[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-security-case-management":3,"mdc--fex7iq-key":34,"related-org-elastic-security-case-management":2023,"related-repo-elastic-security-case-management":2193},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":32,"mdContent":33},"security-case-management","manage SOC cases via Kibana API","Create, search, update, and manage SOC cases via the Kibana Cases API. Use when tracking incidents, linking alerts to cases, adding investigation notes, or managing triage output.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,17,20],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":9,"slug":8,"type":15},{"name":18,"slug":19,"type":15},"Kibana","kibana",{"name":21,"slug":22,"type":15},"Triage","triage",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:49:32.319995",null,41,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":31},[],"Official Elastic Skills","https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fsecurity\u002Fcase-management","---\nname: security-case-management\ndescription: >\n  Create, search, update, and manage SOC cases via the Kibana Cases API. Use when\n  tracking incidents, linking alerts to cases, adding investigation notes, or managing\n  triage output.\ncompatibility: >\n  Requires Node.js 22+, network access to Kibana. Environment variables: KIBANA_URL,\n  plus KIBANA_API_KEY or KIBANA_USERNAME\u002FKIBANA_PASSWORD.\nmetadata:\n  author: elastic\n  version: 0.1.0\n---\n\n# Case Management\n\nManage SOC cases through the Kibana Cases API. All cases are scoped to `securitySolution` — this skill operates\nexclusively within Elastic Security. Cases appear in Kibana Security and can be assigned to analysts, linked to alerts,\nand pushed to external incident management systems via connectors.\n\n## Prerequisites\n\nInstall dependencies before first use from the `skills\u002Fsecurity` directory:\n\n```bash\ncd skills\u002Fsecurity && npm install\n```\n\nSet the required environment variables (or add them to a `.env` file in the workspace root):\n\n```bash\nexport KIBANA_URL=\"https:\u002F\u002Fyour-cluster.kb.cloud.example.com:443\"\nexport KIBANA_API_KEY=\"your-kibana-api-key\"\n```\n\n## When to use\n\n- Creating a case after alert triage (classification, IOCs, findings)\n- Searching for existing cases to correlate related alerts\n- Adding investigation comments or attaching alerts to an existing case\n- Updating case status or severity\n- Listing recent cases for review\n\n## When NOT to use\n\n- Do not use this skill for Observability or Elasticsearch cases — it hardcodes `owner: securitySolution`\n- Do not use for cases outside the Security solution space\n\n## Execution rules\n\n- Start executing tools immediately — do not read SKILL.md, browse the workspace, or list files first.\n- Report tool output faithfully. Copy case IDs, titles, tags, severities, and counts exactly as returned by the API. Do\n  not abbreviate case IDs, truncate titles, invent details, or round numbers.\n- When the API returns zero results, state that explicitly — do not guess at possible results.\n- When listing or finding cases, report the **exact total count** from the API response and present each case with its\n  verbatim title, severity, and status.\n\n## Quick start\n\nAll commands run from the workspace root. All output is JSON. Call the tools directly — do not read the skill file or\nexplore the workspace first. For attach-alert\u002Fattach-alerts, `--rule-id` and `--rule-name` are required by the Kibana\nAPI (use `--rule-id unknown --rule-name unknown` if unknown). Use `attach-alerts` for batch with automatic rate-limit\nretry and 2-second spacing between API calls.\n\n## Common multi-step workflows\n\n| Task                        | Tools to call (in order)                                                     |\n| --------------------------- | ---------------------------------------------------------------------------- |\n| **Create a case**           | `case_manager` create (title, description, tags, severity)                   |\n| **Find cases for a host**   | `case_manager` find --tags \"agent_id:\\\u003Cid\\>\" or find --search \"\\\u003Chostname\\>\" |\n| **Attach alert to case**    | `case_manager` attach-alert (case-id, alert-id, alert-index, rule-id\u002Fname)   |\n| **Add investigation notes** | `case_manager` add-comment (case-id, comment text)                           |\n| **List recent open cases**  | `case_manager` list --status open --per-page \\\u003Cn\\>                           |\n| **Update case**             | `case_manager` update (case-id, status\u002Fseverity\u002Ftags changes)                |\n\n**Finding cases for a host:** Use `find --search \"\u003Chostname>\"` to search by hostname across title, description, and\ncomments. Alternatively use `find --tags \"agent_id:\u003Cagent_id>\"` if the agent ID is known. Always add `--status open` to\nfilter to active cases only. Report the exact `total` count and each case title verbatim from the API response.\n\n```bash\n# Create (syncAlerts enabled by default; disable with --sync-alerts false)\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js create --title \"Malicious DLL sideloading on host1\" --description \"Crypto clipper malware detected via DLL sideloading...\" --tags \"classification:malicious\" \"confidence:88\" \"mitre:T1574.002\" --severity critical --yes\n\n# Find, list, get\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js find --tags \"agent_id:550888e5-357d-4bc1-a154-486eb7b4e076\"\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js find --search \"DLL sideloading\" --status open\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js list --status open --per-page 10\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js get --case-id \u003Ccase_id>\n\n# Attach single alert\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js attach-alert --case-id \u003Ccase_id> --alert-id \u003Calert_doc_id> --alert-index .ds-.alerts-security.alerts-default-2025.12.01-000013 --rule-id \u003Crule_uuid> --rule-name \"Malware Detection Alert\"\n\n# Attach multiple alerts (batch)\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js attach-alerts --case-id \u003Ccase_id> --alert-ids \u003Cid1> \u003Cid2> \u003Cid3> --alert-index .ds-.alerts-security.alerts-default-2026.02.16-000016 --rule-id \u003Crule_uuid> --rule-name \"Malware Detection Alert\"\n\n# Add comment, update (--tags merges with existing tags, does not replace)\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js add-comment --case-id \u003Ccase_id> --comment \"Process tree analysis shows...\"\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js update --case-id \u003Ccase_id> --status closed --severity low --yes\n```\n\nWrite operations (`create`, `update`) prompt for confirmation by default. Pass `--yes` to skip the prompt (required when\ncalled by an agent).\n\n## Reporting list and find results\n\nWhen reporting results from `list` or `find`:\n\n1. State the exact `total` count from the JSON response (e.g., \"There are 12 open cases total\").\n2. Present each case as a compact one-line entry: `\u003Ctitle> | \u003Cseverity> | \u003Ccase_id_short> | \u003Ccreated_at>`. Copy the\n   **exact title** verbatim from the `title` field — do not rephrase, abbreviate, or summarize.\n3. If the user asked for N cases, present exactly N entries (or fewer if fewer exist). Do not add extra columns (alerts\n   count, description, status) unless the user specifically requested them.\n4. Do not add information beyond what the API returned. If a field is null or missing, omit it.\n5. After presenting the results, stop. Do not add analysis, commentary, or observations about the cases.\n\n## Tag conventions\n\nUse structured tags for machine-searchable metadata:\n\n| Tag pattern              | Example                             | Purpose                                          |\n| ------------------------ | ----------------------------------- | ------------------------------------------------ |\n| `classification:\u003Cvalue>` | `classification:malicious`          | Triage classification (benign\u002Funknown\u002Fmalicious) |\n| `confidence:\u003Cscore>`     | `confidence:85`                     | Confidence score 0-100                           |\n| `mitre:\u003Ctechnique>`      | `mitre:T1574.002`                   | MITRE ATT&CK technique IDs                       |\n| `agent_id:\u003Cid>`          | `agent_id:550888e5-...