159},{"style":111},[1160],{"type":49,"value":1161}," cases-for-alert",{"type":43,"tag":98,"props":1163,"children":1164},{"style":111},[1165],{"type":49,"value":530},{"type":43,"tag":98,"props":1167,"children":1168},{"style":117},[1169],{"type":49,"value":465},{"type":43,"tag":98,"props":1171,"children":1172},{"style":111},[1173],{"type":49,"value":1174},"alert_i",{"type":43,"tag":98,"props":1176,"children":1177},{"style":163},[1178],{"type":49,"value":521},{"type":43,"tag":98,"props":1180,"children":1181},{"style":117},[1182],{"type":49,"value":1183},">\n",{"type":43,"tag":52,"props":1185,"children":1186},{},[1187],{"type":49,"value":1188},"Look for cases with the same agent ID, user, or related detection rule within a similar time window.",{"type":43,"tag":1190,"props":1191,"children":1192},"blockquote",{},[1193],{"type":43,"tag":52,"props":1194,"children":1195},{},[1196,1201,1203,1209,1211,1217,1219,1225],{"type":43,"tag":732,"props":1197,"children":1198},{},[1199],{"type":49,"value":1200},"Note:",{"type":49,"value":1202}," ",{"type":43,"tag":58,"props":1204,"children":1206},{"className":1205},[],[1207],{"type":49,"value":1208},"find --search",{"type":49,"value":1210}," may return 500 errors on Serverless. Use ",{"type":43,"tag":58,"props":1212,"children":1214},{"className":1213},[],[1215],{"type":49,"value":1216},"find --tags",{"type":49,"value":1218}," or ",{"type":43,"tag":58,"props":1220,"children":1222},{"className":1221},[],[1223],{"type":49,"value":1224},"list",{"type":49,"value":1226}," instead.",{"type":43,"tag":1005,"props":1228,"children":1230},{"id":1229},"step-2-gather-context",[1231],{"type":49,"value":1232},"Step 2: Gather context",{"type":43,"tag":52,"props":1234,"children":1235},{},[1236,1241],{"type":43,"tag":732,"props":1237,"children":1238},{},[1239],{"type":49,"value":1240},"This is the most important step. Do not skip or shortcut it.",{"type":49,"value":1242}," Complete ALL substeps before forming any classification\nopinion.",{"type":43,"tag":52,"props":1244,"children":1245},{},[1246,1251,1253,1259,1261,1267],{"type":43,"tag":732,"props":1247,"children":1248},{},[1249],{"type":49,"value":1250},"Time range warning:",{"type":49,"value":1252}," Alerts may be days or weeks old. NEVER use relative time like ",{"type":43,"tag":58,"props":1254,"children":1256},{"className":1255},[],[1257],{"type":49,"value":1258},"NOW() - 1 HOUR",{"type":49,"value":1260},". Extract the\nalert's ",{"type":43,"tag":58,"props":1262,"children":1264},{"className":1263},[],[1265],{"type":49,"value":1266},"@timestamp",{"type":49,"value":1268}," and build queries around that time with +\u002F- 1 hour window.",{"type":43,"tag":52,"props":1270,"children":1271},{},[1272,1277],{"type":43,"tag":732,"props":1273,"children":1274},{},[1275],{"type":49,"value":1276},"Substeps:",{"type":49,"value":1278}," (2a) Related alerts on same agent\u002Fuser; (2b) Rule frequency across env (high = FP-prone); (2c) Entity\ncontext — process tree, network, registry, files; (2d) Behavior investigation — persistence, C2, lateral movement,\ncredential access.",{"type":43,"tag":52,"props":1280,"children":1281},{},[1282,1284,1290,1292,1298],{"type":49,"value":1283},"Example — process tree (use ES|QL with ",{"type":43,"tag":58,"props":1285,"children":1287},{"className":1286},[],[1288],{"type":49,"value":1289},"KEEP",{"type":49,"value":1291},"; avoid ",{"type":43,"tag":58,"props":1293,"children":1295},{"className":1294},[],[1296],{"type":49,"value":1297},"--full",{"type":49,"value":1299}," which produces 10K+ lines):",{"type":43,"tag":87,"props":1301,"children":1303},{"className":1038,"code":1302,"language":1040,"meta":92,"style":92},"FROM logs-endpoint.events.process-*\n| WHERE agent.id == \"\u003Cagent_id>\" AND @timestamp >= \"\u003Calert_time - 5min>\" AND @timestamp \u003C= \"\u003Calert_time + 10min>\"\n  AND process.parent.name IS NOT NULL\n  AND process.name NOT IN (\"svchost.exe\", \"conhost.exe\", \"agentbeat.exe\")\n| KEEP @timestamp, process.name, process.command_line, process.pid, process.parent.name, process.parent.pid\n| SORT @timestamp | LIMIT 80\n",[1304],{"type":43,"tag":58,"props":1305,"children":1306},{"__ignoreMap":92},[1307,1315,1323,1331,1339,1347],{"type":43,"tag":98,"props":1308,"children":1309},{"class":100,"line":101},[1310],{"type":43,"tag":98,"props":1311,"children":1312},{},[1313],{"type":49,"value":1314},"FROM logs-endpoint.events.process-*\n",{"type":43,"tag":98,"props":1316,"children":1317},{"class":100,"line":189},[1318],{"type":43,"tag":98,"props":1319,"children":1320},{},[1321],{"type":49,"value":1322},"| WHERE agent.id == \"\u003Cagent_id>\" AND @timestamp >= \"\u003Calert_time - 5min>\" AND @timestamp \u003C= \"\u003Calert_time + 10min>\"\n",{"type":43,"tag":98,"props":1324,"children":1325},{"class":100,"line":219},[1326],{"type":43,"tag":98,"props":1327,"children":1328},{},[1329],{"type":49,"value":1330},"  AND process.parent.name IS NOT NULL\n",{"type":43,"tag":98,"props":1332,"children":1333},{"class":100,"line":249},[1334],{"type":43,"tag":98,"props":1335,"children":1336},{},[1337],{"type":49,"value":1338},"  AND process.name NOT IN (\"svchost.exe\", \"conhost.exe\", \"agentbeat.exe\")\n",{"type":43,"tag":98,"props":1340,"children":1341},{"class":100,"line":488},[1342],{"type":43,"tag":98,"props":1343,"children":1344},{},[1345],{"type":49,"value":1346},"| KEEP @timestamp, process.name, process.command_line, process.pid, process.parent.name, process.parent.pid\n",{"type":43,"tag":98,"props":1348,"children":1349},{"class":100,"line":616},[1350],{"type":43,"tag":98,"props":1351,"children":1352},{},[1353],{"type":49,"value":1354},"| SORT @timestamp | LIMIT 80\n",{"type":43,"tag":698,"props":1356,"children":1357},{},[1358,1374],{"type":43,"tag":702,"props":1359,"children":1360},{},[1361],{"type":43,"tag":706,"props":1362,"children":1363},{},[1364,1369],{"type":43,"tag":710,"props":1365,"children":1366},{},[1367],{"type":49,"value":1368},"Data type",{"type":43,"tag":710,"props":1370,"children":1371},{},[1372],{"type":49,"value":1373},"Index