Cut false alarms in Elastic Security rules.
What it does
Creates and tunes Elastic Security detection rules to cover threats and reduce false positives.
When to use it
Use for false positives, exceptions, coverage gaps, noisy rules, or detection-rule management through Kibana.
How to use it
Give it a detection-rule creation or tuning request; it applies rule and exception changes through Kibana.
Uses
Good to know
- cannot be undone: Kibana
- acts without asking
Latest review
What you need · 12
Requires Node.js 22 or later.
Requires a reachable Kibana instance configured through KIBANA_URL.
Access · 4
This skill
Kibana
Write
Changes detection rules and exceptions (irreversible)
Elasticsearch
Read
Queries security alerts and events