kibana-anomaly-detection

This skill equips an agent to perform end-to-end Elastic ML anomaly detection work against Kibana Agent Builder, exposed through MCP tools prefixed `ad_*` and ES|QL queries over Elastic's machine-learning system indices (`.ml-anomalies-*`, `.ml-config`, `.ml-notifications-*`, `.ml-annotations-*`). It solves the problem of interpreting and operating anomaly detection jobs without deep prior ML expertise: it answers investigation and root-cause questions ("what broke?", "which entity?", blast radius), explains why anomaly scores are high or low (renormalization, model bounds, forecasts), troubleshoots operational issues (missing documents, memory limits, stalled datafeeds, cross-cluster search, lifecycle), and manages jobs and datafeeds (create, configure, start/stop, retrieve results).

The skill is organized around a Mode Selector (Investigate, Explain, Troubleshoot, Manage) that shares a common tool surface, with a documented investigation ordering (Investigate then Explain then Troubleshoot). It ships a large reference library: an anomaly score quick-reference and score bands, RCA ES|QL tool definitions (correlation, blast radius, cross-job entity matching, detector fingerprinting), workflow YAML files for datafeed and job operations, a permissions matrix, and specialized framing guides for security (attack chains, MITRE, exfiltration signals) and observability/SRE (degradation, capacity, deployment regression). It emphasizes running `ad_validate_ml_tool_permissions` as a preflight because missing privileges are the most common cause of misleading empty results.

Target users are SREs, platform engineers, security analysts, and observability practitioners running Elasticsearch machine learning who want a guided, defensive analysis and operations layer. Typical use cases include incident scoping across co-firing jobs, attributing anomalies to deployments, sizing model memory, and suppressing false positives during maintenance windows via calendar events.