pattern",{"type":43,"tag":721,"props":1375,"children":1376},{},[1377,1394,1411,1428],{"type":43,"tag":706,"props":1378,"children":1379},{},[1380,1385],{"type":43,"tag":728,"props":1381,"children":1382},{},[1383],{"type":49,"value":1384},"Alerts",{"type":43,"tag":728,"props":1386,"children":1387},{},[1388],{"type":43,"tag":58,"props":1389,"children":1391},{"className":1390},[],[1392],{"type":49,"value":1393},".alerts-security.alerts-*",{"type":43,"tag":706,"props":1395,"children":1396},{},[1397,1402],{"type":43,"tag":728,"props":1398,"children":1399},{},[1400],{"type":49,"value":1401},"Processes",{"type":43,"tag":728,"props":1403,"children":1404},{},[1405],{"type":43,"tag":58,"props":1406,"children":1408},{"className":1407},[],[1409],{"type":49,"value":1410},"logs-endpoint.events.process-*",{"type":43,"tag":706,"props":1412,"children":1413},{},[1414,1419],{"type":43,"tag":728,"props":1415,"children":1416},{},[1417],{"type":49,"value":1418},"Network",{"type":43,"tag":728,"props":1420,"children":1421},{},[1422],{"type":43,"tag":58,"props":1423,"children":1425},{"className":1424},[],[1426],{"type":49,"value":1427},"logs-endpoint.events.network-*",{"type":43,"tag":706,"props":1429,"children":1430},{},[1431,1436],{"type":43,"tag":728,"props":1432,"children":1433},{},[1434],{"type":49,"value":1435},"Logs",{"type":43,"tag":728,"props":1437,"children":1438},{},[1439],{"type":43,"tag":58,"props":1440,"children":1442},{"className":1441},[],[1443],{"type":49,"value":1444},"logs-*",{"type":43,"tag":52,"props":1446,"children":1447},{},[1448,1450,1454],{"type":49,"value":1449},"For full query templates and classification criteria, see\n",{"type":43,"tag":1083,"props":1451,"children":1452},{"href":1085},[1453],{"type":49,"value":1085},{"type":49,"value":906},{"type":43,"tag":1005,"props":1456,"children":1458},{"id":1457},"step-3-create-or-update-case",[1459],{"type":49,"value":1460},"Step 3: Create or update case",{"type":43,"tag":52,"props":1462,"children":1463},{},[1464,1466,1472,1474,1480],{"type":49,"value":1465},"After gathering context, create a case and attach alert(s). Use ",{"type":43,"tag":58,"props":1467,"children":1469},{"className":1468},[],[1470],{"type":49,"value":1471},"--rule-id",{"type":49,"value":1473}," and ",{"type":43,"tag":58,"props":1475,"children":1477},{"className":1476},[],[1478],{"type":49,"value":1479},"--rule-name",{"type":49,"value":1481}," (required; 400 error\nwithout them):",{"type":43,"tag":87,"props":1483,"children":1485},{"className":89,"code":1484,"language":91,"meta":92,"style":92},"node skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js create \\\n  --title \"\u003Cconcise summary>\" \\\n  --description \"\u003Cfindings, IOCs, attack chain, MITRE techniques>\" \\\n  --tags \"classification:\u003Cbenign|unknown|malicious>\" \"confidence:\u003C0-100>\" \"mitre:\u003Ctechnique>\" \"agent_id:\u003Cid>\" \\\n  --severity \u003Clow|medium|high|critical>\n\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js attach-alert \\\n  --case-id \u003Ccase_id> --alert-id \u003Calert_id> --alert-index \u003Cindex> \\\n  --rule-id \u003Crule_uuid> --rule-name \"\u003Crule name>\"\n\n# Multiple alerts: attach-alerts --alert-ids \u003Cid1> \u003Cid2>\n# Add notes: add-comment --case-id \u003Cid> --comment \"Findings...\"\n",[1486],{"type":43,"tag":58,"props":1487,"children":1488},{"__ignoreMap":92},[1489,1509,1534,1559,1622,1671,1680,1700,1770,1813,1821,1831],{"type":43,"tag":98,"props":1490,"children":1491},{"class":100,"line":101},[1492,1496,1500,1504],{"type":43,"tag":98,"props":1493,"children":1494},{"style":123},[1495],{"type":49,"value":302},{"type":43,"tag":98,"props":1497,"children":1498},{"style":111},[1499],{"type":49,"value":319},{"type":43,"tag":98,"props":1501,"children":1502},{"style":111},[1503],{"type":49,"value":391},{"type":43,"tag":98,"props":1505,"children":1506},{"style":163},[1507],{"type":49,"value":1508}," \\\n",{"type":43,"tag":98,"props":1510,"children":1511},{"class":100,"line":189},[1512,1517,1521,1526,1530],{"type":43,"tag":98,"props":1513,"children":1514},{"style":111},[1515],{"type":49,"value":1516},"  --title",{"type":43,"tag":98,"props":1518,"children":1519},{"style":117},[1520],{"type":49,"value":334},{"type":43,"tag":98,"props":1522,"children":1523},{"style":111},[1524],{"type":49,"value":1525},"\u003Cconcise summary>",{"type":43,"tag":98,"props":1527,"children":1528},{"style":117},[1529],{"type":49,"value":176},{"type":43,"tag":98,"props":1531,"children":1532},{"style":163},[1533],{"type":49,"value":1508},{"type":43,"tag":98,"props":1535,"children":1536},{"class":100,"line":219},[1537,1542,1546,1551,1555],{"type":43,"tag":98,"props":1538,"children":1539},{"style":111},[1540],{"type":49,"value":1541},"  --description",{"type":43,"tag":98,"props":1543,"children":1544},{"style":117},[1545],{"type":49,"value":334},{"type":43,"tag":98,"props":1547,"children":1548},{"style":111},[1549],{"type":49,"value":1550},"\u003Cfindings, IOCs, attack chain, MITRE techniques>",{"type":43,"tag":98,"props":1552,"children":1553},{"style":117},[1554],{"type":49,"value":176},{"type":43,"tag":98,"props":1556,"children":1557},{"style":163},[1558],{"type":49,"value":1508},{"type":43,"tag":98,"props":1560,"children":1561},{"class":100,"line":249},[1562,1567,1571,1576,1580,1584,1589,1593,1597,1602,1606,1610,1614,1618],{"type":43,"tag":98,"props":1563,"children":1564},{"style":111},[1565],{"type":49,"value":1566},"  --tags",{"type":43,"tag":98,"props":1568,"children":1569},{"style":117},[1570],{"type":49,"value":334},{"type":43,"tag":98,"props":1572,"children":1573},{"style":111},[1574],{"type":49,"value":1575},"classification:\u003Cbenign|unknown|malicious>",{"type":43,"tag":98,"props":1577,"children":1578},{"style":117},[1579],{"type":49,"value":176},{"type":43,"tag":98,"props":1581,"children":1582},{"style":117},[1583],{"type":49,"value":334},{"type":43,"tag":98,"props":1585,"children":1586},{"style":111},[1587],{"type":49,"value":1588},"confidence:\u003C0-100>",{"type":43,"tag":98,"props":1590,"children":1591},{"style":117},[1592],{"type":49,"value":176},{"type":43,"tag":98,"props":1594,"children":1595},{"style":117},[1596],{"type":49,"value":334},{"type":43,"tag":98,"props":1598,"children":1599},{"style":111},[1600],{"type":49,"value":1601},"mitre:\u003Ctechnique>",{"type":43,"tag":98,"props":1603,"children":1604},{"style":117},[1605],{"type":49,"value":176},{"type":43,"tag":98,"props":1607,"children":1608},{"style":117},[1609],{"type":49,"value":334},{"type":43,"tag":98,"props":1611,"children":1612},{"style":111},[1613],{"type":49,"value":339},{"type":43,"tag":98,"props":1615,"children":1616},{"style":117},[1617],{"type":49,"value":176},{"type":43,"tag":98,"props":1619,"children":1620},{"style":163},[1621],{"type":49,"value":1508},{"type":43,"tag":98,"props":1623,"children":1624},{"class":100,"line":488},[1625,1630,1634,1639,1644,1649,1653,1658,1662,1667],{"type":43,"tag":98,"props":1626,"children":1627},{"style":111},[1628],{"type":49,"value":1629},"  --severity",{"type":43,"tag":98,"props":1631,"children":1632},{"style":117},[1633],{"type":49,"value":465},{"type":43,"tag":98,"props":1635,"children":1636},{"style":111},[1637],{"type":49,"value":1638},"low",{"type":43,"tag":98,"props":1640,"children":1641},{"style":117},[1642],{"type":49,"value":1643},"|",{"type":43,"tag":98,"props":1645,"children":1646},{"style":123},[1647],{"type":49,"value":1648},"medium",{"type":43,"tag":98,"props":1650,"children":1651},{"style":117},[1652],{"type":49,"value":1643},{"type":43,"tag":98,"props":1654,"children":1655},{"style":123},[1656],{"type":49,"value":1657},"high",{"type":43,"tag":98,"props":1659,"children":1660},{"style":117},[1661],{"type":49,"value":1643},{"type":43,"tag":98,"props":1663,"children":1664},{"style":123},[1665],{"type":49,"value":1666},"critical",{"type":43,"tag":98,"props":1668,"children":1669},{"style":163},[1670],{"type":49,"value":1183},{"type":43,"tag":98,"props":1672,"children":1673},{"class":100,"line":616},[1674],{"type":43,"tag":98,"props":1675,"children":1677},{"emptyLinePlaceholder":1676},true,[1678],{"type":49,"value":1679},"\n",{"type":43,"tag":98,"props":1681,"children":1683},{"class":100,"line":1682},7,[1684,1688,1692,1696],{"type":43,"tag":98,"props":1685,"children":1686},{"style":123},[1687],{"type":49,"value":302},{"type":43,"tag":98,"props":1689,"children":1690},{"style":111},[1691],{"type":49,"value":319},{"type":43,"tag":98,"props":1693,"children":1694},{"style":111},[1695],{"type":49,"value":502},{"type":43,"tag":98,"props":1697,"children":1698},{"style":163},[1699],{"type":49,"value":1508},{"type":43,"tag":98,"props":1701,"children":1703},{"class":100,"line":1702},8,[1704,1709,1713,1718,1722,1726,1730,1734,1738,1742,1746,1750,1754,1758,1762,1766],{"type":43,"tag":98,"props":1705,"children":1706},{"style":111},[1707],{"type":49,"value":1708},"  --case-id",{"type":43,"tag":98,"props":1710,"children":1711},{"style":117},[1712],{"type":49,"value":465},{"type":43,"tag":98,"props":1714,"children":1715},{"style":111},[1716],{"type":49,"value":1717},"case_i",{"type":43,"tag":98,"props":1719,"children":1720},{"style":163},[1721],{"type":49,"value":521},{"type":43,"tag":98,"props":1723,"children":1724},{"style":117},[1725],{"type":49,"value":480},{"type":43,"tag":98,"props":1727,"children":1728},{"style":111},[1729],{"type":49,"value":530},{"type":43,"tag":98,"props":1731,"children":1732},{"style":117},[1733],{"type":49,"value":465},{"type":43,"tag":98,"props":1735,"children":1736},{"style":111},[1737],{"type":49,"value":1174},{"type":43,"tag":98,"props":1739,"children":1740},{"style":163},[1741],{"type":49,"value":521},{"type":43,"tag":98,"props":1743,"children":1744},{"style":117},[1745],{"type":49,"value":480},{"type":43,"tag":98,"props":1747,"children":1748},{"style":111},[1749],{"type":49,"value":551},{"type":43,"tag":98,"props":1751,"children":1752},{"style":117},[1753],{"type":49,"value":465},{"type":43,"tag":98,"props":1755,"children":1756},{"style":111},[1757],{"type":49,"value":560},{"type":43,"tag":98,"props":1759,"children":1760},{"style":163},[1761],{"type":49,"value":565},{"type":43,"tag":98,"props":1763,"children":1764},{"style":117},[1765],{"type":49,"value":480},{"type":43,"tag":98,"props":1767,"children":1768},{"style":163},[1769],{"type":49,"value":1508},{"type":43,"tag":98,"props":1771,"children":1773},{"class":100,"line":1772},9,[1774,1779,1783,1788,1792,1796,1800,1804,1809],{"type":43,"tag":98,"props":1775,"children":1776},{"style":111},[1777],{"type":49,"value":1778},"  --rule-id",{"type":43,"tag":98,"props":1780,"children":1781},{"style":117},[1782],{"type":49,"value":465},{"type":43,"tag":98,"props":1784,"children":1785},{"style":111},[1786],{"type":49,"value":1787},"rule_uui",{"type":43,"tag":98,"props":1789,"children":1790},{"style":163},[1791],{"type":49,"value":521},{"type":43,"tag":98,"props":1793,"children":1794},{"style":117},[1795],{"type":49,"value":480},{"type":43,"tag":98,"props":1797,"children":1798},{"style":111},[1799],{"type":49,"value":596},{"type":43,"tag":98,"props":1801,"children":1802},{"style":117},[1803],{"type":49,"value":334},{"type":43,"tag":98,"props":1805,"children":1806},{"style":111},[1807],{"type":49,"value":1808},"\u003Crule name>",{"type":43,"tag":98,"props":1810,"children":1811},{"style":117},[1812],{"type":49,"value":186},{"type":43,"tag":98,"props":1814,"children":1816},{"class":100,"line":1815},10,[1817],{"type":43,"tag":98,"props":1818,"children":1819},{"emptyLinePlaceholder":1676},[1820],{"type":49,"value":1679},{"type":43,"tag":98,"props":1822,"children":1824},{"class":100,"line":1823},11,[1825],{"type":43,"tag":98,"props":1826,"children":1828},{"style":1827},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1829],{"type":49,"value":1830},"# Multiple alerts: attach-alerts --alert-ids \u003Cid1> \u003Cid2>\n",{"type":43,"tag":98,"props":1832,"children":1834},{"class":100,"line":1833},12,[1835],{"type":43,"tag":98,"props":1836,"children":1837},{"style":1827},[1838],{"type":49,"value":1839},"# Add notes: add-comment --case-id \u003Cid> --comment \"Findings...\"\n",{"type":43,"tag":52,"props":1841,"children":1842},{},[1843,1848],{"type":43,"tag":732,"props":1844,"children":1845},{},[1846],{"type":49,"value":1847},"Case description:",{"type":49,"value":1849}," Summary (1-2 sentences); Attack chain; IOCs (hashes, IPs, paths); MITRE techniques; Behavioral\nfindings; Response context (remediation, credentials at risk).",{"type":43,"tag":1005,"props":1851,"children":1853},{"id":1852},"step-4-acknowledge-alerts",[1854],{"type":49,"value":1855},"Step 4: Acknowledge alerts",{"type":43,"tag":52,"props":1857,"children":1858},{},[1859,1861,1867],{"type":49,"value":1860},"Acknowledge ALL related alerts together. Use ",{"type":43,"tag":58,"props":1862,"children":1864},{"className":1863},[],[1865],{"type":49,"value":1866},"--dry-run",{"type":49,"value":1868}," first to confirm scope, then run without it:",{"type":43,"tag":87,"props":1870,"children":1872},{"className":89,"code":1871,"language":91,"meta":92,"style":92},"# By host name — preferred when triaging a host\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Facknowledge-alert.js --query --host \u003Chostname> --dry-run\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Facknowledge-alert.js --query --host \u003Chostname> --yes\n\n# By agent ID — preferred when agent.id is known\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Facknowledge-alert.js --related --agent \u003Cid> --timestamp \u003Cts> --window 60 --dry-run\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Facknowledge-alert.js --related --agent \u003Cid> --timestamp \u003Cts> --window 60 --yes\n",[1873],{"type":43,"tag":58,"props":1874,"children":1875},{"__ignoreMap":92},[1876,1884,1928,1967,1974,1982,2049],{"type":43,"tag":98,"props":1877,"children":1878},{"class":100,"line":101},[1879],{"type":43,"tag":98,"props":1880,"children":1881},{"style":1827},[1882],{"type":49,"value":1883},"# By host name — preferred when triaging a