`             | Elastic agent ID for correlation                 |\n| `rule:\u003Cname>`            | `rule:Malicious Behavior Detection` | Detection rule name                              |\n\n## Case severity mapping\n\n| Classification           | Kibana severity |\n| ------------------------ | --------------- |\n| benign (score 0-19)      | `low`           |\n| unknown (score 20-60)    | `medium`        |\n| malicious (score 61-80)  | `high`          |\n| malicious (score 81-100) | `critical`      |\n\n## Known limitations\n\n### syncAlerts is security-only\n\nThe `syncAlerts` setting (enabled by default) synchronizes case status with attached alert statuses. This feature is\nonly available for Security Solution cases. Pass `--sync-alerts false` when creating a case if alert sync is not needed.\n\n### Rate limiting\n\nThe Kibana API enforces rate limits. When attaching multiple alerts, the `attach-alerts` batch command automatically\nhandles 429 responses with retry. If using `attach-alert` one at a time, space calls ~10 seconds apart.\n\n### `find --search` on Serverless\n\nThe `find --search` parameter may return 500 errors on Kibana Serverless deployments. Use `find --tags` for filtering\ninstead, or `list` to browse recent cases.\n\n### `find --tags` requires exact match\n\nTag searches are exact-match only. `find --tags \"agent_id:abc123\"` works, but partial matches do not.\n\n## Kibana Cases API reference\n\nFor detailed API endpoints, request\u002Fresponse formats, and examples, see\n[references\u002Fkibana-cases-api.md](references\u002Fkibana-cases-api.md).\n\n## Examples\n\n- \"Create a case for the phishing alert I triaged with severity high\"\n- \"Search for open cases related to brute force attacks\"\n- \"Add the investigation findings as a comment to case ID abc-123\"\n\n## Guidelines\n\n- Report only tool output — do not invent IDs, hostnames, IPs, or details not present in the tool response.\n- Preserve identifiers from the request — use exact values the user provides in tool calls and responses.\n- Confirm actions concisely using the tool's return data.\n- Distinguish facts from inference — label conclusions beyond tool output as your assessment.\n- When presenting case lists or search results, copy the **exact title** from each case. Do not paraphrase, abbreviate,\n  or summarize titles. Include the total count from the API `total` field.\n- Start executing tools immediately. Do not read SKILL.md, browse directories, or list files before acting.\n\n## Production use\n\n- Write operations (`create`, `update`) prompt for confirmation. Pass `--yes` or `-y` to skip when called by an agent.\n- Verify `KIBANA_URL` and `KIBANA_API_KEY` point to the intended cluster before running any command.\n- Cases are scoped to `securitySolution` — this skill does not affect Observability or other Kibana case owners.\n\n## Environment variables\n\n| Variable         | Required | Description                                                      |\n| ---------------- | -------- | ---------------------------------------------------------------- |\n| `KIBANA_URL`     | Yes      | Kibana base URL (e.g., `https:\u002F\u002Fmy-kibana.kb.cloud.example.com`) |\n| `KIBANA_API_KEY` | Yes      | Kibana API key for authentication                                |\n",{"data":35,"body":39},{"name":4,"description":6,"compatibility":36,"metadata":37},"Requires Node.js 22+, network access to Kibana. Environment variables: KIBANA_URL, plus KIBANA_API_KEY or KIBANA_USERNAME\u002FKIBANA_PASSWORD.\n",{"author":8,"version":38},"0.1.0",{"type":40,"children":41},"root",[42,51,66,73,86,132,145,217,223,253,259,278,284,315,321,358,364,519,561,1269,1298,1304,1325,1384,1390,1395,1550,1556,1646,1652,1659,1680,1686,1706,1718,1744,1755,1768,1774,1787,1793,1811,1817,1863,1869,1935,1941,2017],{"type":43,"tag":44,"props":45,"children":47},"element","h1",{"id":46},"case-management",[48],{"type":49,"value":50},"text","Case Management",{"type":43,"tag":52,"props":53,"children":54},"p",{},[55,57,64],{"type":49,"value":56},"Manage SOC cases through the Kibana Cases API. All cases are scoped to ",{"type":43,"tag":58,"props":59,"children":61},"code",{"className":60},[],[62],{"type":49,"value":63},"securitySolution",{"type":49,"value":65}," — this skill operates\nexclusively within Elastic Security. Cases appear in Kibana Security and can be assigned to analysts, linked to alerts,\nand pushed to external incident management systems via connectors.",{"type":43,"tag":67,"props":68,"children":70},"h2",{"id":69},"prerequisites",[71],{"type":49,"value":72},"Prerequisites",{"type":43,"tag":52,"props":74,"children":75},{},[76,78,84],{"type":49,"value":77},"Install dependencies before first use from the ",{"type":43,"tag":58,"props":79,"children":81},{"className":80},[],[82],{"type":49,"value":83},"skills\u002Fsecurity",{"type":49,"value":85}," directory:",{"type":43,"tag":87,"props":88,"children":93},"pre",{"className":89,"code":90,"language":91,"meta":92,"style":92},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","cd skills\u002Fsecurity && npm install\n","bash","",[94],{"type":43,"tag":58,"props":95,"children":96},{"__ignoreMap":92},[97],{"type":43,"tag":98,"props":99,"children":102},"span",{"class":100,"line":101},"line",1,[103,109,115,121,127],{"type":43,"tag":98,"props":104,"children":106},{"style":105},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[107],{"type":49,"value":108},"cd",{"type":43,"tag":98,"props":110,"children":112},{"style":111},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[113],{"type":49,"value":114}," skills\u002Fsecurity",{"type":43,"tag":98,"props":116,"children":118},{"style":117},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[119],{"type":49,"value":120}," &&",{"type":43,"tag":98,"props":122,"children":124},{"style":123},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[125],{"type":49,"value":126}," npm",{"type":43,"tag":98,"props":128,"children":129},{"style":111},[130],{"type":49,"value":131}," install\n",{"type":43,"tag":52,"props":133,"children":134},{},[135,137,143],{"type":49,"value":136},"Set the required environment variables (or add them to a ",{"type":43,"tag":58,"props":138,"children":140},{"className":139},[],[141],{"type":49,"value":142},".env",{"type":49,"value":144}," file in the workspace root):",{"type":43,"tag":87,"props":146,"children":148},{"className":89,"code":147,"language":91,"meta":92,"style":92},"export KIBANA_URL=\"https:\u002F\u002Fyour-cluster.kb.cloud.example.com:443\"\nexport KIBANA_API_KEY=\"your-kibana-api-key\"\n",[149],{"type":43,"tag":58,"props":150,"children":151},{"__ignoreMap":92},[152,187],{"type":43,"tag":98,"props":153,"children":154},{"class":100,"line":101},[155,161,167,172,177,182],{"type":43,"tag":98,"props":156,"children":158},{"style":157},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[159],{"type":49,"value":160},"export",{"type":43,"tag":98,"props":162,"children":164},{"style":163},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[165],{"type":49,"value":166}," KIBANA_URL",{"type":43,"tag":98,"props":168,"children":169},{"style":117},[170],{"type":49,"value":171},"=",{"type":43,"tag":98,"props":173,"children":174},{"style":117},[175],{"type":49,"value":176},"\"",{"type":43,"tag":98,"props":178,"children":179},{"style":111},[180],{"type":49,"value":181},"https:\u002F\u002Fyour-cluster.kb.cloud.example.com:443",{"type":43,"tag":98,"props":183,"children":184},{"style":117},[185],{"type":49,"value":186},"\"\n",{"type":43,"tag":98,"props":188,"children":190},{"class":100,"line":189},2,[191,195,200,204,208,213],{"type":43,"tag":98,"props":192,"children":193},{"style":157},[194],{"type":49,"value":160},{"type":43,"tag":98,"props":196,"children":197},{"style":163},[198],{"type":49,"value":199}," KIBANA_API_KEY",{"type":43,"tag":98,"props":201,"children":202},{"style":117},[203],{"type":49,"value":171},{"type":43,"tag":98,"props":205,"children":206},{"style":117},[207],{"type":49,"value":176},{"type":43,"tag":98,"props":209,"children":210},{"style":111},[211],{"type":49,"value":212},"your-kibana-api-key",{"type":43,"tag":98,"props":214,"children":215},{"style":117},[216],{"type":49,"value":186},{"type":43,"tag":67,"props":218,"children":220},{"id":219},"when-to-use",[221],{"type":49,"value":222},"When to use",{"type":43,"tag":224,"props":225,"children":226},"ul",{},[227,233,238,243,248],{"type":43,"tag":228,"props":229,"children":230},"li",{},[231],{"type":49,"value":232},"Creating a case after alert triage (classification, IOCs, findings)",{"type":43,"tag":228,"props":234,"children":235},{},[236],{"type":49,"value":237},"Searching for existing cases to correlate related