security-alert-triage
Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge. Use when triaging alerts, performing SOC analysis, or investigating detections.
Install
With your agent
Install OMGSkills skill "elastic/claude-plugin:skills/security/alert-triage" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/elastic/claude-plugin /tmp/claude-plugin && ln -s /tmp/claude-plugin/skills/security/alert-triage ~/.claude/skills/security-alert-triageFrom README
Alert Triage Analyze Elastic Security alerts one at a time: gather context, classify, create a case, and acknowledge. This skill depends on the case-management skill for case creation. Prerequisites dependencies before first use from the skills/security directory: Set the required environment variables (or add them to a .env file in the workspace root): All commands from workspace root. Always fetch → investigate → document → acknowledge. Call the tools directly — do not read the skill file or explore the workspace first.
More from this repo
cloud-onboarding
Onboard an Elastic Cloud organization: configure the `elastic` CLI's Cloud context and API key, establish a default...
cloud-provisioning
Provision and operate Elastic Cloud infrastructure: create, connect to, update, and delete Serverless projects...
elasticsearch-anomaly-detection
Used to create and manage Elastic ML anomaly detection jobs via the API.