security-detection-rule-management

Elastic agent skill for executing ES|QL (Elasticsearch Query Language) queries. Use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or build charts and dashboards from ES|QL results.

Create and manage Kibana dashboards and visualizations declaratively via the new Kibana 9.4+ APIs — minimal, diffable payloads suited for GitOps, version control, and LLM-assisted generation.

An official Elastic agent skill for searching and analyzing observability logs in Elasticsearch and Kibana. Part of a curated skills library teaching AI agents correct Elastic platform patterns.

Authenticate to Elasticsearch across all supported realms — native, file-based, LDAP/AD, SAML, OIDC, Kerberos, JWT, and certificate — plus the full API key lifecycle. Covers credential verification and deployment differences across self-managed, ECH, and Serverless without ever prompting the user for secrets in chat.

Help developers new to Elasticsearch get from zero to a working search experience. Guide them through understanding their intent, mapping their data, and building a search experience with best practices baked in.

Teaches AI agents how to ingest files into Elasticsearch, covering document indexing, file processing pipelines, and data ingestion workflows as part of the official Elastic Agent Skills library.

Teaches AI agents how to create, manage, and configure Kibana alerting rules in the Elastic Stack, part of Elastic's official Agent Skills library for working with Elasticsearch, Kibana, and Elastic Security.

Official Elastic skill for enabling, configuring, and querying Elasticsearch security audit logs — covering audit setup, event filtering, and investigation of security incidents such as failed logins.

An official Elastic agent skill for building Kibana agents. Part of a curated library teaching AI agents correct patterns for Elasticsearch, Kibana, Elastic Observability, and Elastic Security.

Manage Elasticsearch RBAC — native users, custom roles, role mappings, and document- / field-level security — including Kibana feature/space privileges and Mustache-template role assignment from external realms like LDAP, SAML, and PKI. Covers feature differences across self-managed, ECH, and Serverless deployments.