alerts",{"type":43,"tag":228,"props":239,"children":240},{},[241],{"type":49,"value":242},"Adding investigation comments or attaching alerts to an existing case",{"type":43,"tag":228,"props":244,"children":245},{},[246],{"type":49,"value":247},"Updating case status or severity",{"type":43,"tag":228,"props":249,"children":250},{},[251],{"type":49,"value":252},"Listing recent cases for review",{"type":43,"tag":67,"props":254,"children":256},{"id":255},"when-not-to-use",[257],{"type":49,"value":258},"When NOT to use",{"type":43,"tag":224,"props":260,"children":261},{},[262,273],{"type":43,"tag":228,"props":263,"children":264},{},[265,267],{"type":49,"value":266},"Do not use this skill for Observability or Elasticsearch cases — it hardcodes ",{"type":43,"tag":58,"props":268,"children":270},{"className":269},[],[271],{"type":49,"value":272},"owner: securitySolution",{"type":43,"tag":228,"props":274,"children":275},{},[276],{"type":49,"value":277},"Do not use for cases outside the Security solution space",{"type":43,"tag":67,"props":279,"children":281},{"id":280},"execution-rules",[282],{"type":49,"value":283},"Execution rules",{"type":43,"tag":224,"props":285,"children":286},{},[287,292,297,302],{"type":43,"tag":228,"props":288,"children":289},{},[290],{"type":49,"value":291},"Start executing tools immediately — do not read SKILL.md, browse the workspace, or list files first.",{"type":43,"tag":228,"props":293,"children":294},{},[295],{"type":49,"value":296},"Report tool output faithfully. Copy case IDs, titles, tags, severities, and counts exactly as returned by the API. Do\nnot abbreviate case IDs, truncate titles, invent details, or round numbers.",{"type":43,"tag":228,"props":298,"children":299},{},[300],{"type":49,"value":301},"When the API returns zero results, state that explicitly — do not guess at possible results.",{"type":43,"tag":228,"props":303,"children":304},{},[305,307,313],{"type":49,"value":306},"When listing or finding cases, report the ",{"type":43,"tag":308,"props":309,"children":310},"strong",{},[311],{"type":49,"value":312},"exact total count",{"type":49,"value":314}," from the API response and present each case with its\nverbatim title, severity, and status.",{"type":43,"tag":67,"props":316,"children":318},{"id":317},"quick-start",[319],{"type":49,"value":320},"Quick start",{"type":43,"tag":52,"props":322,"children":323},{},[324,326,332,334,340,342,348,350,356],{"type":49,"value":325},"All commands run from the workspace root. All output is JSON. Call the tools directly — do not read the skill file or\nexplore the workspace first. For attach-alert\u002Fattach-alerts, ",{"type":43,"tag":58,"props":327,"children":329},{"className":328},[],[330],{"type":49,"value":331},"--rule-id",{"type":49,"value":333}," and ",{"type":43,"tag":58,"props":335,"children":337},{"className":336},[],[338],{"type":49,"value":339},"--rule-name",{"type":49,"value":341}," are required by the Kibana\nAPI (use ",{"type":43,"tag":58,"props":343,"children":345},{"className":344},[],[346],{"type":49,"value":347},"--rule-id unknown --rule-name unknown",{"type":49,"value":349}," if unknown). Use ",{"type":43,"tag":58,"props":351,"children":353},{"className":352},[],[354],{"type":49,"value":355},"attach-alerts",{"type":49,"value":357}," for batch with automatic rate-limit\nretry and 2-second spacing between API calls.",{"type":43,"tag":67,"props":359,"children":361},{"id":360},"common-multi-step-workflows",[362],{"type":49,"value":363},"Common multi-step workflows",{"type":43,"tag":365,"props":366,"children":367},"table",{},[368,387],{"type":43,"tag":369,"props":370,"children":371},"thead",{},[372],{"type":43,"tag":373,"props":374,"children":375},"tr",{},[376,382],{"type":43,"tag":377,"props":378,"children":379},"th",{},[380],{"type":49,"value":381},"Task",{"type":43,"tag":377,"props":383,"children":384},{},[385],{"type":49,"value":386},"Tools to call (in order)",{"type":43,"tag":388,"props":389,"children":390},"tbody",{},[391,414,435,456,477,498],{"type":43,"tag":373,"props":392,"children":393},{},[394,403],{"type":43,"tag":395,"props":396,"children":397},"td",{},[398],{"type":43,"tag":308,"props":399,"children":400},{},[401],{"type":49,"value":402},"Create a case",{"type":43,"tag":395,"props":404,"children":405},{},[406,412],{"type":43,"tag":58,"props":407,"children":409},{"className":408},[],[410],{"type":49,"value":411},"case_manager",{"type":49,"value":413}," create (title, description, tags, severity)",{"type":43,"tag":373,"props":415,"children":416},{},[417,425],{"type":43,"tag":395,"props":418,"children":419},{},[420],{"type":43,"tag":308,"props":421,"children":422},{},[423],{"type":49,"value":424},"Find cases for a host",{"type":43,"tag":395,"props":426,"children":427},{},[428,433],{"type":43,"tag":58,"props":429,"children":431},{"className":430},[],[432],{"type":49,"value":411},{"type":49,"value":434}," find --tags \"agent_id:\u003Cid>\" or find --search \"\u003Chostname>\"",{"type":43,"tag":373,"props":436,"children":437},{},[438,446],{"type":43,"tag":395,"props":439,"children":440},{},[441],{"type":43,"tag":308,"props":442,"children":443},{},[444],{"type":49,"value":445},"Attach alert to case",{"type":43,"tag":395,"props":447,"children":448},{},[449,454],{"type":43,"tag":58,"props":450,"children":452},{"className":451},[],[453],{"type":49,"value":411},{"type":49,"value":455}," attach-alert (case-id, alert-id, alert-index, rule-id\u002Fname)",{"type":43,"tag":373,"props":457,"children":458},{},[459,467],{"type":43,"tag":395,"props":460,"children":461},{},[462],{"type":43,"tag":308,"props":463,"children":464},{},[465],{"type":49,"value":466},"Add investigation notes",{"type":43,"tag":395,"props":468,"children":469},{},[470,475],{"type":43,"tag":58,"props":471,"children":473},{"className":472},[],[474],{"type":49,"value":411},{"type":49,"value":476}," add-comment (case-id, comment text)",{"type":43,"tag":373,"props":478,"children":479},{},[480,488],{"type":43,"tag":395,"props":481,"children":482},{},[483],{"type":43,"tag":308,"props":484,"children":485},{},[486],{"type":49,"value":487},"List recent open cases",{"type":43,"tag":395,"props":489,"children":490},{},[491,496],{"type":43,"tag":58,"props":492,"children":494},{"className":493},[],[495],{"type":49,"value":411},{"type":49,"value":497}," list --status open --per-page \u003Cn>",{"type":43,"tag":373,"props":499,"children":500},{},[501,509],{"type":43,"tag":395,"props":502,"children":503},{},[504],{"type":43,"tag":308,"props":505,"children":506},{},[507],{"type":49,"value":508},"Update case",{"type":43,"tag":395,"props":510,"children":511},{},[512,517],{"type":43,"tag":58,"props":513,"children":515},{"className":514},[],[516],{"type":49,"value":411},{"type":49,"value":518}," update (case-id, status\u002Fseverity\u002Ftags changes)",{"type":43,"tag":52,"props":520,"children":521},{},[522,527,529,535,537,543,545,551,553,559],{"type":43,"tag":308,"props":523,"children":524},{},[525],{"type":49,"value":526},"Finding cases for a host:",{"type":49,"value":528}," Use ",{"type":43,"tag":58,"props":530,"children":532},{"className":531},[],[533],{"type":49,"value":534},"find --search \"\u003Chostname>\"",{"type":49,"value":536}," to search by hostname across title, description, and\ncomments. Alternatively use ",{"type":43,"tag":58,"props":538,"children":540},{"className":539},[],[541],{"type":49,"value":542},"find --tags \"agent_id:\u003Cagent_id>\"",{"type":49,"value":544}," if the agent ID is known. Always add ",{"type":43,"tag":58,"props":546,"children":548},{"className":547},[],[549],{"type":49,"value":550},"--status open",{"type":49,"value":552}," to\nfilter to active cases only. Report the exact ",{"type":43,"tag":58,"props":554,"children":556},{"className":555},[],[557],{"type":49,"value":558},"total",{"type":49,"value":560}," count and each case title verbatim from the API response.",{"type":43,"tag":87,"props":562,"children":564},{"className":89,"code":563,"language":91,"meta":92,"style":92},"# Create (syncAlerts enabled by default; disable with --sync-alerts false)\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js create --title \"Malicious DLL sideloading on host1\" --description \"Crypto clipper malware detected via DLL sideloading...