Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint). Use for false positives, exceptions, new coverage, noisy rules, or rule management via Kibana API.
Detected risks:
security-detection-rule-management creates, tunes, and manages Elastic Security detection rules for both SIEM and Endpoint, driving all operations through the Kibana Detection Engine API via a bundled `rule-manager.js`. It solves the day-to-day work of a detection-engineering team: reducing false positives, adding exceptions, closing coverage gaps with new rules, and quieting noisy rules — without hand-crafting API calls. The skill is built for immediate execution and faithful reporting: it starts calling tools right away, and copies rule IDs, names, alert counts, exception IDs, and error messages exactly as the API returns them rather than abbreviating or inventing them.
The skill packages concrete workflows. To tune a noisy SIEM rule it finds noisy rules, investigates false positives with `run-query`, and then patches the rule or adds an exception, following a preference order of add-exception, tighten-query, adjust threshold/suppression, reduce severity, and — only as a last resort — disable. To add an endpoint behavior exception it first fetches the rule definition from GitHub with the dedicated `fetch_endpoint_rule` tool and then scopes an exception to the rule id with `add_endpoint_exception`. To create a new rule it defines the threat and MITRE ATT&CK technique, tests the query against real data, and creates the rule, with local `validate-query` catching syntax errors before create or patch. Write operations (patch, enable, disable, delete, add-exception, bulk-action) require confirmation unless `--yes` is passed, which is required when an agent runs them. It requires Node.js 22+ and network access to Kibana and Elasticsearch, configured through `KIBANA_URL`/`ELASTICSEARCH_URL` plus API keys or username/password credentials.
The skill targets SOC analysts and detection engineers running Elastic Security who need repeatable, auditable rule management. It is most useful for iterative rule tuning and coverage expansion where accurate IDs, tested queries, and a clear tuning strategy matter.
It creates, tunes, and manages Elastic Security detection rules for both SIEM and Endpoint via the Kibana Detection Engine API — handling false positives, exceptions, new coverage, and noisy rules.
Add an exception first, then tighten the query, then adjust threshold or alert suppression, then reduce risk score/severity, and only disable the rule as a last resort.
Node.js 22+ and network access to Kibana and Elasticsearch. Set `KIBANA_URL` with `KIBANA_API_KEY` (or username/password), and `ELASTICSEARCH_URL` or `ELASTICSEARCH_CLOUD_ID` with `ELASTICSEARCH_API_KEY` (or username/password). Run `npm install` in the security skill directory first.
Always fetch the rule definition first with the dedicated `fetch_endpoint_rule` tool to understand the query logic and existing exclusions, then use `add_endpoint_exception` scoped to the rule id — do not invoke the underlying scripts manually.
No. Write operations such as patch, enable, disable, delete, add-exception, and bulk-action prompt for confirmation by default; passing `--yes` skips the prompt, which is required when the skill is driven by an agent.
Quick Setup:
.claude/skills/Repository
elastic/agent-skills