skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-alert-triage-with-elastic-siem

Classify, prioritize, and investigate security alerts in Elastic Security SIEM using ES|QL queries.

954|172|Updated Mar 13, 2026
Search Tags:#threat detection#elastic#siem#SoC#esql#alert triage#Kibana
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-alert-triage-with-elastic-siem
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-alert-triage-with-elastic-siem
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/soc-operations/performing-alert-triage-with-elastic-siem
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-alert-triage-with-elastic-siem

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SOC analysts face high volumes of Elastic Security alerts and need a structured workflow to rapidly classify them as true positives, benign true positives, or false positives without missing attack chains or misreading risk scores.

Core Features & Use Cases

  • Structured 5-Step Triage Workflow: Initial assessment, context gathering with ES|QL queries, threat intelligence enrichment, classification, and documentation in roughly 10 minutes per alert cluster.
  • Ready-to-Use ES|QL Queries: Pre-built queries for finding related events, tracking suspicious users across hosts, correlating alerts by source IP, and checking indicators against threat intelligence feeds.
  • Prioritization Matrix and KPIs: Risk-score-to-SLA mapping and triage metrics (MTTT, false positive rate, escalation rate) to measure SOC performance.
  • Use Case: An analyst sees a high-severity brute-force alert, runs the provided ES|QL queries to pivot on source.ip over 24 hours, discovers a failed-logins-then-success chain across multiple hosts, and escalates it as a true positive with documented evidence.

Quick Start

Triage the open critical alerts in my Elastic Security deployment and classify each one with supporting ES|QL evidence.

Frequently Asked Questions about performing-alert-triage-with-elastic-siem

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage alerts in Elastic Security SIEM?▼

Alert triage in Elastic Security follows a five-step workflow: assess severity and risk score, gather context with ES|QL queries on related events, enrich with threat intelligence, classify as true positive or false positive, and document the decision. A structured triage typically takes 5-10 minutes per alert cluster.

How to write ES|QL queries to investigate Elastic Security alerts?▼

Use ES|QL to query indices like logs-endpoint.events.* or .alerts-security.alerts-default, filtering by host.name, user.name, or source.ip with STATS aggregations. For example, count events by category for an affected host over the past hour to find related activity.

What is the difference between risk score and severity in Elastic Security?▼

Risk score (kibana.alert.risk_score) is a rule-authored numeric value that is not calibrated to your asset criticality, while severity is a categorical label. A score of 73 on a domain controller may outrank a 90 on a test box, so always cross-reference asset context.

Why do Elastic detection rules show empty alert context fields?▼

Empty fields usually mean the data source is not normalized to the Elastic Common Schema (ECS), so fields like user.name or source.ip are null. Verify ECS field presence with an ES|QL KEEP/STATS query before trusting a no-related-activity result.

When should I close an alert as a false positive versus benign true positive?▼

Close as benign true positive when expected behavior matches the rule, such as an admin running PowerShell, and exception the asset or user. Mark false positive only when the rule logic itself misfires, then create a tuning task rather than broadening the rule.

Related Skills

Explore More Software Engineering Skills→
patrykkopycinskipatrykkopycinski
6

siem-quickstart

Discover security telemetry sources and summarize posture for Elastic Security.

Community
Intermediate
rkz91rkz91
264

pmstudio-irp

Generate a product-specific Incident Response Plan as a self-contained HTML document.

Community
Advanced
Muath2000Muath2000

threat-intel-engineer

Integrate, normalize, and correlate cyber threat data from STIX/TAXII feeds.

Community
Advanced
patrykkopycinskipatrykkopycinski
6

security-alert-triage

Automate end-to-end security alert triage within Elastic Security.

Community
Advanced