security-alert-triage

Automating security alert triage involves fetching, investigating, and acknowledging Elastic Security alerts programmatically. This Skill automates that workflow by gathering context through ES|QL queries and managing cases via the Kibana case management API.

Yes, you can create and update cases automatically when investigating Elastic Security alerts. This Skill integrates with the case management API to log findings and contextual data directly into cases during the alert triage process.

Gathering context for incident response uses ES|QL queries to extract related process and network information. This Skill runs these queries against Elasticsearch to enrich the investigation of security alerts before acknowledging them.

Yes, Node.js is required to acknowledge Elastic Security alerts in bulk or individually. The Skill also requires network access to both Elasticsearch and Kibana to fetch alerts and interact with the case management API.

Handling critical security alerts without manual investigation is best done by automating the triage process. This Skill fetches unacknowledged alerts, enriches them with process and network data, creates a case, and acknowledges the alert to reduce analyst workload.

Automated alert triage fails to fetch context if there is no network access to Elasticsearch and Kibana. The Skill depends on this connectivity to execute ES|QL queries and interact with the Elastic Security APIs for alert investigation.