Kibana Anomaly Detection

It ships with four distinct modes (Investigate, Explain, Troubleshoot, Manage) that map user intent to specific tool chains, so you don't waste time blending RCA logic with score explanation or job configuration. The investigation protocol is concrete: 14 steps from metadata discovery through cross-job entity correlation to source evidence retrieval, with clear rules like "multi-job entities are prime suspects" and "earliest anomaly timestamp wins." The skill understands renormalization, multi-bucket impact scoring, and the three-layer structure of the `.ml-anomalies-*` indices. You'll want this when answering "what broke and which entity caused it" or debugging why a datafeed stopped, not for general Elasticsearch queries.