security-alert-triage
elasticTurn security alerts into documented, acknowledged cases.
security operations
What it does
Analyzes Elastic Security alerts, documents classifications in cases, and acknowledges the investigated alerts.
When to use it
Use when triaging alerts, performing SOC analysis, or investigating detections.
How to use it
Give it an alert-triage request; it investigates the alerts, creates or updates a case, and acknowledges related alerts.
Uses
Access · 4
This skill
Elastic Security alerts
Acknowledges Elastic Security alerts (irreversible)
Kibana cases
Creates and updates Kibana cases
Elasticsearch
Reads alerts and security telemetry
npm install
Installs the skill dependencies
Good to know
- cannot be undone: Elastic Security alerts
- acts without asking
What you need · 8
Requires Node.js 22 or newer.
The scripts import the Elasticsearch client package.
Requires network access to an Elasticsearch deployment.
Requires a Kibana deployment for case management.
About this skill
- Visibility
- Public
- Repository
- elastic/agent-skills
- Created
- Oct 8, 2026
- Updated
- Oct 8, 2026
- Files
- 7