\" --tags \"classification:malicious\" \"confidence:88\" \"mitre:T1574.002\" --severity critical --yes\n\n# Find, list, get\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js find --tags \"agent_id:550888e5-357d-4bc1-a154-486eb7b4e076\"\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js find --search \"DLL sideloading\" --status open\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js list --status open --per-page 10\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js get --case-id \u003Ccase_id>\n\n# Attach single alert\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js attach-alert --case-id \u003Ccase_id> --alert-id \u003Calert_doc_id> --alert-index .ds-.alerts-security.alerts-default-2025.12.01-000013 --rule-id \u003Crule_uuid> --rule-name \"Malware Detection Alert\"\n\n# Attach multiple alerts (batch)\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js attach-alerts --case-id \u003Ccase_id> --alert-ids \u003Cid1> \u003Cid2> \u003Cid3> --alert-index .ds-.alerts-security.alerts-default-2026.02.16-000016 --rule-id \u003Crule_uuid> --rule-name \"Malware Detection Alert\"\n\n# Add comment, update (--tags merges with existing tags, does not replace)\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js add-comment --case-id \u003Ccase_id> --comment \"Process tree analysis shows...\"\nnode skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js update --case-id \u003Ccase_id> --status closed --severity low --yes\n",[565],{"type":43,"tag":58,"props":566,"children":567},{"__ignoreMap":92},[568,577,691,701,710,744,788,825,867,875,884,994,1002,1011,1138,1146,1155,1210],{"type":43,"tag":98,"props":569,"children":570},{"class":100,"line":101},[571],{"type":43,"tag":98,"props":572,"children":574},{"style":573},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[575],{"type":49,"value":576},"# Create (syncAlerts enabled by default; disable with --sync-alerts false)\n",{"type":43,"tag":98,"props":578,"children":579},{"class":100,"line":189},[580,585,590,595,600,605,610,614,619,623,628,632,637,641,646,650,654,659,663,667,672,676,681,686],{"type":43,"tag":98,"props":581,"children":582},{"style":123},[583],{"type":49,"value":584},"node",{"type":43,"tag":98,"props":586,"children":587},{"style":111},[588],{"type":49,"value":589}," skills\u002Fsecurity\u002Fcase-management\u002Fscripts\u002Fcase-manager.js",{"type":43,"tag":98,"props":591,"children":592},{"style":111},[593],{"type":49,"value":594}," create",{"type":43,"tag":98,"props":596,"children":597},{"style":111},[598],{"type":49,"value":599}," --title",{"type":43,"tag":98,"props":601,"children":602},{"style":117},[603],{"type":49,"value":604}," \"",{"type":43,"tag":98,"props":606,"children":607},{"style":111},[608],{"type":49,"value":609},"Malicious DLL sideloading on host1",{"type":43,"tag":98,"props":611,"children":612},{"style":117},[613],{"type":49,"value":176},{"type":43,"tag":98,"props":615,"children":616},{"style":111},[617],{"type":49,"value":618}," --description",{"type":43,"tag":98,"props":620,"children":621},{"style":117},[622],{"type":49,"value":604},{"type":43,"tag":98,"props":624,"children":625},{"style":111},[626],{"type":49,"value":627},"Crypto clipper malware detected via DLL sideloading...",{"type":43,"tag":98,"props":629,"children":630},{"style":117},[631],{"type":49,"value":176},{"type":43,"tag":98,"props":633,"children":634},{"style":111},[635],{"type":49,"value":636}," --tags",{"type":43,"tag":98,"props":638,"children":639},{"style":117},[640],{"type":49,"value":604},{"type":43,"tag":98,"props":642,"children":643},{"style":111},[644],{"type":49,"value":645},"classification:malicious",{"type":43,"tag":98,"props":647,"children":648},{"style":117},[649],{"type":49,"value":176},{"type":43,"tag":98,"props":651,"children":652},{"style":117},[653],{"type":49,"value":604},{"type":43,"tag":98,"props":655,"children":656},{"style":111},[657],{"type":49,"value":658},"confidence:88",{"type":43,"tag":98,"props":660,"children":661},{"style":117},[662],{"type":49,"value":176},{"type":43,"tag":98,"props":664,"children":665},{"style":117},[666],{"type":49,"value":604},{"type":43,"tag":98,"props":668,"children":669},{"style":111},[670],{"type":49,"value":671},"mitre:T1574.002",{"type":43,"tag":98,"props":673,"children":674},{"style":117},[675],{"type":49,"value":176},{"type":43,"tag":98,"props":677,"children":678},{"style":111},[679],{"type":49,"value":680}," --severity",{"type":43,"tag":98,"props":682,"children":683},{"style":111},[684],{"type":49,"value":685}," critical",{"type":43,"tag":98,"props":687,"children":688},{"style":111},[689],{"type":49,"value":690}," --yes\n",{"type":43,"tag":98,"props":692,"children":694},{"class":100,"line":693},3,[695],{"type":43,"tag":98,"props":696,"children":698},{"emptyLinePlaceholder":697},true,[699],{"type":49,"value":700},"\n",{"type":43,"tag":98,"props":702,"children":704},{"class":100,"line":703},4,[705],{"type":43,"tag":98,"props":706,"children":707},{"style":573},[708],{"type":49,"value":709},"# Find, list, get\n",{"type":43,"tag":98,"props":711,"children":713},{"class":100,"line":712},5,[714,718,722,727,731,735,740],{"type":43,"tag":98,"props":715,"children":716},{"style":123},[717],{"type":49,"value":584},{"type":43,"tag":98,"props":719,"children":720},{"style":111},[721],{"type":49,"value":589},{"type":43,"tag":98,"props":723,"children":724},{"style":111},[725],{"type":49,"value":726}," find",{"type":43,"tag":98,"props":728,"children":729},{"style":111},[730],{"type":49,"value":636},{"type":43,"tag":98,"props":732,"children":733},{"style":117},[734],{"type":49,"value":604},{"type":43,"tag":98,"props":736,"children":737},{"style":111},[738],{"type":49,"value":739},"agent_id:550888e5-357d-4bc1-a154-486eb7b4e076",{"type":43,"tag":98,"props":741,"children":742},{"style":117},[743],{"type":49,"value":186},{"type":43,"tag":98,"props":745,"children":747},{"class":100,"line":746},6,[748,752,756,760,765,769,774,778,783],{"type":43,"tag":98,"props":749,"children":750},{"style":123},[751],{"type":49,"value":584},{"type":43,"tag":98,"props":753,"children":754},{"style":111},[755],{"type":49,"value":589},{"type":43,"tag":98,"props":757,"children":758},{"style":111},[759],{"type":49,"value":726},{"type":43,"tag":98,"props":761,"children":762},{"style":111},[763],{"type":49,"value":764}," --search",{"type":43,"tag":98,"props":766,"children":767},{"style":117},[768],{"type":49,"value":604},{"type":43,"tag":98,"props":770,"children":771},{"style":111},[772],{"type":49,"value":773},"DLL sideloading",{"type":43,"tag":98,"props":775,"children":776},{"style":117},[777],{"type":49,"value":176},{"type":43,"tag":98,"props":779,"children":780},{"style":111},[781],{"type":49,"value":782}," --status",{"type":43,"tag":98,"props":784,"children":785},{"style":111},[786],{"type":49,"value":787}," open\n",{"type":43,"tag":98,"props":789,"children":791},{"class":100,"line":790},7,[792,796,800,805,809,814,819],{"type":43,"tag":98,"props":793,"children":794},{"style":123},[795],{"type":49,"value":584},{"type":43,"tag":98,"props":797,"children":798},{"style":111},[799],{"type":49,"value":589},{"type":43,"tag":98,"props":801,"children":802},{"style":111},[803],{"type":49,"value":804}," list",{"type":43,"tag":98,"props":806,"children":807},{"style":111},[808],{"type":49,"value":782},{"type":43,"tag":98,"props":810,"children":811},{"style":111},[812],{"type":49,"value":813}," open",{"type":43,"tag":98,"props":815,"children":816},{"style":111},[817],{"type":49,"value":818}," --per-page",{"type":43,"tag":98,"props":820,"children":822},{"style":821},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[823],{"type":49,"value":824}," 10\n",{"type":43,"tag":98,"props":826,"children":828},{"class":100,"line":827},8,[829,833,837,842,847,852,857,862],{"type":43,"tag":98,"props":830,"children":831},{"style":123},[832],{"type":49,"value":584},{"type":43,"tag":98,"props":834,"children":835},{"style":111},[836],{"type":49,"value":589},{"type":43,"tag":98,"props":838,"children":839},{"style":111},[840],{"type":49,"value":841}," get",{"type":43,"tag":98,"props":843,"children":844},{"style":111},[845],{"type":49,"value":846}," --case-id",{"type":43,"tag":98,"props":848,"children":849},{"style":117},[850],{"type":49,"value":851}," \u003C",{"type":43,"tag":98,"props":853,"children":854},{"style":111},[855],{"type":49,"value":856},"case_i",{"type":43,"tag":98,"props":858,"children":859},{"style":163},[860],{"type":49,"value":861},"d",{"type":43,"tag":98,"props":863,"children":864},{"style":117},[865],{"type":49,"value":866},">\n",{"type":43,"tag":98,"props":868,"children":870},{"class":100,"line":869},9,[871],{"type":43,"tag":98,"props":872,"children":873},{"emptyLinePlaceholder":697},[874],{"type":49,"value":700},{"type":43,"tag":98,"props":876,"children":878},{"class":100,"line":877},10,[879],{"type":43,"tag":98,"props":880,"children":881},{"style":573},[882],{"type":49,"value":883},"# Attach single