case-management

Create, search, update, and manage SOC cases for Elastic Security. ALWAYS use this skill when the user mentions cases, incidents, investigations, or asks to see, show, list, open, create, update, or search cases. Trigger for: "show me my cases", "open cases", "list cases", "any open cases", "create a case", "case for this alert", "show me case 42", "incident tracking", "investigation status", or any case-related question.

跳到安装查看文件

仓库: elastic/example-mcp-app-security
最近来源活动: 2026年4月17日 20:40
检测到的 SKILL.md 语言: 英语
星标: 25
Forks: 15

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 AI 助手安装

复制这段 Prompt，发给你正在使用的 AI 助手。

Follow https://skillsmp.com/skill-install/prompt.md to install only the Agent Skill at https://github.com/elastic/example-mcp-app-security/tree/main/skills/case-management.

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/elastic/example-mcp-app-security --skill case-management

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

SKILL.md

来源说明 · 只读预览

name: case-management
description: Create, search, update, and manage SOC cases for Elastic Security. ALWAYS use this skill when the user mentions cases, incidents, investigations, or asks to see, show, list, open, create, update, or search cases. Trigger for: "show me my cases", "open cases", "list cases", "any open cases", "create a case", "case for this alert", "show me case 42", "incident tracking", "investigation status", or any case-related question.

# Case Management Manage SOC cases using the `elastic-security` MCP connector. ## ALWAYS call the tool When the user asks about cases, ALWAYS call `manage-cases` to open the interactive dashboard. Do not try to answer from memory or describe cases without calling the tool first. | User says | Tool call | |-----------|-----------| | "show me my cases" | `manage-cases` (no params) | | "any open cases?" | `manage-cases` with `status: "open"` | | "closed cases" | `manage-cases` with `status: "closed"` | | "cases for SRVWIN02" | `manage-cases` with `search: "SRVWIN02"` | | "critical cases" | `manage-cases` with `severity: "critical"` | | "show case 42" | `manage-cases` (user can click it in the dashboard) | | "create a case" | `create-case` with title, description, tags, severity | | "create a case for this alert" | `create-case` with alert details, then `attach-alert-to-case` | ## Tools | Tool | Purpose | |------|---------| | `manage-cases` | Opens interactive case dashboard. Params: `status`, `severity`, `search` | | `create-case` | Creates a new case. Params: `title`, `description`, `tags` (comma-separated), `severity` | | `attach-alert-to-case` | Attaches an alert to a case. Params: `caseId`, `alertId`, `alertIndex`, `ruleId`, `ruleName` | | `update-case` | Updates case status/severity. Params: `caseId`, `version`, `status`, `severity` | | `add-case-comment` | Adds investigation notes. Params: `caseId`, `comment` | ## Creating Cases When the user asks you to create a case, call `create-case` directly — do NOT tell them to use the dashboard UI. Example: ``` create-case with: title: "[MALICIOUS] Ransomware Attack Chain — srv-win-defend-01" description: "## Summary\n- Full ransomware kill chain detected\n- Host: srv-win-defend-01\n- User: Jonathan\n\n## MITRE ATT&CK\nT1566, T1059, T1218\n\n## Findings\n..." tags: "classification:malicious,confidence:high,host:srv-win-defend-01,mitre:T1566,mitre:T1059" severity: "critical" ``` After creating the case, if you have alert IDs, attach them with `attach-alert-to-case`. ## Tag Conventions | Tag pattern | Example | Purpose | |-------------|---------|---------| | `classification:<level>` | `classification:malicious` | Triage result | | `confidence:<score>` | `confidence:85` | Confidence 0-100 | | `mitre:<technique>` | `mitre:T1574.002` | MITRE ATT&CK technique | | `agent_id:<uuid>` | `agent_id:550888e5-...` | Elastic agent ID | | `rule:<name>` | `rule:Malware Detection` | Detection rule name |

在 GitHub 查看

返回搜索返回安装

alert-triage

Triage Elastic Security alerts — fetch, investigate, classify threats, create cases, and acknowledge. Use when triaging alerts, performing SOC analysis, investigating detections, reviewing security incidents, or when the user mentions ransomware, malware, lateral movement, credential theft, DLL injection, suspicious processes, or any specific threat. Also trigger for "show me alerts", "what's happening on host X", "any critical alerts", or any security operations question.

2026-04-17

attack-discovery-triage

Triage Elastic Security Attack Discovery findings — fetch correlated attack narratives, assess confidence with entity risk and rule frequency signals, and present an interactive triage dashboard for approval, case creation, and acknowledgment. Use when triaging attack discoveries, reviewing correlated attacks, assessing EASE output, or when the user mentions "attack discovery", "AD findings", "triage attacks", "correlated alerts", or asks to process attack discovery results. Also trigger for "what attacks were discovered", "triage my discoveries", or "any attack discoveries".

2026-04-17

detection-rule-management

Create, tune, and manage Elastic Security detection rules. Use for false positive tuning, adding exceptions, creating new detection coverage, finding noisy rules, enabling/disabling rules, or any detection engineering task. Also trigger for "detection rules", "noisy rules", "false positives", "add exception", "create rule", or "tune rule".

2026-04-17

查看这个仓库的全部 Skills

case-management

来源信息

安装方式

用 AI 助手安装

检查来源文件

同仓库更多 Skills

用 AI 助手安装

同仓库更多 Skills