host\n",{"type":43,"tag":98,"props":1885,"children":1886},{"class":100,"line":189},[1887,1891,1895,1900,1905,1909,1914,1919,1923],{"type":43,"tag":98,"props":1888,"children":1889},{"style":123},[1890],{"type":49,"value":302},{"type":43,"tag":98,"props":1892,"children":1893},{"style":111},[1894],{"type":49,"value":626},{"type":43,"tag":98,"props":1896,"children":1897},{"style":111},[1898],{"type":49,"value":1899}," --query",{"type":43,"tag":98,"props":1901,"children":1902},{"style":111},[1903],{"type":49,"value":1904}," --host",{"type":43,"tag":98,"props":1906,"children":1907},{"style":117},[1908],{"type":49,"value":465},{"type":43,"tag":98,"props":1910,"children":1911},{"style":111},[1912],{"type":49,"value":1913},"hostnam",{"type":43,"tag":98,"props":1915,"children":1916},{"style":163},[1917],{"type":49,"value":1918},"e",{"type":43,"tag":98,"props":1920,"children":1921},{"style":117},[1922],{"type":49,"value":480},{"type":43,"tag":98,"props":1924,"children":1925},{"style":111},[1926],{"type":49,"value":1927}," --dry-run\n",{"type":43,"tag":98,"props":1929,"children":1930},{"class":100,"line":219},[1931,1935,1939,1943,1947,1951,1955,1959,1963],{"type":43,"tag":98,"props":1932,"children":1933},{"style":123},[1934],{"type":49,"value":302},{"type":43,"tag":98,"props":1936,"children":1937},{"style":111},[1938],{"type":49,"value":626},{"type":43,"tag":98,"props":1940,"children":1941},{"style":111},[1942],{"type":49,"value":1899},{"type":43,"tag":98,"props":1944,"children":1945},{"style":111},[1946],{"type":49,"value":1904},{"type":43,"tag":98,"props":1948,"children":1949},{"style":117},[1950],{"type":49,"value":465},{"type":43,"tag":98,"props":1952,"children":1953},{"style":111},[1954],{"type":49,"value":1913},{"type":43,"tag":98,"props":1956,"children":1957},{"style":163},[1958],{"type":49,"value":1918},{"type":43,"tag":98,"props":1960,"children":1961},{"style":117},[1962],{"type":49,"value":480},{"type":43,"tag":98,"props":1964,"children":1965},{"style":111},[1966],{"type":49,"value":485},{"type":43,"tag":98,"props":1968,"children":1969},{"class":100,"line":249},[1970],{"type":43,"tag":98,"props":1971,"children":1972},{"emptyLinePlaceholder":1676},[1973],{"type":49,"value":1679},{"type":43,"tag":98,"props":1975,"children":1976},{"class":100,"line":488},[1977],{"type":43,"tag":98,"props":1978,"children":1979},{"style":1827},[1980],{"type":49,"value":1981},"# By agent ID — preferred when agent.id is known\n",{"type":43,"tag":98,"props":1983,"children":1984},{"class":100,"line":616},[1985,1989,1993,1997,2001,2005,2009,2013,2017,2021,2025,2029,2033,2037,2041,2045],{"type":43,"tag":98,"props":1986,"children":1987},{"style":123},[1988],{"type":49,"value":302},{"type":43,"tag":98,"props":1990,"children":1991},{"style":111},[1992],{"type":49,"value":626},{"type":43,"tag":98,"props":1994,"children":1995},{"style":111},[1996],{"type":49,"value":631},{"type":43,"tag":98,"props":1998,"children":1999},{"style":111},[2000],{"type":49,"value":636},{"type":43,"tag":98,"props":2002,"children":2003},{"style":117},[2004],{"type":49,"value":465},{"type":43,"tag":98,"props":2006,"children":2007},{"style":111},[2008],{"type":49,"value":516},{"type":43,"tag":98,"props":2010,"children":2011},{"style":163},[2012],{"type":49,"value":521},{"type":43,"tag":98,"props":2014,"children":2015},{"style":117},[2016],{"type":49,"value":480},{"type":43,"tag":98,"props":2018,"children":2019},{"style":111},[2020],{"type":49,"value":657},{"type":43,"tag":98,"props":2022,"children":2023},{"style":117},[2024],{"type":49,"value":465},{"type":43,"tag":98,"props":2026,"children":2027},{"style":111},[2028],{"type":49,"value":666},{"type":43,"tag":98,"props":2030,"children":2031},{"style":163},[2032],{"type":49,"value":671},{"type":43,"tag":98,"props":2034,"children":2035},{"style":117},[2036],{"type":49,"value":480},{"type":43,"tag":98,"props":2038,"children":2039},{"style":111},[2040],{"type":49,"value":680},{"type":43,"tag":98,"props":2042,"children":2043},{"style":683},[2044],{"type":49,"value":686},{"type":43,"tag":98,"props":2046,"children":2047},{"style":111},[2048],{"type":49,"value":1927},{"type":43,"tag":98,"props":2050,"children":2051},{"class":100,"line":1682},[2052,2056,2060,2064,2068,2072,2076,2080,2084,2088,2092,2096,2100,2104,2108,2112],{"type":43,"tag":98,"props":2053,"children":2054},{"style":123},[2055],{"type":49,"value":302},{"type":43,"tag":98,"props":2057,"children":2058},{"style":111},[2059],{"type":49,"value":626},{"type":43,"tag":98,"props":2061,"children":2062},{"style":111},[2063],{"type":49,"value":631},{"type":43,"tag":98,"props":2065,"children":2066},{"style":111},[2067],{"type":49,"value":636},{"type":43,"tag":98,"props":2069,"children":2070},{"style":117},[2071],{"type":49,"value":465},{"type":43,"tag":98,"props":2073,"children":2074},{"style":111},[2075],{"type":49,"value":516},{"type":43,"tag":98,"props":2077,"children":2078},{"style":163},[2079],{"type":49,"value":521},{"type":43,"tag":98,"props":2081,"children":2082},{"style":117},[2083],{"type":49,"value":480},{"type":43,"tag":98,"props":2085,"children":2086},{"style":111},[2087],{"type":49,"value":657},{"type":43,"tag":98,"props":2089,"children":2090},{"style":117},[2091],{"type":49,"value":465},{"type":43,"tag":98,"props":2093,"children":2094},{"style":111},[2095],{"type":49,"value":666},{"type":43,"tag":98,"props":2097,"children":2098},{"style":163},[2099],{"type":49,"value":671},{"type":43,"tag":98,"props":2101,"children":2102},{"style":117},[2103],{"type":49,"value":480},{"type":43,"tag":98,"props":2105,"children":2106},{"style":111},[2107],{"type":49,"value":680},{"type":43,"tag":98,"props":2109,"children":2110},{"style":683},[2111],{"type":49,"value":686},{"type":43,"tag":98,"props":2113,"children":2114},{"style":111},[2115],{"type":49,"value":485},{"type":43,"tag":52,"props":2117,"children":2118},{},[2119,2121,2127,2129,2135,2137,2143],{"type":49,"value":2120},"Increase ",{"type":43,"tag":58,"props":2122,"children":2124},{"className":2123},[],[2125],{"type":49,"value":2126},"--window",{"type":49,"value":2128}," for longer attack chains (e.g., ",{"type":43,"tag":58,"props":2130,"children":2132},{"className":2131},[],[2133],{"type":49,"value":2134},"300",{"type":49,"value":2136}," for 5 minutes). Report the exact count of acknowledged alerts\nfrom the tool output. Pass ",{"type":43,"tag":58,"props":2138,"children":2140},{"className":2139},[],[2141],{"type":49,"value":2142},"--yes",{"type":49,"value":2144}," to skip the confirmation prompt (required when called by an agent).",{"type":43,"tag":1005,"props":2146,"children":2148},{"id":2147},"step-5-repeat",[2149],{"type":49,"value":2150},"Step 5: Repeat",{"type":43,"tag":87,"props":2152,"children":2154},{"className":89,"code":2153,"language":91,"meta":92,"style":92},"node skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Ffetch-next-alert.js\n",[2155],{"type":43,"tag":58,"props":2156,"children":2157},{"__ignoreMap":92},[2158],{"type":43,"tag":98,"props":2159,"children":2160},{"class":100,"line":101},[2161,2165],{"type":43,"tag":98,"props":2162,"children":2163},{"style":123},[2164],{"type":49,"value":302},{"type":43,"tag":98,"props":2166,"children":2167},{"style":111},[2168],{"type":49,"value":307},{"type":43,"tag":67,"props":2170,"children":2172},{"id":2171},"tool-reference",[2173],{"type":49,"value":2174},"Tool