Kibana Anomaly Detection

This is a thorough implementation of Elastic ML anomaly detection workflows through Kibana's Agent Builder MCP surface. It ships with four distinct modes (Investigate, Explain, Troubleshoot, Manage) that map user intent to specific tool chains, so you don't waste time blending RCA logic with score explanation or job configuration. The investigation protocol is concrete: 14 steps from metadata discovery through cross-job entity correlation to source evidence retrieval, with clear rules like "multi-job entities are prime suspects" and "earliest anomaly timestamp wins." The skill understands renormalization, multi-bucket impact scoring, and the three-layer structure of the `.ml-anomalies-*` indices. You'll want this when answering "what broke and which entity caused it" or debugging why a datafeed stopped, not for general Elasticsearch queries.

Install to Claude Code

npx -y skills add elastic/agent-skills --skill kibana-anomaly-detection --agent claude-code