Security Alert Triage

If you're running Elastic Security and drowning in alerts, this handles the tedious part of triage. It analyzes alerts one by one, gathers context, classifies them, and can create cases or acknowledge them directly in your Elastic environment. Built by the Elastic team, so it knows the data structures and API quirks. The setup requires some environment variables and a dependency on their case-management skill, which is typical for the agent-skills repo approach. It's basically workflow automation for the repetitive investigation steps you'd otherwise do manually in Kibana. Saves time if you're already in the Elastic ecosystem and tired of clicking through the same alert patterns.

Install to Claude Code

npx -y skills add elastic/agent-skills --skill security-alert-triage --agent claude-code