security-detection-rule-management
Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint). Use for false positives, exceptions, new coverage, noisy rules, or rule management via Kibana API.
Install
With your agent
Install OMGSkills skill "elastic/claude-plugin:skills/security/detection-rule-management" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/elastic/claude-plugin /tmp/claude-plugin && ln -s /tmp/claude-plugin/skills/security/detection-rule-management ~/.claude/skills/security-detection-rule-managementFrom README
Detection Rule Management Create new detection rules for emerging threats and coverage gaps, and tune existing rules to reduce false positives. All operations use the Kibana Detection Engine API via rule-manager.js. Execution rules Start executing tools immediately — do not read SKILL.md, browse the workspace, or list files first. Report tool output faithfully. Copy rule IDs, names, alert counts, exception IDs, and error messages exactly as returned by the API. Do not abbreviate rule UUIDs, invent rule names, or round alert counts. When a tool returns an error (rule not found, API failure), report the exact error — do not guess at alternatives.
More from this repo
cloud-onboarding
Onboard an Elastic Cloud organization: configure the `elastic` CLI's Cloud context and API key, establish a default...
cloud-provisioning
Provision and operate Elastic Cloud infrastructure: create, connect to, update, and delete Serverless projects...
elasticsearch-anomaly-detection
Used to create and manage Elastic ML anomaly detection jobs via the API.