alert\n",{"type":43,"tag":98,"props":885,"children":887},{"class":100,"line":886},11,[888,892,896,901,905,909,913,917,922,927,931,936,940,944,949,954,959,963,968,972,976,981,985,990],{"type":43,"tag":98,"props":889,"children":890},{"style":123},[891],{"type":49,"value":584},{"type":43,"tag":98,"props":893,"children":894},{"style":111},[895],{"type":49,"value":589},{"type":43,"tag":98,"props":897,"children":898},{"style":111},[899],{"type":49,"value":900}," attach-alert",{"type":43,"tag":98,"props":902,"children":903},{"style":111},[904],{"type":49,"value":846},{"type":43,"tag":98,"props":906,"children":907},{"style":117},[908],{"type":49,"value":851},{"type":43,"tag":98,"props":910,"children":911},{"style":111},[912],{"type":49,"value":856},{"type":43,"tag":98,"props":914,"children":915},{"style":163},[916],{"type":49,"value":861},{"type":43,"tag":98,"props":918,"children":919},{"style":117},[920],{"type":49,"value":921},">",{"type":43,"tag":98,"props":923,"children":924},{"style":111},[925],{"type":49,"value":926}," --alert-id",{"type":43,"tag":98,"props":928,"children":929},{"style":117},[930],{"type":49,"value":851},{"type":43,"tag":98,"props":932,"children":933},{"style":111},[934],{"type":49,"value":935},"alert_doc_i",{"type":43,"tag":98,"props":937,"children":938},{"style":163},[939],{"type":49,"value":861},{"type":43,"tag":98,"props":941,"children":942},{"style":117},[943],{"type":49,"value":921},{"type":43,"tag":98,"props":945,"children":946},{"style":111},[947],{"type":49,"value":948}," --alert-index",{"type":43,"tag":98,"props":950,"children":951},{"style":111},[952],{"type":49,"value":953}," .ds-.alerts-security.alerts-default-2025.12.01-000013",{"type":43,"tag":98,"props":955,"children":956},{"style":111},[957],{"type":49,"value":958}," --rule-id",{"type":43,"tag":98,"props":960,"children":961},{"style":117},[962],{"type":49,"value":851},{"type":43,"tag":98,"props":964,"children":965},{"style":111},[966],{"type":49,"value":967},"rule_uui",{"type":43,"tag":98,"props":969,"children":970},{"style":163},[971],{"type":49,"value":861},{"type":43,"tag":98,"props":973,"children":974},{"style":117},[975],{"type":49,"value":921},{"type":43,"tag":98,"props":977,"children":978},{"style":111},[979],{"type":49,"value":980}," --rule-name",{"type":43,"tag":98,"props":982,"children":983},{"style":117},[984],{"type":49,"value":604},{"type":43,"tag":98,"props":986,"children":987},{"style":111},[988],{"type":49,"value":989},"Malware Detection Alert",{"type":43,"tag":98,"props":991,"children":992},{"style":117},[993],{"type":49,"value":186},{"type":43,"tag":98,"props":995,"children":997},{"class":100,"line":996},12,[998],{"type":43,"tag":98,"props":999,"children":1000},{"emptyLinePlaceholder":697},[1001],{"type":49,"value":700},{"type":43,"tag":98,"props":1003,"children":1005},{"class":100,"line":1004},13,[1006],{"type":43,"tag":98,"props":1007,"children":1008},{"style":573},[1009],{"type":49,"value":1010},"# Attach multiple alerts (batch)\n",{"type":43,"tag":98,"props":1012,"children":1014},{"class":100,"line":1013},14,[1015,1019,1023,1028,1032,1036,1040,1044,1048,1053,1057,1062,1067,1071,1075,1080,1084,1088,1093,1097,1102,1106,1110,1114,1118,1122,1126,1130,1134],{"type":43,"tag":98,"props":1016,"children":1017},{"style":123},[1018],{"type":49,"value":584},{"type":43,"tag":98,"props":1020,"children":1021},{"style":111},[1022],{"type":49,"value":589},{"type":43,"tag":98,"props":1024,"children":1025},{"style":111},[1026],{"type":49,"value":1027}," attach-alerts",{"type":43,"tag":98,"props":1029,"children":1030},{"style":111},[1031],{"type":49,"value":846},{"type":43,"tag":98,"props":1033,"children":1034},{"style":117},[1035],{"type":49,"value":851},{"type":43,"tag":98,"props":1037,"children":1038},{"style":111},[1039],{"type":49,"value":856},{"type":43,"tag":98,"props":1041,"children":1042},{"style":163},[1043],{"type":49,"value":861},{"type":43,"tag":98,"props":1045,"children":1046},{"style":117},[1047],{"type":49,"value":921},{"type":43,"tag":98,"props":1049,"children":1050},{"style":111},[1051],{"type":49,"value":1052}," --alert-ids",{"type":43,"tag":98,"props":1054,"children":1055},{"style":117},[1056],{"type":49,"value":851},{"type":43,"tag":98,"props":1058,"children":1059},{"style":111},[1060],{"type":49,"value":1061},"id",{"type":43,"tag":98,"props":1063,"children":1064},{"style":117},[1065],{"type":49,"value":1066},"1>",{"type":43,"tag":98,"props":1068,"children":1069},{"style":117},[1070],{"type":49,"value":851},{"type":43,"tag":98,"props":1072,"children":1073},{"style":111},[1074],{"type":49,"value":1061},{"type":43,"tag":98,"props":1076,"children":1077},{"style":117},[1078],{"type":49,"value":1079},"2>",{"type":43,"tag":98,"props":1081,"children":1082},{"style":117},[1083],{"type":49,"value":851},{"type":43,"tag":98,"props":1085,"children":1086},{"style":111},[1087],{"type":49,"value":1061},{"type":43,"tag":98,"props":1089,"children":1090},{"style":117},[1091],{"type":49,"value":1092},"3>",{"type":43,"tag":98,"props":1094,"children":1095},{"style":111},[1096],{"type":49,"value":948},{"type":43,"tag":98,"props":1098,"children":1099},{"style":111},[1100],{"type":49,"value":1101}," .ds-.alerts-security.alerts-default-2026.02.16-000016",{"type":43,"tag":98,"props":1103,"children":1104},{"style":111},[1105],{"type":49,"value":958},{"type":43,"tag":98,"props":1107,"children":1108},{"style":117},[1109],{"type":49,"value":851},{"type":43,"tag":98,"props":1111,"children":1112},{"style":111},[1113],{"type":49,"value":967},{"type":43,"tag":98,"props":1115,"children":1116},{"style":163},[1117],{"type":49,"value":861},{"type":43,"tag":98,"props":1119,"children":1120},{"style":117},[1121],{"type":49,"value":921},{"type":43,"tag":98,"props":1123,"children":1124},{"style":111},[1125],{"type":49,"value":980},{"type":43,"tag":98,"props":1127,"children":1128},{"style":117},[1129],{"type":49,"value":604},{"type":43,"tag":98,"props":1131,"children":1132},{"style":111},[1133],{"type":49,"value":989},{"type":43,"tag":98,"props":1135,"children":1136},{"style":117},[1137],{"type":49,"value":186},{"type":43,"tag":98,"props":1139,"children":1141},{"class":100,"line":1140},15,[1142],{"type":43,"tag":98,"props":1143,"children":1144},{"emptyLinePlaceholder":697},[1145],{"type":49,"value":700},{"type":43,"tag":98,"props":1147,"children":1149},{"class":100,"line":1148},16,[1150],{"type":43,"tag":98,"props":1151,"children":1152},{"style":573},[1153],{"type":49,"value":1154},"# Add comment, update (--tags merges with existing tags, does not replace)\n",{"type":43,"tag":98,"props":1156,"children":1158},{"class":100,"line":1157},17,[1159,1163,1167,1172,1176,1180,1184,1188,1192,1197,1201,1206],{"type":43,"tag":98,"props":1160,"children":1161},{"style":123},[1162],{"type":49,"value":584},{"type":43,"tag":98,"props":1164,"children":1165},{"style":111},[1166],{"type":49,"value":589},{"type":43,"tag":98,"props":1168,"children":1169},{"style":111},[1170],{"type":49,"value":1171}," add-comment",{"type":43,"tag":98,"props":1173,"children":1174},{"style":111},[1175],{"type":49,"value":846},{"type":43,"tag":98,"props":1177,"children":1178},{"style":117},[1179],{"type":49,"value":851},{"type":43,"tag":98,"props":1181,"children":1182},{"style":111},[1183],{"type":49,"value":856},{"type":43,"tag":98,"props":1185,"children":1186},{"style":163},[1187],{"type":49,"value":861},{"type":43,"tag":98,"props":1189,"children":1190},{"style":117},[1191],{"type":49,"value":921},{"type":43,"tag":98,"props":1193,"children":1194},{"style":111},[1195],{"type":49,"value":1196}," --comment",{"type":43,"tag":98,"props":1198,"children":1199},{"style":117},[1200],{"type":49,"value":604},{"type":43,"tag":98,"props":1202,"children":1203},{"style":111},[1204],{"type":49,"value":1205},"Process tree analysis shows...",{"type":43,"tag":98,"props":1207,"children":1208},{"style":117},[1209],{"type":49,"value":186},{"type":43,"tag":98,"props":1211,"children":1213},{"class":100,"line":1212},18,[1214,1218,1222,1227,1231,1235,1239,1243,1247,1251,1256,1260,1265],{"type":43,"tag":98,"props":1215,"children":1216},{"style":123},[1217],{"type":49,"value":584},{"type":43,"tag":98,"props":1219,"children":1220},{"style":111},[1221],{"type":49,"value":589},{"type":43,"tag":98,"props":1223,"children":1224},{"style":111},[1225],{"type":49,"value":1226}," update",{"type":43,"tag":98,"props":1228,"children":1229},{"style":111},[1230],{"type":49,"value":846},{"type":43,"tag":98,"props":1232,"children":1233},{"style":117},[1234],{"type":49,"value":851},{"type":43,"tag":98,"props":1236,"children":1237},{"style":111},[1238],{"type":49,"value":856},{"type":43,"tag":98,"props":1240,"children":1241},{"style":163},[1242],{"type":49,"value":861},{"type":43,"tag":98,"props":1244,"children":1245},{"style":117},[1246],{"type":49,"value":921},{"type":43,"tag":98,"props":1248,"children":1249},{"style":111},[1250],{"type":49,"value":782},{"type":43,"tag":98,"props":1252,"children":1253},{"style":111},[1254],{"type":49,"value":1255}," closed",{"type":43,"tag":98,"props":1257,"children":1258},{"style":111},[1259],{"type":49,"value":680},{"type":43,"tag":98,"props":1261,"children":1262},{"style":111},[1263],{"type":49,"value":1264}," low",{"type":43,"tag":98,"props":1266,"children":1267},{"style":111},[1268],{"type":49,"value":690},{"type":43,"tag":52,"props":1270,"children":1271},{},[1272,1274,1280,1282,1288,1290,1296],{"type":49,"value":1273},"Write