security-alert-triage

Automating security alert triage involves orchestrating alert review, contextual enrichment, and investigation workflows. This Skill automates that end-to-end process within Elastic Security, pulling host, user, and process context to guide containment decisions.

Enriching security alerts requires pulling related host, user, and process information to inform investigation decisions. This Skill automates contextual enrichment by querying Elasticsearch and Kibana APIs to gather process-tree lookups and relevant entity data.

Creating and managing cases from security alerts is supported through integration with the manage_cases functionality. This Skill orchestrates case creation and updates alert statuses directly, allowing investigators to escalate, exempt, or close alerts with automated actions.

An end-to-end alert investigation workflow handles resolution by guiding reviewers through alert review, enrichment, and verdict determination. This Skill provides one-click verdicts with automated actions to escalate, exempt, or close alerts based on the gathered context.

Running automated alert triage workflows in this Skill requires integrating with Elasticsearch and Kibana APIs. These dependencies are utilized to execute esql queries, perform process-tree lookups, and orchestrate alert status updates within Elastic Security.