reference",{"type":43,"tag":1005,"props":2176,"children":2178},{"id":2177},"fetch-next-alertjs",[2179],{"type":49,"value":2180},"fetch-next-alert.js",{"type":43,"tag":52,"props":2182,"children":2183},{},[2184],{"type":49,"value":2185},"Fetches the oldest unacknowledged Elastic Security alert.",{"type":43,"tag":87,"props":2187,"children":2189},{"className":89,"code":2188,"language":91,"meta":92,"style":92},"node skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Ffetch-next-alert.js [--days \u003Cn>] [--json] [--full] [--verbose]\n",[2190],{"type":43,"tag":58,"props":2191,"children":2192},{"__ignoreMap":92},[2193],{"type":43,"tag":98,"props":2194,"children":2195},{"class":100,"line":101},[2196,2200,2205,2210,2215,2220,2224,2229,2234,2239,2243,2247,2252,2257],{"type":43,"tag":98,"props":2197,"children":2198},{"style":123},[2199],{"type":49,"value":302},{"type":43,"tag":98,"props":2201,"children":2202},{"style":111},[2203],{"type":49,"value":2204}," skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Ffetch-next-alert.js",{"type":43,"tag":98,"props":2206,"children":2207},{"style":163},[2208],{"type":49,"value":2209}," [--days ",{"type":43,"tag":98,"props":2211,"children":2212},{"style":117},[2213],{"type":49,"value":2214},"\u003C",{"type":43,"tag":98,"props":2216,"children":2217},{"style":163},[2218],{"type":49,"value":2219},"n",{"type":43,"tag":98,"props":2221,"children":2222},{"style":117},[2223],{"type":49,"value":480},{"type":43,"tag":98,"props":2225,"children":2226},{"style":111},[2227],{"type":49,"value":2228},"]",{"type":43,"tag":98,"props":2230,"children":2231},{"style":163},[2232],{"type":49,"value":2233}," [--json] ",{"type":43,"tag":98,"props":2235,"children":2236},{"style":117},[2237],{"type":49,"value":2238},"[",{"type":43,"tag":98,"props":2240,"children":2241},{"style":163},[2242],{"type":49,"value":1297},{"type":43,"tag":98,"props":2244,"children":2245},{"style":117},[2246],{"type":49,"value":2228},{"type":43,"tag":98,"props":2248,"children":2249},{"style":117},[2250],{"type":49,"value":2251}," [",{"type":43,"tag":98,"props":2253,"children":2254},{"style":163},[2255],{"type":49,"value":2256},"--verbose",{"type":43,"tag":98,"props":2258,"children":2259},{"style":117},[2260],{"type":49,"value":2261},"]\n",{"type":43,"tag":1005,"props":2263,"children":2265},{"id":2264},"run-queryjs",[2266],{"type":49,"value":2267},"run-query.js",{"type":43,"tag":52,"props":2269,"children":2270},{},[2271],{"type":49,"value":2272},"Runs KQL or ES|QL queries against Elasticsearch.",{"type":43,"tag":52,"props":2274,"children":2275},{},[2276,2281,2283,2288,2290,2295],{"type":43,"tag":732,"props":2277,"children":2278},{},[2279],{"type":49,"value":2280},"PowerShell warning",{"type":49,"value":2282},": ES|QL queries contain pipe characters (",{"type":43,"tag":58,"props":2284,"children":2286},{"className":2285},[],[2287],{"type":49,"value":1643},{"type":49,"value":2289},") which PowerShell interprets as shell pipes. ALWAYS\nuse ",{"type":43,"tag":58,"props":2291,"children":2293},{"className":2292},[],[2294],{"type":49,"value":880},{"type":49,"value":2296}," for ES|QL:",{"type":43,"tag":87,"props":2298,"children":2300},{"className":89,"code":2299,"language":91,"meta":92,"style":92},"# Write query to file, then run\nnode skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Frun-query.js --query-file query.esql --type esql\n",[2301],{"type":43,"tag":58,"props":2302,"children":2303},{"__ignoreMap":92},[2304,2312],{"type":43,"tag":98,"props":2305,"children":2306},{"class":100,"line":101},[2307],{"type":43,"tag":98,"props":2308,"children":2309},{"style":1827},[2310],{"type":49,"value":2311},"# Write query to file, then run\n",{"type":43,"tag":98,"props":2313,"children":2314},{"class":100,"line":189},[2315,2319,2323,2327,2331,2335],{"type":43,"tag":98,"props":2316,"children":2317},{"style":123},[2318],{"type":49,"value":302},{"type":43,"tag":98,"props":2320,"children":2321},{"style":111},[2322],{"type":49,"value":355},{"type":43,"tag":98,"props":2324,"children":2325},{"style":111},[2326],{"type":49,"value":360},{"type":43,"tag":98,"props":2328,"children":2329},{"style":111},[2330],{"type":49,"value":365},{"type":43,"tag":98,"props":2332,"children":2333},{"style":111},[2334],{"type":49,"value":370},{"type":43,"tag":98,"props":2336,"children":2337},{"style":111},[2338],{"type":49,"value":375},{"type":43,"tag":52,"props":2340,"children":2341},{},[2342],{"type":49,"value":2343},"KQL queries without pipes can be passed directly:",{"type":43,"tag":87,"props":2345,"children":2347},{"className":89,"code":2346,"language":91,"meta":92,"style":92},"node skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Frun-query.js \"agent.id:\u003Cid>\" --index \"logs-*\" --days 7\n",[2348],{"type":43,"tag":58,"props":2349,"children":2350},{"__ignoreMap":92},[2351],{"type":43,"tag":98,"props":2352,"children":2353},{"class":100,"line":101},[2354,2358,2362,2366,2371,2375,2380,2384,2388,2392,2397],{"type":43,"tag":98,"props":2355,"children":2356},{"style":123},[2357],{"type":49,"value":302},{"type":43,"tag":98,"props":2359,"children":2360},{"style":111},[2361],{"type":49,"value":355},{"type":43,"tag":98,"props":2363,"children":2364},{"style":117},[2365],{"type":49,"value":334},{"type":43,"tag":98,"props":2367,"children":2368},{"style":111},[2369],{"type":49,"value":2370},"agent.id:\u003Cid>",{"type":43,"tag":98,"props":2372,"children":2373},{"style":117},[2374],{"type":49,"value":176},{"type":43,"tag":98,"props":2376,"children":2377},{"style":111},[2378],{"type":49,"value":2379}," --index",{"type":43,"tag":98,"props":2381,"children":2382},{"style":117},[2383],{"type":49,"value":334},{"type":43,"tag":98,"props":2385,"children":2386},{"style":111},[2387],{"type":49,"value":1444},{"type":43,"tag":98,"props":2389,"children":2390},{"style":117},[2391],{"type":49,"value":176},{"type":43,"tag":98,"props":2393,"children":2394},{"style":111},[2395],{"type":49,"value":2396}," --days",{"type":43,"tag":98,"props":2398,"children":2399},{"style":683},[2400],{"type":49,"value":2401}," 7\n",{"type":43,"tag":698,"props":2403,"children":2404},{},[2405,2421],{"type":43,"tag":702,"props":2406,"children":2407},{},[2408],{"type":43,"tag":706,"props":2409,"children":2410},{},[2411,2416],{"type":43,"tag":710,"props":2412,"children":2413},{},[2414],{"type":49,"value":2415},"Arg",{"type":43,"tag":710,"props":2417,"children":2418},{},[2419],{"type":49,"value":2420},"Description",{"type":43,"tag":721,"props":2422,"children":2423},{},[2424,2441,2465,2501,2532,2556,2580,2597],{"type":43,"tag":706,"props":2425,"children":2426},{},[2427,2436],{"type":43,"tag":728,"props":2428,"children":2429},{},[2430],{"type":43,"tag":58,"props":2431,"children":2433},{"className":2432},[],[2434],{"type":49,"value":2435},"query",{"type":43,"tag":728,"props":2437,"children":2438},{},[2439],{"type":49,"value":2440},"KQL