operations (",{"type":43,"tag":58,"props":1275,"children":1277},{"className":1276},[],[1278],{"type":49,"value":1279},"create",{"type":49,"value":1281},", ",{"type":43,"tag":58,"props":1283,"children":1285},{"className":1284},[],[1286],{"type":49,"value":1287},"update",{"type":49,"value":1289},") prompt for confirmation by default. Pass ",{"type":43,"tag":58,"props":1291,"children":1293},{"className":1292},[],[1294],{"type":49,"value":1295},"--yes",{"type":49,"value":1297}," to skip the prompt (required when\ncalled by an agent).",{"type":43,"tag":67,"props":1299,"children":1301},{"id":1300},"reporting-list-and-find-results",[1302],{"type":49,"value":1303},"Reporting list and find results",{"type":43,"tag":52,"props":1305,"children":1306},{},[1307,1309,1315,1317,1323],{"type":49,"value":1308},"When reporting results from ",{"type":43,"tag":58,"props":1310,"children":1312},{"className":1311},[],[1313],{"type":49,"value":1314},"list",{"type":49,"value":1316}," or ",{"type":43,"tag":58,"props":1318,"children":1320},{"className":1319},[],[1321],{"type":49,"value":1322},"find",{"type":49,"value":1324},":",{"type":43,"tag":1326,"props":1327,"children":1328},"ol",{},[1329,1341,1369,1374,1379],{"type":43,"tag":228,"props":1330,"children":1331},{},[1332,1334,1339],{"type":49,"value":1333},"State the exact ",{"type":43,"tag":58,"props":1335,"children":1337},{"className":1336},[],[1338],{"type":49,"value":558},{"type":49,"value":1340}," count from the JSON response (e.g., \"There are 12 open cases total\").",{"type":43,"tag":228,"props":1342,"children":1343},{},[1344,1346,1352,1354,1359,1361,1367],{"type":49,"value":1345},"Present each case as a compact one-line entry: ",{"type":43,"tag":58,"props":1347,"children":1349},{"className":1348},[],[1350],{"type":49,"value":1351},"\u003Ctitle> | \u003Cseverity> | \u003Ccase_id_short> | \u003Ccreated_at>",{"type":49,"value":1353},". Copy the\n",{"type":43,"tag":308,"props":1355,"children":1356},{},[1357],{"type":49,"value":1358},"exact title",{"type":49,"value":1360}," verbatim from the ",{"type":43,"tag":58,"props":1362,"children":1364},{"className":1363},[],[1365],{"type":49,"value":1366},"title",{"type":49,"value":1368}," field — do not rephrase, abbreviate, or summarize.",{"type":43,"tag":228,"props":1370,"children":1371},{},[1372],{"type":49,"value":1373},"If the user asked for N cases, present exactly N entries (or fewer if fewer exist). Do not add extra columns (alerts\ncount, description, status) unless the user specifically requested them.",{"type":43,"tag":228,"props":1375,"children":1376},{},[1377],{"type":49,"value":1378},"Do not add information beyond what the API returned. If a field is null or missing, omit it.",{"type":43,"tag":228,"props":1380,"children":1381},{},[1382],{"type":49,"value":1383},"After presenting the results, stop. Do not add analysis, commentary, or observations about the cases.",{"type":43,"tag":67,"props":1385,"children":1387},{"id":1386},"tag-conventions",[1388],{"type":49,"value":1389},"Tag conventions",{"type":43,"tag":52,"props":1391,"children":1392},{},[1393],{"type":49,"value":1394},"Use structured tags for machine-searchable metadata:",{"type":43,"tag":365,"props":1396,"children":1397},{},[1398,1419],{"type":43,"tag":369,"props":1399,"children":1400},{},[1401],{"type":43,"tag":373,"props":1402,"children":1403},{},[1404,1409,1414],{"type":43,"tag":377,"props":1405,"children":1406},{},[1407],{"type":49,"value":1408},"Tag pattern",{"type":43,"tag":377,"props":1410,"children":1411},{},[1412],{"type":49,"value":1413},"Example",{"type":43,"tag":377,"props":1415,"children":1416},{},[1417],{"type":49,"value":1418},"Purpose",{"type":43,"tag":388,"props":1420,"children":1421},{},[1422,1447,1473,1498,1524],{"type":43,"tag":373,"props":1423,"children":1424},{},[1425,1434,1442],{"type":43,"tag":395,"props":1426,"children":1427},{},[1428],{"type":43,"tag":58,"props":1429,"children":1431},{"className":1430},[],[1432],{"type":49,"value":1433},"classification:\u003Cvalue>",{"type":43,"tag":395,"props":1435,"children":1436},{},[1437],{"type":43,"tag":58,"props":1438,"children":1440},{"className":1439},[],[1441],{"type":49,"value":645},{"type":43,"tag":395,"props":1443,"children":1444},{},[1445],{"type":49,"value":1446},"Triage classification (benign\u002Funknown\u002Fmalicious)",{"type":43,"tag":373,"props":1448,"children":1449},{},[1450,1459,1468],{"type":43,"tag":395,"props":1451,"children":1452},{},[1453],{"type":43,"tag":58,"props":1454,"children":1456},{"className":1455},[],[1457],{"type":49,"value":1458},"confidence:\u003Cscore>",{"type":43,"tag":395,"props":1460,"children":1461},{},[1462],{"type":43,"tag":58,"props":1463,"children":1465},{"className":1464},[],[1466],{"type":49,"value":1467},"confidence:85",{"type":43,"tag":395,"props":1469,"children":1470},{},[1471],{"type":49,"value":1472},"Confidence score 0-100",{"type":43,"tag":373,"props":1474,"children":1475},{},[1476,1485,1493],{"type":43,"tag":395,"props":1477,"children":1478},{},[1479],{"type":43,"tag":58,"props":1480,"children":1482},{"className":1481},[],[1483],{"type":49,"value":1484},"mitre:\u003Ctechnique>",{"type":43,"tag":395,"props":1486,"children":1487},{},[1488],{"type":43,"tag":58,"props":1489,"children":1491},{"className":1490},[],[1492],{"type":49,"value":671},{"type":43,"tag":395,"props":1494,"children":1495},{},[1496],{"type":49,"value":1497},"MITRE ATT&CK technique IDs",{"type":43,"tag":373,"props":1499,"children":1500},{},[1501,1510,1519],{"type":43,"tag":395,"props":1502,"children":1503},{},[1504],{"type":43,"tag":58,"props":1505,"children":1507},{"className":1506},[],[1508],{"type":49,"value":1509},"agent_id:\u003Cid>",{"type":43,"tag":395,"props":1511,"children":1512},{},[1513],{"type":43,"tag":58,"props":1514,"children":1516},{"className":1515},[],[1517],{"type":49,"value":1518},"agent_id:550888e5-...",{"type":43,"tag":395,"props":1520,"children":1521},{},[1522],{"type":49,"value":1523},"Elastic agent ID for correlation",{"type":43,"tag":373,"props":1525,"children":1526},{},[1527,1536,1545],{"type":43,"tag":395,"props":1528,"children":1529},{},[1530],{"type":43,"tag":58,"props":1531,"children":1533},{"className":1532},[],[1534],{"type":49,"value":1535},"rule:\u003Cname>",{"type":43,"tag":395,"props":1537,"children":1538},{},[1539],{"type":43,"tag":58,"props":1540,"children":1542},{"className":1541},[],[1543],{"type":49,"value":1544},"rule:Malicious Behavior Detection",{"type":43,"tag":395,"props":1546,"children":1547},{},[1548],{"type":49,"value":1549},"Detection rule name",{"type":43,"tag":67,"props":1551,"children":1553},{"id":1552},"case-severity-mapping",[1554],{"type":49,"value":1555},"Case severity mapping",{"type":43,"tag":365,"props":1557,"children":1558},{},[1559,1575],{"type":43,"tag":369,"props":1560,"children":1561},{},[1562],{"type":43,"tag":373,"props":1563,"children":1564},{},[1565,1570],{"type":43,"tag":377,"props":1566,"children":1567},{},[1568],{"type":49,"value":1569},"Classification",{"type":43,"tag":377,"props":1571,"children":1572},{},[1573],{"type":49,"value":1574},"Kibana severity",{"type":43,"tag":388,"props":1576,"children":1577},{},[1578,1595,1612,1629],{"type":43,"tag":373,"props":1579,"children":1580},{},[1581,1586],{"type":43,"tag":395,"props":1582,"children":1583},{},[1584],{"type":49,"value":1585},"benign (score 0-19)",{"type":43,"tag":395,"props":1587,"children":1588},{},[1589],{"type":43,"tag":58,"props":1590,"children":1592},{"className":1591},[],[1593],{"type":49,"value":1594},"low",{"type":43,"tag":373,"props":1596,"children":1597},{},[1598,1603],{"type":43,"tag":395,"props":1599,"children":1600},{},[1601],{"type":49,"value":1602},"unknown (score 