security-alert-triage

Name: security-alert-triage
Availability: InStock
Author: elastic

Automate triage of Elastic Security alerts with ES|QL queries and case management.

546|44|Updated Mar 6, 2026

Search Tags:#investigation #security #incident response #alerting #triage #elastic security

Ready to run

npx skills add https://github.com/elastic/agent-skills --skill security-alert-triage-elastic

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-alert-triage
Source: https://github.com/elastic/agent-skills/tree/main/skills/security/alert-triage
Command: npx skills add https://github.com/elastic/agent-skills --skill security-alert-triage-elastic

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the process of investigating and responding to security alerts, reducing manual effort and improving response times for security analysts.

Core Features & Use Cases

Automated Alert Triage: Fetches, investigates, and acknowledges security alerts.
Context Gathering: Runs queries to gather relevant information about alerts.
Case Management Integration: Creates and updates cases with findings.
Use Case: When a new critical alert fires, this Skill can automatically fetch it, gather related process and network information, create a case, and acknowledge the alert, allowing analysts to focus on high-priority threats.

Quick Start

Fetch the next unacknowledged alert and begin its triage process.

Frequently Asked Questions about security-alert-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate security alert triage in Elastic Security?▼

Automating security alert triage involves fetching, investigating, and acknowledging Elastic Security alerts programmatically. This Skill automates that workflow by gathering context through ES|QL queries and managing cases via the Kibana case management API.

Can I create and update cases automatically when investigating Elastic Security alerts?▼

Yes, you can create and update cases automatically when investigating Elastic Security alerts. This Skill integrates with the case management API to log findings and contextual data directly into cases during the alert triage process.

How do I gather context for an incident response using ES|QL queries?▼

Gathering context for incident response uses ES|QL queries to extract related process and network information. This Skill runs these queries against Elasticsearch to enrich the investigation of security alerts before acknowledging them.

Do I need Node.js to acknowledge Elastic Security alerts in bulk?▼

Yes, Node.js is required to acknowledge Elastic Security alerts in bulk or individually. The Skill also requires network access to both Elasticsearch and Kibana to fetch alerts and interact with the case management API.

What is the best way to handle critical security alerts without manual investigation?▼

Handling critical security alerts without manual investigation is best done by automating the triage process. This Skill fetches unacknowledged alerts, enriches them with process and network data, creates a case, and acknowledges the alert to reduce analyst workload.

Why does automated alert triage fail to fetch context for incident response?▼

Automated alert triage fails to fetch context if there is no network access to Elasticsearch and Kibana. The Skill depends on this connectivity to execute ES|QL queries and interact with the Elastic Security APIs for alert investigation.