esdiag-releasePrepare and verify ESDiag numbered releases, with explicit human approval for publication. Use when cutting a maintenance branch, setting a stable version, drafting notes, publishing containers or crates.io crates, creating a numeric tag, attaching native…esdiagCollect, share, process, or analyze Elasticsearch, Kibana, and Logstash diagnostics with `esdiag`. Setup or install esdiag tools; Ask Kibana Agent Builder diagnostic questions.esdiagCollect, share, process, or analyze Elasticsearch, Kibana, and Logstash diagnostics with `esdiag`. Setup or install esdiag tools; Ask Kibana Agent Builder diagnostic questions.changelogMaintain `CHANGELOG.md` entries using Keep a Changelog 1.1.0 conventions. Use when adding or reviewing changelog entries, preparing unreleased notes for a PR, or checking whether changelog bullets are correctly scoped and referenced during PR review workflows.agentic-diagnostic-assistantAnalyze Elasticsearch diagnostic bundles and ESDiag diagnostic dashboards for cluster health, ingest/search performance, shard sizing and allocation, ILM/lifecycle behavior, node/host capacity, hotspots, thread pool pressure, and storage efficiency. Use when…
repository explorer
elastic · Repositories and representative skills - Page 2
Repository-level view of 266 collected skills across 32 GitHub repositories.
alert-triageTriage Elastic Security alerts — fetch, investigate, classify threats, create cases, and acknowledge. Use when triaging alerts, performing SOC analysis, investigating detections, reviewing security incidents, or when the user mentions ransomware, malware,…attack-discovery-triageTriage Elastic Security Attack Discovery findings — fetch correlated attack narratives, assess confidence with entity risk and rule frequency signals, and present an interactive triage dashboard for approval, case creation, and acknowledgment. Use when…case-managementCreate, search, update, and manage SOC cases for Elastic Security. ALWAYS use this skill when the user mentions cases, incidents, investigations, or asks to see, show, list, open, create, update, or search cases. Trigger for: "show me my cases", "open cases",…detection-rule-managementCreate, tune, and manage Elastic Security detection rules. Use for false positive tuning, adding exceptions, creating new detection coverage, finding noisy rules, enabling/disabling rules, or any detection engineering task. Also trigger for "detection rules",…generate-sample-dataGenerate sample security events, attack scenarios, and synthetic alerts for Elastic Security. Use when demoing, populating dashboards, testing detection rules, setting up a POC, or when the user asks for test data, demo data, or sample alerts.
ref-resolutionUse any time a branch, tag, or version in the user's question is ambiguous or unspecified - whether at the start of a question or mid-conversation (e.g. when comparing behavior across versions).subagent-orchestrationUse when a request decomposes into multiple independent subtasks that can be worked on separately and combined afterward.code-searchUse when you need to find where something is defined, understand how a feature is implemented, or explore an unfamiliar repo. Guides which tools to use and in what order.repo-discoveryUse at the start of most questions to identify which repos are indexed before querying content. Also use mid-conversation when an answer may require expanding into a related or upstream repo (e.g. tracing from an application repo into a lower-level…code-citationsUse whenever an answer names a code symbol, class, function, config key, endpoint, file, directory, or file extension - or makes any checkable claim about repository behavior (a default value, a version, a recall/latency figure, a behavioral guarantee). This…
elastic-cli-usageGuides execution of elasticsearch CLI commands via elastic_cli, resolves serverless-specific errors, and routes tasks between CLI and MCP/Kibana API tools. Use when running es or kb commands, debugging elastic CLI argument syntax, hitting 410 serverless…elasticsearch-esqlUse this skill when writing or debugging ES|QL queries for Elasticsearch. Activate when the user asks to query logs, metrics, traces, or any Elasticsearch data using ES|QL syntax.observability-rcaUse this skill when performing root cause analysis on incidents detected by Elastic Observability. Activate when the user reports a production issue, outage, degraded performance, or asks to investigate alerts.slo-managementUse this skill when working with Elastic SLOs (Service Level Objectives). Activate when the user asks about SLO status, burn rates, error budgets, or needs to create and manage SLO definitions.
accessing-benchmark-resultsRetrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g.…developing-rallyWork on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.running-benchmarksRun Rally benchmarks (races) against Elasticsearch — an existing/external cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting…
package-spec-releasePrepares a package-spec release branch from elastic/main, finalizes spec/changelog.yml, updates compliance CI matrix, reviews Go toolchain (prompts whether to adopt a newer Go minor when stable releases are ahead, otherwise patch-only .go-version), updates…review-prReview a package-spec pull request or branch for completeness and correctness. Use when the user asks to review a PR, check their branch is ready to merge, verify they have not missed required changes, or wants a pre-submission checklist. Accepts a PR number,…open-pull-requestDrafts or opens a GitHub pull request body that matches this repository’s .github/PULL_REQUEST_TEMPLATE.md, keeps What/Why concise, and fills Related issues with links to issues, PRs, or other repos. Use when the user asks to open a PR, create a pull request,…
ecs-pr-triageTriages an ECS pull request. Analyzes the PR diff and metadata, classifies the change (schema / tooling / docs / mixed), routes it to the correct contribution path (direct PR vs RFC Proposal vs needs-discussion), checks PR completeness, and produces a…ecs-rfc-guideGuides contributors through the Elastic Common Schema (ECS) RFC (Proposal) process: template sections, target maturity (alpha/beta), rfcs/text artifacts, and optional OTel mapping. Use when a change needs an RFC, when drafting or reviewing RFC PRs, or when…
migrate-required-input-dependencyMigrate an Elastic integration package from a legacy inline agent template to integrations with required input dependencies (`requires.input`, `streams[].package`). Gathers developer decisions on dataset naming, variable overrides, stack constraints, and…validate-integration-docsLint an Elastic integration package's markdown with vale and propose fixes. Use when the user says "vale check," "lint docs," "validate the README," "check integration markdown," or wants to polish an integration's docs before opening a PR. Filters out false…
add-packageUse this skill when adding a new package to the esql-js Yarn Workspaces monorepo — either splitting an existing subsystem out of packages/esql/ (unbundling) or creating a brand-new package. Covers every config file the package needs (build, tests, storybook),…grammar-sync-updateUse this skill when a grammar sync PR has landed (updating packages/esql/src/parser/antlr/) and a follow-up PR is needed to wire a new ES|QL command or update an existing one in the AST layer. Covers all files that need changes and the exact patterns to…
prCreate a GitHub pull request with a focused why/what body. Use when the user asks to open a PR, create a pull request, or ship a branch.create-agentic-workflowScaffold a new gh-aw agentic workflow in docs-actions. Use when the user wants to add a new agentic workflow, create a docs automation, or build a new scheduled audit/fix workflow for Elastic documentation.
rtest-case-memoUse when asked to draft a short case memo for a Cortex compliance investigation. Provides the fixed memo layout used by the fictional Cortex financial firm.rtest-citation-formatUse when writing or reviewing a Cortex compliance finding that cites a source document. Defines the citation format for Cortex case notes.