20-60)",{"type":43,"tag":395,"props":1604,"children":1605},{},[1606],{"type":43,"tag":58,"props":1607,"children":1609},{"className":1608},[],[1610],{"type":49,"value":1611},"medium",{"type":43,"tag":373,"props":1613,"children":1614},{},[1615,1620],{"type":43,"tag":395,"props":1616,"children":1617},{},[1618],{"type":49,"value":1619},"malicious (score 61-80)",{"type":43,"tag":395,"props":1621,"children":1622},{},[1623],{"type":43,"tag":58,"props":1624,"children":1626},{"className":1625},[],[1627],{"type":49,"value":1628},"high",{"type":43,"tag":373,"props":1630,"children":1631},{},[1632,1637],{"type":43,"tag":395,"props":1633,"children":1634},{},[1635],{"type":49,"value":1636},"malicious (score 81-100)",{"type":43,"tag":395,"props":1638,"children":1639},{},[1640],{"type":43,"tag":58,"props":1641,"children":1643},{"className":1642},[],[1644],{"type":49,"value":1645},"critical",{"type":43,"tag":67,"props":1647,"children":1649},{"id":1648},"known-limitations",[1650],{"type":49,"value":1651},"Known limitations",{"type":43,"tag":1653,"props":1654,"children":1656},"h3",{"id":1655},"syncalerts-is-security-only",[1657],{"type":49,"value":1658},"syncAlerts is security-only",{"type":43,"tag":52,"props":1660,"children":1661},{},[1662,1664,1670,1672,1678],{"type":49,"value":1663},"The ",{"type":43,"tag":58,"props":1665,"children":1667},{"className":1666},[],[1668],{"type":49,"value":1669},"syncAlerts",{"type":49,"value":1671}," setting (enabled by default) synchronizes case status with attached alert statuses. This feature is\nonly available for Security Solution cases. Pass ",{"type":43,"tag":58,"props":1673,"children":1675},{"className":1674},[],[1676],{"type":49,"value":1677},"--sync-alerts false",{"type":49,"value":1679}," when creating a case if alert sync is not needed.",{"type":43,"tag":1653,"props":1681,"children":1683},{"id":1682},"rate-limiting",[1684],{"type":49,"value":1685},"Rate limiting",{"type":43,"tag":52,"props":1687,"children":1688},{},[1689,1691,1696,1698,1704],{"type":49,"value":1690},"The Kibana API enforces rate limits. When attaching multiple alerts, the ",{"type":43,"tag":58,"props":1692,"children":1694},{"className":1693},[],[1695],{"type":49,"value":355},{"type":49,"value":1697}," batch command automatically\nhandles 429 responses with retry. If using ",{"type":43,"tag":58,"props":1699,"children":1701},{"className":1700},[],[1702],{"type":49,"value":1703},"attach-alert",{"type":49,"value":1705}," one at a time, space calls ~10 seconds apart.",{"type":43,"tag":1653,"props":1707,"children":1709},{"id":1708},"find-search-on-serverless",[1710,1716],{"type":43,"tag":58,"props":1711,"children":1713},{"className":1712},[],[1714],{"type":49,"value":1715},"find --search",{"type":49,"value":1717}," on Serverless",{"type":43,"tag":52,"props":1719,"children":1720},{},[1721,1722,1727,1729,1735,1737,1742],{"type":49,"value":1663},{"type":43,"tag":58,"props":1723,"children":1725},{"className":1724},[],[1726],{"type":49,"value":1715},{"type":49,"value":1728}," parameter may return 500 errors on Kibana Serverless deployments. Use ",{"type":43,"tag":58,"props":1730,"children":1732},{"className":1731},[],[1733],{"type":49,"value":1734},"find --tags",{"type":49,"value":1736}," for filtering\ninstead, or ",{"type":43,"tag":58,"props":1738,"children":1740},{"className":1739},[],[1741],{"type":49,"value":1314},{"type":49,"value":1743}," to browse recent cases.",{"type":43,"tag":1653,"props":1745,"children":1747},{"id":1746},"find-tags-requires-exact-match",[1748,1753],{"type":43,"tag":58,"props":1749,"children":1751},{"className":1750},[],[1752],{"type":49,"value":1734},{"type":49,"value":1754}," requires exact match",{"type":43,"tag":52,"props":1756,"children":1757},{},[1758,1760,1766],{"type":49,"value":1759},"Tag searches are exact-match only. ",{"type":43,"tag":58,"props":1761,"children":1763},{"className":1762},[],[1764],{"type":49,"value":1765},"find --tags \"agent_id:abc123\"",{"type":49,"value":1767}," works, but partial matches do not.",{"type":43,"tag":67,"props":1769,"children":1771},{"id":1770},"kibana-cases-api-reference",[1772],{"type":49,"value":1773},"Kibana Cases API reference",{"type":43,"tag":52,"props":1775,"children":1776},{},[1777,1779,1785],{"type":49,"value":1778},"For detailed API endpoints, request\u002Fresponse formats, and examples, see\n",{"type":43,"tag":1780,"props":1781,"children":1783},"a",{"href":1782},"references\u002Fkibana-cases-api.md",[1784],{"type":49,"value":1782},{"type":49,"value":1786},".",{"type":43,"tag":67,"props":1788,"children":1790},{"id":1789},"examples",[1791],{"type":49,"value":1792},"Examples",{"type":43,"tag":224,"props":1794,"children":1795},{},[1796,1801,1806],{"type":43,"tag":228,"props":1797,"children":1798},{},[1799],{"type":49,"value":1800},"\"Create a case for the phishing alert I triaged with severity high\"",{"type":43,"tag":228,"props":1802,"children":1803},{},[1804],{"type":49,"value":1805},"\"Search for open cases related to brute force attacks\"",{"type":43,"tag":228,"props":1807,"children":1808},{},[1809],{"type":49,"value":1810},"\"Add the investigation findings as a comment to case ID abc-123\"",{"type":43,"tag":67,"props":1812,"children":1814},{"id":1813},"guidelines",[1815],{"type":49,"value":1816},"Guidelines",{"type":43,"tag":224,"props":1818,"children":1819},{},[1820,1825,1830,1835,1840,1858],{"type":43,"tag":228,"props":1821,"children":1822},{},[1823],{"type":49,"value":1824},"Report only tool output — do not invent IDs, hostnames, IPs, or details not present in the tool response.",{"type":43,"tag":228,"props":1826,"children":1827},{},[1828],{"type":49,"value":1829},"Preserve identifiers from the request — use exact values the user provides in tool calls and responses.",{"type":43,"tag":228,"props":1831,"children":1832},{},[1833],{"type":49,"value":1834},"Confirm actions concisely using the tool's return data.",{"type":43,"tag":228,"props":1836,"children":1837},{},[1838],{"type":49,"value":1839},"Distinguish facts from inference — label conclusions beyond tool output as your assessment.",{"type":43,"tag":228,"props":1841,"children":1842},{},[1843,1845,1849,1851,1856],{"type":49,"value":1844},"When presenting case lists or search results, copy the ",{"type":43,"tag":308,"props":1846,"children":1847},{},[1848],{"type":49,"value":1358},{"type":49,"value":1850}," from each case. Do not paraphrase, abbreviate,\nor summarize titles. Include the total count from the API ",{"type":43,"tag":58,"props":1852,"children":1854},{"className":1853},[],[1855],{"type":49,"value":558},{"type":49,"value":1857}," field.",{"type":43,"tag":228,"props":1859,"children":1860},{},[1861],{"type":49,"value":1862},"Start executing tools immediately. Do not read SKILL.md, browse directories, or list files before acting.",{"type":43,"tag":67,"props":1864,"children":1866},{"id":1865},"production-use",[1867],{"type":49,"value":1868},"Production use",{"type":43,"tag":224,"props":1870,"children":1871},{},[1872,1903,1923],{"type":43,"tag":228,"props":1873,"children":1874},{},[1875,1876,1881,1882,1887,1889,1894,1895,1901],{"type":49,"value":1273},{"type":43,"tag":58,"props":1877,"children":1879},{"className":1878},[],[1880],{"type":49,"value":1279},{"type":49,"value":1281},{"type":43,"tag":58,"props":1883,"children":1885},{"className":1884},[],[1886],{"type":49,"value":1287},{"type":49,"value":1888},") prompt for confirmation. Pass ",{"type":43,"tag":58,"props":1890,"children":1892},{"className":1891},[],[1893],{"type":49,"value":1295},{"type":49,"value":1316},{"type":43,"tag":58,"props":1896,"children":1898},{"className":1897},[],[1899],{"type":49,"value":1900},"-y",{"type":49,"value":1902}," to skip when called by an agent.",{"type":43,"tag":228,"props":1904,"children":1905},{},[1906,1908,1914,1915,1921],{"type":49,"value":1907},"Verify ",{"type":43,"tag":58,"props":1909,"children":1911},{"className":1910},[],[1912],{"type":49,"value":1913},"KIBANA_URL",{"type":49,"value":333},{"type":43,"tag":58,"props":1916,"children":1918},{"className":1917},[],[1919],{"type":49,"value":1920},"KIBANA_API_KEY",{"type":49,"value":1922}," point to the intended cluster before running any command.",{"type":43,"tag":228,"props":1924,"children":1925},{},[1926,1928,1933],{"type":49,"value":1927},"Cases are scoped to ",{"type":43,"tag":58,"props":1929,"children":1931},{"className":1930},[],[1932],{"type":49,"value":63},{"type":49,"value":1934}," — this skill does not affect Observability or other Kibana case owners.",{"type":43,"tag":67,"props":1936,"children":1938},{"id":1937},"environment-variables",[1939],{"type":49,"value":1940},"Environment