Menu
Build automation and workflows with alerting, ingest pipelines, security, and Agent Builder
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Debug and analyze LLM eval runs — view traces, compare runs, investigate failures, track costs. Use when debugging @kbn/evals failures, comparing eval runs, or analyzing LLM performance.
Start your security session with a personalized briefing — attacks, alerts, cases, rules, threat intel. Use as the first thing when starting security work.
Guide users from zero to a working Elastic cluster — Cloud or on-prem, connection config, first queries, and next steps.
Interactive guide for creating an APM service overview dashboard — discovers service data, presents metrics, and creates a tailored dashboard.
Interactive guide for creating SLOs from discovered APM and metric data — identifies candidates, lets user configure targets, and creates SLOs.
Create, configure, and manage Elasticsearch indices — mappings, settings, templates, data streams, and lifecycle policies.
| name | elastic-workflows |
| description | Build automation and workflows with alerting, ingest pipelines, security, and Agent Builder |
Use this skill when the user wants to set up automation or workflows on Elastic: alerting, ingest pipelines, security detection/response, or orchestration with Agent Builder.
create_alert_rule and list_alert_rules (Observability). In Kibana, add connectors and attach to rules.create_ingest_pipeline and list_ingest_pipelines; index with the pipeline to run the workflow on each document.siem_quickstart, then create_detection_rule, list_detection_rules, enable_detection_rules, get_security_alerts, update_alert_status, add_rule_exception.create_agent_builder_tool, list_agent_builder_tools, test_agent_builder_tool, and get_agent_builder_mcp_config to define tools and connect the IDE to Agent Builder MCP.get_agent_builder_mcp_config and add the config to Cursor/Claude so workflows can use custom Agent Builder tools.get_security_alerts and optionally update_alert_status.