메뉴
Build automation and workflows with alerting, ingest pipelines, security, and Agent Builder
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Debug and analyze LLM eval runs — view traces, compare runs, investigate failures, track costs. Use when debugging @kbn/evals failures, comparing eval runs, or analyzing LLM performance.
Start your security session with a personalized briefing — attacks, alerts, cases, rules, threat intel. Use as the first thing when starting security work.
Guide users from zero to a working Elastic cluster — Cloud or on-prem, connection config, first queries, and next steps.
Interactive guide for creating an APM service overview dashboard — discovers service data, presents metrics, and creates a tailored dashboard.
Interactive guide for creating SLOs from discovered APM and metric data — identifies candidates, lets user configure targets, and creates SLOs.
Create, configure, and manage Elasticsearch indices — mappings, settings, templates, data streams, and lifecycle policies.
| name | elastic-workflows |
| description | Build automation and workflows with alerting, ingest pipelines, security, and Agent Builder |
Use this skill when the user wants to set up automation or workflows on Elastic: alerting, ingest pipelines, security detection/response, or orchestration with Agent Builder.
create_alert_rule and list_alert_rules (Observability). In Kibana, add connectors and attach to rules.create_ingest_pipeline and list_ingest_pipelines; index with the pipeline to run the workflow on each document.siem_quickstart, then create_detection_rule, list_detection_rules, enable_detection_rules, get_security_alerts, update_alert_status, add_rule_exception.create_agent_builder_tool, list_agent_builder_tools, test_agent_builder_tool, and get_agent_builder_mcp_config to define tools and connect the IDE to Agent Builder MCP.get_agent_builder_mcp_config and add the config to Cursor/Claude so workflows can use custom Agent Builder tools.get_security_alerts and optionally update_alert_status.