# kibana-anomaly-detection

> Claude/Codex skill by [@elastic](https://omgskills.com/library/elastic/index.md) · 4 stars · Updated 2026-10-23

Elastic ML anomaly detection — investigation/RCA, score explanation, job lifecycle troubleshooting, and job operations. Use when answering "what broke?"/"which entity?"/RCA, "why is score high/low?"/renormalization, "datafeed stopped"/"memory limit"/hard\_limit, or configuring ML anomaly detection jobs. Reads results from \`.ml-anomalies-\*\` and job state from ML REST APIs.

## Install

```sh
git clone https://github.com/elastic/claude-plugin /tmp/claude-plugin && ln -s /tmp/claude-plugin/skills/kibana/kibana-anomaly-detection ~/.claude/skills/kibana-anomaly-detection
```

## From README

Elastic ML Anomaly Detection Expert process for ML anomaly detection: attribute incidents to entities, explain scores and model behavior, diagnose job lifecycle failures, and manage jobs. Read anomaly results from POST /.ml-anomalies-/search (Serverless-safe) and job/datafeed state from ML REST APIs. When the user embeds fixture evidence (influencer rows, job stats) in the prompt, apply the judgment below directly — do not re-fetch fields already supplied. Environment Configuration This skill executes Elasticsearch operations through the elastic CLI. If the elastic CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds. This skill references operations in HTTP-shorthand form (e.g., GET /, GET /cat/indices, GET /{index}/mapping, GET /{index}/settings/index.mode, POST /query).

## Links

- HTML page: https://omgskills.com/library/elastic/claude-plugin/skills/kibana/kibana-anomaly-detection/
- GitHub: https://github.com/elastic/claude-plugin
- Author: [@elastic](https://omgskills.com/library/elastic/index.md)

## More from this repo

- [cloud-onboarding](https://omgskills.com/library/elastic/claude-plugin/skills/cloud/onboarding/index.md) — Onboard an Elastic Cloud organization: configure the \`elastic\` CLI's Cloud context and API key, establish a default...
   - [@elastic](https://omgskills.com/library/elastic/index.md) · 4 stars
- [cloud-provisioning](https://omgskills.com/library/elastic/claude-plugin/skills/cloud/provisioning/index.md) — Provision and operate Elastic Cloud infrastructure: create, connect to, update, and delete Serverless projects...
   - [@elastic](https://omgskills.com/library/elastic/index.md) · 4 stars
- [elasticsearch-anomaly-detection](https://omgskills.com/library/elastic/claude-plugin/skills/elasticsearch/elasticsearch-anomaly-detection/index.md) — Used to create and manage Elastic ML anomaly detection jobs via the API.
   - [@elastic](https://omgskills.com/library/elastic/index.md) · 4 stars