Alert Analysis

Investigate one Elastic Security alert (or one group of related alerts) end to end: gather context, classify the threat, document findings, and, after confirming scope with the analyst, acknowledge.

<!-- begin-partial: preamble -->

Environment Configuration

This skill executes Elasticsearch operations through the elastic CLI. If the elastic CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., GET /, GET /_cat/indices, GET /{index}/_mapping, GET /{index}/_settings/index.mode, POST /_query). The Operations table at the end of this document maps each shorthand to the equivalent elastic CLI command, always use the CLI rather than calling the HTTP API directly.

<!-- end-partial: preamble -->

Critical principles

• Do not classify prematurely. Gather ALL context before deciding benign, unknown, or malicious.
• Most alerts are false positives, even when they look alarming. Rule names such as "Malicious Behavior" and severity "critical" are NOT evidence.
• "Unknown" is an acceptable outcome and is often the correct one when evidence is insufficient.
• Malicious requires strong corroborating evidence, persistence plus C2, credential theft, or lateral movement, not a single suspicious API call.
• Report tool output verbatim. Copy IDs, hostnames, timestamps, and counts exactly as returned. Do not round numbers, abbreviate IDs, or paraphrase error messages.

See references/classification-guide.md for detailed evidence-weighting criteria, the behavioral weight table, and common false positive sources.

Process

Step 1, Fetch the alert