Security Detection Rule Management

If you're managing Elastic Security detection rules and dealing with noisy alerts, this handles the entire tuning workflow through Kibana's Detection Engine API. You can identify the noisiest rules, investigate false positive patterns by querying the alerts index, then tune them by adding exceptions, tightening queries, or adjusting thresholds. It includes dedicated tooling for both SIEM and endpoint behavior rules, with the workflow pushing you to investigate alert patterns before making changes. The skill comes with clear multi-step workflows for common scenarios like tuning a specific noisy rule or adding exceptions scoped to endpoint behaviors. Requires your Elasticsearch and Kibana credentials, Node.js 22+, and follows a strict execution model that skips the usual file browsing in favor of immediate action.

Install to Claude Code

npx -y skills add elastic/agent-skills --skill security-detection-rule-management --agent claude-code