query (positional)",{"type":43,"tag":706,"props":2442,"children":2443},{},[2444,2460],{"type":43,"tag":728,"props":2445,"children":2446},{},[2447,2452,2454],{"type":43,"tag":58,"props":2448,"children":2450},{"className":2449},[],[2451],{"type":49,"value":880},{"type":49,"value":2453},", ",{"type":43,"tag":58,"props":2455,"children":2457},{"className":2456},[],[2458],{"type":49,"value":2459},"-q",{"type":43,"tag":728,"props":2461,"children":2462},{},[2463],{"type":49,"value":2464},"Read query from file (required for ES|QL on PowerShell)",{"type":43,"tag":706,"props":2466,"children":2467},{},[2468,2484],{"type":43,"tag":728,"props":2469,"children":2470},{},[2471,2477,2478],{"type":43,"tag":58,"props":2472,"children":2474},{"className":2473},[],[2475],{"type":49,"value":2476},"--type",{"type":49,"value":2453},{"type":43,"tag":58,"props":2479,"children":2481},{"className":2480},[],[2482],{"type":49,"value":2483},"-t",{"type":43,"tag":728,"props":2485,"children":2486},{},[2487,2493,2494,2499],{"type":43,"tag":58,"props":2488,"children":2490},{"className":2489},[],[2491],{"type":49,"value":2492},"kql",{"type":49,"value":1218},{"type":43,"tag":58,"props":2495,"children":2497},{"className":2496},[],[2498],{"type":49,"value":1040},{"type":49,"value":2500}," (default: kql)",{"type":43,"tag":706,"props":2502,"children":2503},{},[2504,2520],{"type":43,"tag":728,"props":2505,"children":2506},{},[2507,2513,2514],{"type":43,"tag":58,"props":2508,"children":2510},{"className":2509},[],[2511],{"type":49,"value":2512},"--index",{"type":49,"value":2453},{"type":43,"tag":58,"props":2515,"children":2517},{"className":2516},[],[2518],{"type":49,"value":2519},"-i",{"type":43,"tag":728,"props":2521,"children":2522},{},[2523,2525,2530],{"type":49,"value":2524},"Index pattern (default: ",{"type":43,"tag":58,"props":2526,"children":2528},{"className":2527},[],[2529],{"type":49,"value":1444},{"type":49,"value":2531},")",{"type":43,"tag":706,"props":2533,"children":2534},{},[2535,2551],{"type":43,"tag":728,"props":2536,"children":2537},{},[2538,2544,2545],{"type":43,"tag":58,"props":2539,"children":2541},{"className":2540},[],[2542],{"type":49,"value":2543},"--size",{"type":49,"value":2453},{"type":43,"tag":58,"props":2546,"children":2548},{"className":2547},[],[2549],{"type":49,"value":2550},"-s",{"type":43,"tag":728,"props":2552,"children":2553},{},[2554],{"type":49,"value":2555},"Max results (default: 100)",{"type":43,"tag":706,"props":2557,"children":2558},{},[2559,2575],{"type":43,"tag":728,"props":2560,"children":2561},{},[2562,2568,2569],{"type":43,"tag":58,"props":2563,"children":2565},{"className":2564},[],[2566],{"type":49,"value":2567},"--days",{"type":49,"value":2453},{"type":43,"tag":58,"props":2570,"children":2572},{"className":2571},[],[2573],{"type":49,"value":2574},"-d",{"type":43,"tag":728,"props":2576,"children":2577},{},[2578],{"type":49,"value":2579},"Limit to last N days",{"type":43,"tag":706,"props":2581,"children":2582},{},[2583,2592],{"type":43,"tag":728,"props":2584,"children":2585},{},[2586],{"type":43,"tag":58,"props":2587,"children":2589},{"className":2588},[],[2590],{"type":49,"value":2591},"--json",{"type":43,"tag":728,"props":2593,"children":2594},{},[2595],{"type":49,"value":2596},"Raw JSON output",{"type":43,"tag":706,"props":2598,"children":2599},{},[2600,2608],{"type":43,"tag":728,"props":2601,"children":2602},{},[2603],{"type":43,"tag":58,"props":2604,"children":2606},{"className":2605},[],[2607],{"type":49,"value":1297},{"type":43,"tag":728,"props":2609,"children":2610},{},[2611],{"type":49,"value":2612},"Full document source",{"type":43,"tag":1005,"props":2614,"children":2616},{"id":2615},"acknowledge-alertjs",[2617],{"type":49,"value":2618},"acknowledge-alert.js",{"type":43,"tag":52,"props":2620,"children":2621},{},[2622,2624,2630,2632,2638],{"type":49,"value":2623},"Acknowledges alerts by updating ",{"type":43,"tag":58,"props":2625,"children":2627},{"className":2626},[],[2628],{"type":49,"value":2629},"workflow_status",{"type":49,"value":2631}," to ",{"type":43,"tag":58,"props":2633,"children":2635},{"className":2634},[],[2636],{"type":49,"value":2637},"acknowledged",{"type":49,"value":906},{"type":43,"tag":698,"props":2640,"children":2641},{},[2642,2658],{"type":43,"tag":702,"props":2643,"children":2644},{},[2645],{"type":43,"tag":706,"props":2646,"children":2647},{},[2648,2653],{"type":43,"tag":710,"props":2649,"children":2650},{},[2651],{"type":49,"value":2652},"Mode",{"type":43,"tag":710,"props":2654,"children":2655},{},[2656],{"type":49,"value":2657},"Command",{"type":43,"tag":721,"props":2659,"children":2660},{},[2661,2678,2695,2712,2729,2749],{"type":43,"tag":706,"props":2662,"children":2663},{},[2664,2669],{"type":43,"tag":728,"props":2665,"children":2666},{},[2667],{"type":49,"value":2668},"Single",{"type":43,"tag":728,"props":2670,"children":2671},{},[2672],{"type":43,"tag":58,"props":2673,"children":2675},{"className":2674},[],[2676],{"type":49,"value":2677},"node skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Facknowledge-alert.js \u003Calert_id> --index \u003Cindex> --yes",{"type":43,"tag":706,"props":2679,"children":2680},{},[2681,2686],{"type":43,"tag":728,"props":2682,"children":2683},{},[2684],{"type":49,"value":2685},"Related",{"type":43,"tag":728,"props":2687,"children":2688},{},[2689],{"type":43,"tag":58,"props":2690,"children":2692},{"className":2691},[],[2693],{"type":49,"value":2694},"node skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Facknowledge-alert.js --related --agent \u003Cid> --timestamp \u003Cts> [--window 60] --yes",{"type":43,"tag":706,"props":2696,"children":2697},{},[2698,2703],{"type":43,"tag":728,"props":2699,"children":2700},{},[2701],{"type":49,"value":2702},"By host",{"type":43,"tag":728,"props":2704,"children":2705},{},[2706],{"type":43,"tag":58,"props":2707,"children":2709},{"className":2708},[],[2710],{"type":49,"value":2711},"node skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Facknowledge-alert.js --query --host \u003Chostname> [--time-start \u003Cts>] [--time-end \u003Cts>] --yes",{"type":43,"tag":706,"props":2713,"children":2714},{},[2715,2720],{"type":43,"tag":728,"props":2716,"children":2717},{},[2718],{"type":49,"value":2719},"Query",{"type":43,"tag":728,"props":2721,"children":2722},{},[2723],{"type":43,"tag":58,"props":2724,"children":2726},{"className":2725},[],[2727],{"type":49,"value":2728},"node skills\u002Fsecurity\u002Falert-triage\u002Fscripts\u002Facknowledge-alert.js --query --agent \u003Cid> [--time-start \u003Cts>] [--time-end \u003Cts>] --yes",{"type":43,"tag":706,"props":2730,"children":2731},{},[2732,2737],{"type":43,"tag":728,"props":2733,"children":2734},{},[2735],{"type":49,"value":2736},"Dry run",{"type":43,"tag":728,"props":2738,"children":2739},{},[2740,2742,2747],{"type":49,"value":2741},"Add ",{"type":43,"tag":58,"props":2743,"children":2745},{"className":2744},[],[2746],{"type":49,"value":1866},{"type":49,"value":2748}," to any mode (no confirmation needed)",{"type":43,"tag":706,"props":2750,"children":2751},{},[2752,2757],{"type":43,"tag":728,"props":2753,"children":2754},{},[2755],{"type":49,"value":2756},"Confirm",{"type":43,"tag":728,"props":2758,"children":2759},{},[2760,2762,2767],{"type":49,"value":2761},"All write modes prompt for confirmation; pass ",{"type":43,"tag":58,"props":2763,"children":2765},{"className":2764},[],[2766],{"type":49,"value":2142},{"type":49,"value":2768}," to skip",{"type":43,"tag":67,"props":2770,"children":2772},{"id":2771},"examples",[2773],{"type":49,"value":2774},"Examples",{"type":43,"tag":853,"props":2776,"children":2777},{},[2778,2783,2788],{"type":43,"tag":857,"props":2779,"children":2780},{},[2781],{"type":49,"value":2782},"\"Fetch the next unacknowledged alert and triage it\"",{"type":43,"tag":857,"props":2784,"children":2785},{},[2786],{"type":49,"value":2787},"\"Investigate alert ID abc-123 — gather context, classify, and create a case if malicious\"",{"type":43,"tag":857,"props":2789,"children":2790},{},[2791],{"type":49,"value":2792},"\"Process the top 5 critical alerts from the last 24 hours\"",{"type":43,"tag":67,"props":2794,"children":2796},{"id":2795},"guidelines",[2797],{"type":49,"value":2798},"Guidelines",{"type":43,"tag":853,"props":2800,"children":2801},{},[2802,2807,2812,2817],{"type":43,"tag":857,"props":2803,"children":2804},{},[2805],{"type":49,"value":2806},"Report only tool output — do not invent IDs, hostnames, IPs, or details not present in the tool response.",{"type":43,"tag":857,"props":2808,"children":2809},{},[2810],{"type":49,"value":2811},"Preserve identifiers from the request — use exact values the user provides in tool calls and responses.",{"type":43,"tag":857,"props":2813,"children":2814},{},[2815],{"type":49,"value":2816},"Confirm actions concisely using the tool's return data.",{"type":43,"tag":857,"props":2818,"children":2819},{},[2820],{"type":49,"value":2821},"Distinguish facts from inference — label conclusions beyond tool output as your assessment.",{"type":43,"tag":67,"props":2823,"children":2825},{"id":2824},"production-use",[2826],{"type":49,"value":2827},"Production use",{"type":43,"tag":853,"props":2829,"children":2830},{},[2831,2857,2869,2874],{"type":43,"tag":857,"props":2832,"children":2833},{},[2834,2836,2841,2843,2848,2849,2855],{"type":49,"value":2835},"All write operations (",{"type":43,"tag":58,"props":2837,"children":2839},{"className":2838},[],[2840],{"type":49,"value":2618},{"type":49,"value":2842},") prompt for confirmation. Pass ",{"type":43,"tag":58,"props":2844,"children":2846},{"className":2845},[],[2847],{"type":49,"value":2142},{"type":49,"value":1218},{"type":43,"tag":58,"props":2850,"children":2852},{"className":2851},[],[2853],{"type":49,"value":2854},"-y",{"type":49,"value":2856}," to skip when called by an\nagent.",{"type":43,"tag":857,"props":2858,"children":2859},{},[2860,2862,2867],{"type":49,"value":2861},"Use ",{"type":43,"tag":58,"props":2863,"children":2865},{"className":2864},[],[2866],{"type":49,"value":1866},{"type":49,"value":2868}," before bulk acknowledgments to preview scope without modifying data.",{"type":43,"tag":857,"props":2870,"children":2871},{},[2872],{"type":49,"value":2873},"The acknowledge script uses the Kibana Detection Engine API, which is compatible with both self-managed and Serverless\ndeployments.",{"type":43,"tag":857,"props":2875,"children":2876},{},[2877],{"type":49,"value":2878},"Verify environment variables point to the intended cluster before running any script — no undo for acknowledgments.",{"type":43,"tag":67,"props":2880,"children":2882},{"id":2881},"environment-variables",[2883],{"type":49,"value":2884},"Environment variables",{"type":43,"tag":698,"props":2886,"children":2887},{},[2888,2908],{"type":43,"tag":702,"props":2889,"children":2890},{},[2891],{"type":43,"tag":706,"props":2892,"children":2893},{},[2894,2899,2904],{"type":43,"tag":710,"props":2895,"children":2896},{},[2897],{"type":49,"value":2898},"Variable",{"type":43,"tag":710,"props":2900,"children":2901},{},[2902],{"type":49,"value":2903},"Required",{"type":43,"tag":710,"props":2905,"children":2906},{},[2907],{"type":49,"value":2420},{"type":43,"tag":721,"props":2909,"children":2910},{},[2911,2933,2954,2975],{"type":43,"tag":706,"props":2912,"children":2913},{},[2914,2923,2928],{"type":43,"tag":728,"props":2915,"children":2916},{},[2917],{"type":43,"tag":58,"props":2918,"children":2920},{"className":2919},[],[2921],{"type":49,"value":2922},"ELASTICSEARCH_URL",{"type":43,"tag":728,"props":2924,"children":2925},{},[2926],{"type":49,"value":2927},"Yes",{"type":43,"tag":728,"props":2929,"children":2930},{},[2931],{"type":49,"value":2932},"Elasticsearch URL",{"type":43,"tag":706,"props":2934,"children":2935},{},[2936,2945,2949],{"type":43,"tag":728,"props":2937,"children":2938},{},[2939],{"type":43,"tag":58,"props":2940,"children":2942},{"className":2941},[],[2943],{"type":49,"value":2944},"ELASTICSEARCH_API_KEY",{"type":43,"tag":728,"props":2946,"children":2947},{},[2948],{"type":49,"value":2927},{"type":43,"tag":728,"props":2950,"children":2951},{},[2952],{"type":49,"value":2953},"Elasticsearch API key",{"type":43,"tag":706,"props":2955,"children":2956},{},[2957,2966,2970],{"type":43,"tag":728,"props":2958,"children":2959},{},[2960],{"type":43,"tag":58,"props":2961,"children":2963},{"className":2962},[],[2964],{"type":49,"value":2965},"KIBANA_URL",{"type":43,"tag":728,"props":2967,"children":2968},{},[2969],{"type":49,"value":2927},{"type":43,"tag":728,"props":2971,"children":2972},{},[2973],{"type":49,"value":2974},"Kibana URL (for case management)",{"type":43,"tag":706,"props":2976,"children":2977},{},[2978,2987,2991],{"type":43,"tag":728,"props":2979,"children":2980},{},[2981],{"type":43,"tag":58,"props":2982,"children":2984},{"className":2983},[],[2985],{"type":49,"value":2986},"KIBANA_API_KEY",{"type":43,"tag":728,"props":2988,"children":2989},{},[2990],{"type":49,"value":2927},{"type":43,"tag":728,"props":2992,"children":2993},{},[2994],{"type":49,"value":2995},"Kibana API key (for case