security-alert-triage
Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge. Use when triaging alerts, performing SOC analysis, or investigating detections.
- Version
- 0.1.0
- Compatibility
- Requires Node.js 22+, network access to Elasticsearch. Environment variables: ELASTICSEARCH_URL or ELASTICSEARCH_CLOUD_ID, plus ELASTICSEARCH_API_KEY or ELASTICSEARCH_USERNAME/ELASTICSEARCH_PASSWORD.
Pinned to revision 4e8964e24a5a, so it is the text this page describes rather than whatever the author pushed since.
Files
- skills/alert-triage/SKILL.md
- skills/alert-triage/references/classification-guide.md
- skills/alert-triage/scripts/acknowledge-alert.js
- skills/alert-triage/scripts/es-client.js
- skills/alert-triage/scripts/fetch-next-alert.js
- skills/alert-triage/scripts/kibana-client.js
- skills/alert-triage/scripts/run-query.js
Every link opens the file at its source, pinned to the revision this page describes.