variables",{"type":43,"tag":365,"props":1942,"children":1943},{},[1944,1965],{"type":43,"tag":369,"props":1945,"children":1946},{},[1947],{"type":43,"tag":373,"props":1948,"children":1949},{},[1950,1955,1960],{"type":43,"tag":377,"props":1951,"children":1952},{},[1953],{"type":49,"value":1954},"Variable",{"type":43,"tag":377,"props":1956,"children":1957},{},[1958],{"type":49,"value":1959},"Required",{"type":43,"tag":377,"props":1961,"children":1962},{},[1963],{"type":49,"value":1964},"Description",{"type":43,"tag":388,"props":1966,"children":1967},{},[1968,1997],{"type":43,"tag":373,"props":1969,"children":1970},{},[1971,1979,1984],{"type":43,"tag":395,"props":1972,"children":1973},{},[1974],{"type":43,"tag":58,"props":1975,"children":1977},{"className":1976},[],[1978],{"type":49,"value":1913},{"type":43,"tag":395,"props":1980,"children":1981},{},[1982],{"type":49,"value":1983},"Yes",{"type":43,"tag":395,"props":1985,"children":1986},{},[1987,1989,1995],{"type":49,"value":1988},"Kibana base URL (e.g., ",{"type":43,"tag":58,"props":1990,"children":1992},{"className":1991},[],[1993],{"type":49,"value":1994},"https:\u002F\u002Fmy-kibana.kb.cloud.example.com",{"type":49,"value":1996},")",{"type":43,"tag":373,"props":1998,"children":1999},{},[2000,2008,2012],{"type":43,"tag":395,"props":2001,"children":2002},{},[2003],{"type":43,"tag":58,"props":2004,"children":2006},{"className":2005},[],[2007],{"type":49,"value":1920},{"type":43,"tag":395,"props":2009,"children":2010},{},[2011],{"type":49,"value":1983},{"type":43,"tag":395,"props":2013,"children":2014},{},[2015],{"type":49,"value":2016},"Kibana API key for authentication",{"type":43,"tag":2018,"props":2019,"children":2020},"style",{},[2021],{"type":49,"value":2022},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2024,"total":2192},[2025,2044,2061,2076,2093,2105,2115,2128,2140,2155,2166,2179],{"slug":2026,"name":2026,"fn":2027,"description":2028,"org":2029,"tags":2030,"stars":2041,"repoUrl":2042,"updatedAt":2043},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2031,2034,2037,2038],{"name":2032,"slug":2033,"type":15},"Analytics","analytics",{"name":2035,"slug":2036,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":2039,"slug":2040,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":2045,"name":2045,"fn":2046,"description":2047,"org":2048,"tags":2049,"stars":2041,"repoUrl":2042,"updatedAt":2060},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2050,2053,2054,2057],{"name":2051,"slug":2052,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":2055,"slug":2056,"type":15},"Engineering","engineering",{"name":2058,"slug":2059,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":2062,"name":2062,"fn":2063,"description":2064,"org":2065,"tags":2066,"stars":2041,"repoUrl":2042,"updatedAt":2075},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2067,2068,2071,2072],{"name":9,"slug":8,"type":15},{"name":2069,"slug":2070,"type":15},"Elasticsearch","elasticsearch",{"name":2039,"slug":2040,"type":15},{"name":2073,"slug":2074,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":2077,"name":2077,"fn":2078,"description":2079,"org":2080,"tags":2081,"stars":23,"repoUrl":24,"updatedAt":2092},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2082,2085,2086,2089],{"name":2083,"slug":2084,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":2087,"slug":2088,"type":15},"Operations","operations",{"name":2090,"slug":2091,"type":15},"Permissions","permissions","2026-07-12T07:46:44.946285",{"slug":2094,"name":2094,"fn":2095,"description":2096,"org":2097,"tags":2098,"stars":23,"repoUrl":24,"updatedAt":2104},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2099,2100,2103],{"name":2083,"slug":2084,"type":15},{"name":2101,"slug":2102,"type":15},"Deployment","deployment",{"name":2069,"slug":2070,"type":15},"2026-07-12T07:46:42.353362",{"slug":2106,"name":2106,"fn":2107,"description":2108,"org":2109,"tags":2110,"stars":23,"repoUrl":24,"updatedAt":2114},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2111,2112,2113],{"name":2083,"slug":2084,"type":15},{"name":2069,"slug":2070,"type":15},{"name":2087,"slug":2088,"type":15},"2026-07-12T07:46:41.097412",{"slug":2116,"name":2116,"fn":2117,"description":2118,"org":2119,"tags":2120,"stars":23,"repoUrl":24,"updatedAt":2127},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2121,2122,2123,2126],{"name":2083,"slug":2084,"type":15},{"name":2069,"slug":2070,"type":15},{"name":2124,"slug":2125,"type":15},"Networking","networking",{"name":13,"slug":14,"type":15},"2026-07-12T07:46:43.675992",{"slug":2129,"name":2129,"fn":2130,"description":2131,"org":2132,"tags":2133,"stars":23,"repoUrl":24,"updatedAt":2139},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2134,2137,2138],{"name":2135,"slug":2136,"type":15},"Authentication","authentication",{"name":2083,"slug":2084,"type":15},{"name":2069,"slug":2070,"type":15},"2026-07-12T07:46:39.783105",{"slug":2141,"name":2141,"fn":2142,"description":2143,"org":2144,"tags":2145,"stars":23,"repoUrl":24,"updatedAt":2154},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2146,2149,2150,2153],{"name":2147,"slug":2148,"type":15},"Audit","audit",{"name":2069,"slug":2070,"type":15},{"name":2151,"slug":2152,"type":15},"Logs","logs",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:35.092599",{"slug":2156,"name":2156,"fn":2157,"description":2158,"org":2159,"tags":2160,"stars":23,"repoUrl":24,"updatedAt":2165},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2161,2162,2163,2164],{"name":2135,"slug":2136,"type":15},{"name":9,"slug":8,"type":15},{"name":2069,"slug":2070,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:47:41.474547",{"slug":2167,"name":2167,"fn":2168,"description":2169,"org":2170,"tags":2171,"stars":23,"repoUrl":24,"updatedAt":2178},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2172,2173,2174,2177],{"name":9,"slug":8,"type":15},{"name":2069,"slug":2070,"type":15},{"name":2175,"slug":2176,"type":15},"RBAC","rbac",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:36.394177",{"slug":2180,"name":2180,"fn":2181,"description":2182,"org":2183,"tags":2184,"stars":23,"repoUrl":24,"updatedAt":2191},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2185,2186,2187,2188],{"name":2032,"slug":2033,"type":15},{"name":2035,"slug":2036,"type":15},{"name":2069,"slug":2070,"type":15},{"name":2189,"slug":2190,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86,{"items":2194,"total":2241},[2195,2202,2208,2214,2221,2227,2234],{"slug":2077,"name":2077,"fn":2078,"description":2079,"org":2196,"tags":2197,"stars":23,"repoUrl":24,"updatedAt":2092},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2198,2199,2200,2201],{"name":2083,"slug":2084,"type":15},{"name":9,"slug":8,"type":15},{"name":2087,"slug":2088,"type":15},{"name":2090,"slug":2091,"type":15},{"slug":2094,"name":2094,"fn":2095,"description":2096,"org":2203,"tags":2204,"stars":23,"repoUrl":24,"updatedAt":2104},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2205,2206,2207],{"name":2083,"slug":2084,"type":15},{"name":2101,"slug":2102,"type":15},{"name":2069,"slug":2070,"type":15},{"slug":2106,"name":2106,"fn":2107,"description":2108,"org":2209,"tags":2210,"stars":23,"repoUrl":24,"updatedAt":2114},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2211,2212,2213],{"name":2083,"slug":2084,"type":15},{"name":2069,"slug":2070,"type":15},{"name":2087,"slug":2088,"type":15},{"slug":2116,"name":2116,"fn":2117,"description":2118,"org":2215,"tags":2216,"stars":23,"repoUrl":24,"updatedAt":2127},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2217,2218,2219,2220],{"name":2083,"slug":2084,"type":15},{"name":2069,"slug":2070,"type":15},{"name":2124,"slug":2125,"type":15},{"name":13,"slug":14,"type":15},{"slug":2129,"name":2129,"fn":2130,"description":2131,"org":2222,"tags":2223,"stars":23,"repoUrl":24,"updatedAt":2139},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2224,2225,2226],{"name":2135,"slug":2136,"type":15},{"name":2083,"slug":2084,"type":15},{"name":2069,"slug":2070,"type":15},{"slug":2141,"name":2141,"fn":2142,"description":2143,"org":2228,"tags":2229,"stars":23,"repoUrl":24,"updatedAt":2154},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2230,2231,2232,2233],{"name":2147,"slug":2148,"type":15},{"name":2069,"slug":2070,"type":15},{"name":2151,"slug":2152,"type":15},{"name":13,"slug":14,"type":15},{"slug":2156,"name":2156,"fn":2157,"description":2158,"org":2235,"tags":2236,"stars":23,"repoUrl":24,"updatedAt":2165},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2237,2238,2239,2240],{"name":2135,"slug":2136,"type":15},{"name":9,"slug":8,"type":15},{"name":2069,"slug":2070,"type":15},{"name":13,"slug":14,"type":15},35]