management)",{"type":43,"tag":2997,"props":2998,"children":2999},"style",{},[3000],{"type":49,"value":3001},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3003,"total":3095},[3004,3021,3035,3045,3058,3070,3084],{"slug":3005,"name":3005,"fn":3006,"description":3007,"org":3008,"tags":3009,"stars":23,"repoUrl":24,"updatedAt":3020},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3010,3013,3014,3017],{"name":3011,"slug":3012,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":3015,"slug":3016,"type":15},"Operations","operations",{"name":3018,"slug":3019,"type":15},"Permissions","permissions","2026-07-12T07:46:44.946285",{"slug":3022,"name":3022,"fn":3023,"description":3024,"org":3025,"tags":3026,"stars":23,"repoUrl":24,"updatedAt":3034},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3027,3028,3031],{"name":3011,"slug":3012,"type":15},{"name":3029,"slug":3030,"type":15},"Deployment","deployment",{"name":3032,"slug":3033,"type":15},"Elasticsearch","elasticsearch","2026-07-12T07:46:42.353362",{"slug":3036,"name":3036,"fn":3037,"description":3038,"org":3039,"tags":3040,"stars":23,"repoUrl":24,"updatedAt":3044},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3041,3042,3043],{"name":3011,"slug":3012,"type":15},{"name":3032,"slug":3033,"type":15},{"name":3015,"slug":3016,"type":15},"2026-07-12T07:46:41.097412",{"slug":3046,"name":3046,"fn":3047,"description":3048,"org":3049,"tags":3050,"stars":23,"repoUrl":24,"updatedAt":3057},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3051,3052,3053,3056],{"name":3011,"slug":3012,"type":15},{"name":3032,"slug":3033,"type":15},{"name":3054,"slug":3055,"type":15},"Networking","networking",{"name":13,"slug":14,"type":15},"2026-07-12T07:46:43.675992",{"slug":3059,"name":3059,"fn":3060,"description":3061,"org":3062,"tags":3063,"stars":23,"repoUrl":24,"updatedAt":3069},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3064,3067,3068],{"name":3065,"slug":3066,"type":15},"Authentication","authentication",{"name":3011,"slug":3012,"type":15},{"name":3032,"slug":3033,"type":15},"2026-07-12T07:46:39.783105",{"slug":3071,"name":3071,"fn":3072,"description":3073,"org":3074,"tags":3075,"stars":23,"repoUrl":24,"updatedAt":3083},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3076,3079,3080,3082],{"name":3077,"slug":3078,"type":15},"Audit","audit",{"name":3032,"slug":3033,"type":15},{"name":1435,"slug":3081,"type":15},"logs",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:35.092599",{"slug":3085,"name":3085,"fn":3086,"description":3087,"org":3088,"tags":3089,"stars":23,"repoUrl":24,"updatedAt":3094},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3090,3091,3092,3093],{"name":3065,"slug":3066,"type":15},{"name":9,"slug":8,"type":15},{"name":3032,"slug":3033,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:47:41.474547",35,{"items":3097,"total":3219},[3098,3117,3134,3147,3154,3160,3166,3173,3179,3186,3193,3206],{"slug":3099,"name":3099,"fn":3100,"description":3101,"org":3102,"tags":3103,"stars":3114,"repoUrl":3115,"updatedAt":3116},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3104,3107,3110,3111],{"name":3105,"slug":3106,"type":15},"Analytics","analytics",{"name":3108,"slug":3109,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":3112,"slug":3113,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":3118,"name":3118,"fn":3119,"description":3120,"org":3121,"tags":3122,"stars":3114,"repoUrl":3115,"updatedAt":3133},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3123,3126,3127,3130],{"name":3124,"slug":3125,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":3128,"slug":3129,"type":15},"Engineering","engineering",{"name":3131,"slug":3132,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":3135,"name":3135,"fn":3136,"description":3137,"org":3138,"tags":3139,"stars":3114,"repoUrl":3115,"updatedAt":3146},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3140,3141,3142,3143],{"name":9,"slug":8,"type":15},{"name":3032,"slug":3033,"type":15},{"name":3112,"slug":3113,"type":15},{"name":3144,"slug":3145,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":3005,"name":3005,"fn":3006,"description":3007,"org":3148,"tags":3149,"stars":23,"repoUrl":24,"updatedAt":3020},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3150,3151,3152,3153],{"name":3011,"slug":3012,"type":15},{"name":9,"slug":8,"type":15},{"name":3015,"slug":3016,"type":15},{"name":3018,"slug":3019,"type":15},{"slug":3022,"name":3022,"fn":3023,"description":3024,"org":3155,"tags":3156,"stars":23,"repoUrl":24,"updatedAt":3034},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3157,3158,3159],{"name":3011,"slug":3012,"type":15},{"name":3029,"slug":3030,"type":15},{"name":3032,"slug":3033,"type":15},{"slug":3036,"name":3036,"fn":3037,"description":3038,"org":3161,"tags":3162,"stars":23,"repoUrl":24,"updatedAt":3044},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3163,3164,3165],{"name":3011,"slug":3012,"type":15},{"name":3032,"slug":3033,"type":15},{"name":3015,"slug":3016,"type":15},{"slug":3046,"name":3046,"fn":3047,"description":3048,"org":3167,"tags":3168,"stars":23,"repoUrl":24,"updatedAt":3057},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3169,3170,3171,3172],{"name":3011,"slug":3012,"type":15},{"name":3032,"slug":3033,"type":15},{"name":3054,"slug":3055,"type":15},{"name":13,"slug":14,"type":15},{"slug":3059,"name":3059,"fn":3060,"description":3061,"org":3174,"tags":3175,"stars":23,"repoUrl":24,"updatedAt":3069},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3176,3177,3178],{"name":3065,"slug":3066,"type":15},{"name":3011,"slug":3012,"type":15},{"name":3032,"slug":3033,"type":15},{"slug":3071,"name":3071,"fn":3072,"description":3073,"org":3180,"tags":3181,"stars":23,"repoUrl":24,"updatedAt":3083},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3182,3183,3184,3185],{"name":3077,"slug":3078,"type":15},{"name":3032,"slug":3033,"type":15},{"name":1435,"slug":3081,"type":15},{"name":13,"slug":14,"type":15},{"slug":3085,"name":3085,"fn":3086,"description":3087,"org":3187,"tags":3188,"stars":23,"repoUrl":24,"updatedAt":3094},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3189,3190,3191,3192],{"name":3065,"slug":3066,"type":15},{"name":9,"slug":8,"type":15},{"name":3032,"slug":3033,"type":15},{"name":13,"slug":14,"type":15},{"slug":3194,"name":3194,"fn":3195,"description":3196,"org":3197,"tags":3198,"stars":23,"repoUrl":24,"updatedAt":3205},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3199,3200,3201,3204],{"name":9,"slug":8,"type":15},{"name":3032,"slug":3033,"type":15},{"name":3202,"slug":3203,"type":15},"RBAC","rbac",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:36.394177",{"slug":3207,"name":3207,"fn":3208,"description":3209,"org":3210,"tags":3211,"stars":23,"repoUrl":24,"updatedAt":3218},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3212,3213,3214,3215],{"name":3105,"slug":3106,"type":15},{"name":3108,"slug":3109,"type":15},{"name":3032,"slug":3033,"type":15},{"name":3216,"slug":3217,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86]