القائمة
Interactive guide for complete Elastic Security setup — discovers data sources, assesses detection coverage, configures rules, and creates security dashboards.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Debug and analyze LLM eval runs — view traces, compare runs, investigate failures, track costs. Use when debugging @kbn/evals failures, comparing eval runs, or analyzing LLM performance.
Start your security session with a personalized briefing — attacks, alerts, cases, rules, threat intel. Use as the first thing when starting security work.
Guide users from zero to a working Elastic cluster — Cloud or on-prem, connection config, first queries, and next steps.
Interactive guide for creating an APM service overview dashboard — discovers service data, presents metrics, and creates a tailored dashboard.
Interactive guide for creating SLOs from discovered APM and metric data — identifies candidates, lets user configure targets, and creates SLOs.
Create, configure, and manage Elasticsearch indices — mappings, settings, templates, data streams, and lifecycle policies.
| name | security-full-setup |
| description | Interactive guide for complete Elastic Security setup — discovers data sources, assesses detection coverage, configures rules, and creates security dashboards. |
Guide the user through a complete Elastic Security configuration for their deployment.
Use when the user asks to:
Also activates on keywords: "security setup", "SIEM setup", "security onboarding", "detection coverage", "security posture assessment"
Do NOT use when:
security-detection-engineering)security-alert-triage)Call get_cluster_context to get cached cluster awareness — version, health, installed features, and security capabilities. This determines which security features are available and what data is already flowing.
Call discover_security_data with no filters to get a complete picture of available security data.
Present the results to the user as a summary:
Call get_security_summary with the discovery results.
Present the posture assessment:
Based on the gaps identified, ask the user which areas to improve:
Fast-track alternative: For a quick setup, use siem_quickstart to automatically enable the most impactful prebuilt rules based on available data sources. This skips manual rule selection and is ideal for initial deployments.
For each approved rule category, call manage_detection_rules with operation: "bulk_enable" and the appropriate filters.
Report results:
Ask the user if they want threshold-based alerting on security metrics:
For each approved alert, call kibana_api with POST /api/alerting/rule and the configured parameters.
Ask the user if they want a security overview dashboard:
Call kibana_api with POST /api/dashboards/dashboard and the selected dashboard configuration.
Present a final summary:
get_cluster_context — cached cluster awareness (version, health, capabilities)discover_security_data — discover security data sources, rules, and alertsget_security_summary — generate posture assessment with gaps and recommendationssiem_quickstart — fast-track prebuilt rule enablement based on available datamanage_detection_rules — enable/disable detection rules in bulkkibana_api — create dashboards (POST /api/dashboards/dashboard), alert rules (POST /api/alerting/rule), and query rules (GET /api/detection_engine/rules/_find)elastic://docs/api/kibana — Kibana REST API reference for security, dashboard, and alerting endpointselastic://docs/api/security — Security-specific API reference for cases, exceptions, and timelinesES_URL and ES_API_KEY (or basic auth) configuredKIBANA_URL configured for detection rule and dashboard managementsecurity-detection-engineering — create custom detection rules for specific threatssecurity-alert-triage — investigate and triage security alertssecurity-case-management — track and manage security investigationssecurity-threat-hunting — proactive threat hunting with ES|QL