# security-alert-triage

> Claude/Codex skill by [@elastic](https://omgskills.com/library/elastic/index.md) · 4 stars · Updated 2026-10-23

Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge. Use when triaging alerts, performing SOC analysis, or investigating detections.

## Install

```sh
git clone https://github.com/elastic/claude-plugin /tmp/claude-plugin && ln -s /tmp/claude-plugin/skills/security/alert-triage ~/.claude/skills/security-alert-triage
```

## From README

Alert Triage Analyze Elastic Security alerts one at a time: gather context, classify, create a case, and acknowledge. This skill depends on the case-management skill for case creation. Prerequisites dependencies before first use from the skills/security directory: Set the required environment variables (or add them to a .env file in the workspace root): All commands from workspace root. Always fetch → investigate → document → acknowledge. Call the tools directly — do not read the skill file or explore the workspace first.

## Links

- HTML page: https://omgskills.com/library/elastic/claude-plugin/skills/security/alert-triage/
- GitHub: https://github.com/elastic/claude-plugin
- Author: [@elastic](https://omgskills.com/library/elastic/index.md)

## More from this repo

- [cloud-onboarding](https://omgskills.com/library/elastic/claude-plugin/skills/cloud/onboarding/index.md) — Onboard an Elastic Cloud organization: configure the \`elastic\` CLI's Cloud context and API key, establish a default...
   - [@elastic](https://omgskills.com/library/elastic/index.md) · 4 stars
- [cloud-provisioning](https://omgskills.com/library/elastic/claude-plugin/skills/cloud/provisioning/index.md) — Provision and operate Elastic Cloud infrastructure: create, connect to, update, and delete Serverless projects...
   - [@elastic](https://omgskills.com/library/elastic/index.md) · 4 stars
- [elasticsearch-anomaly-detection](https://omgskills.com/library/elastic/claude-plugin/skills/elasticsearch/elasticsearch-anomaly-detection/index.md) — Used to create and manage Elastic ML anomaly detection jobs via the API.
   - [@elastic](https://omgskills.com/library/elastic/index.md) · 4 stars