Investigate security alerts and document cases.
What it does
Investigates Elastic Security alerts, classifies threats, records findings in cases, and acknowledges related alerts.
When to use it
Use when triaging alerts, performing SOC analysis, or investigating detections.
How to use it
Ask it to triage alerts; it investigates them, creates or updates cases with findings, and acknowledges the alerts.
Uses
Good to know
- cannot be undone: Kibana
- acts without asking
Latest review
What you need · 10
Requires Node.js 22 or later to run the scripts.
Requires a reachable Elasticsearch cluster configured through ELASTICSEARCH_URL or ELASTICSEARCH_CLOUD_ID.
Access · 3
This skill
Kibana
Write
Records cases and acknowledges alerts (irreversible)
Elasticsearch
Read
Reads alerts and endpoint activity