القائمة
Create, search, update, and manage SOC cases via the Kibana Cases API. Use when tracking incidents, linking alerts to cases, adding investigation notes, or managing triage output.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.
Authenticate to Elasticsearch using native, file-based, LDAP/AD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys.
Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP/SAML.
Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.
Ingest and transform data files (CSV/JSON/Parquet/Arrow IPC) into Elasticsearch with stream processing and custom transforms. Use when loading files or batch importing data.
Diagnose and resolve Elasticsearch security errors: 401/403 failures, TLS problems, expired API keys, role mapping mismatches, and Kibana login issues. Use when the user reports a security error.
| name | security-case-management |
| description | Create, search, update, and manage SOC cases via the Kibana Cases API. Use when tracking incidents, linking alerts to cases, adding investigation notes, or managing triage output. |
| metadata | {"author":"elastic","version":"0.1.0","source":"elastic/agent-skills//skills/security/case-management"} |
Manage SOC cases through the Kibana Cases API. All cases scoped to securitySolution.
export KIBANA_URL="https://your-cluster.kb.cloud.example.com:443"
export KIBANA_API_KEY="your-kibana-api-key"
# Create
node skills/security/case-management/scripts/case-manager.js create \
--title "Malicious DLL sideloading on host1" \
--description "Crypto clipper malware detected..." \
--tags "classification:malicious" "confidence:88" "mitre:T1574.002" \
--severity critical --yes
# Find by tags or search
node skills/security/case-management/scripts/case-manager.js find --tags "agent_id:<id>"
node skills/security/case-management/scripts/case-manager.js find --search "DLL sideloading" --status open
# List, get
node skills/security/case-management/scripts/case-manager.js list --status open --per-page 10
node skills/security/case-management/scripts/case-manager.js get --case-id <case_id>
# Attach alert
node skills/security/case-management/scripts/case-manager.js attach-alert \
--case-id <case_id> --alert-id <alert_id> --alert-index <index> \
--rule-id <rule_uuid> --rule-name "<name>"
# Attach multiple alerts (batch)
node skills/security/case-management/scripts/case-manager.js attach-alerts \
--case-id <case_id> --alert-ids <id1> <id2> \
--alert-index <index> --rule-id <uuid> --rule-name "<name>"
# Add comment, update
node skills/security/case-management/scripts/case-manager.js add-comment \
--case-id <case_id> --comment "Process tree analysis shows..."
node skills/security/case-management/scripts/case-manager.js update \
--case-id <case_id> --status closed --severity low --yes
| Tag pattern | Example | Purpose |
|---|---|---|
classification:<value> | classification:malicious | Triage classification |
confidence:<score> | confidence:85 | Confidence score 0-100 |
mitre:<technique> | mitre:T1574.002 | MITRE ATT&CK technique |
agent_id:<id> | agent_id:550888e5-... | Agent ID for correlation |
| Classification | Kibana severity |
|---|---|
| benign (score 0-19) | low |
| unknown (score 20-60) | medium |
| malicious (score 61-80) | high |
| malicious (score 81-100) | critical |
--yes to skip.