# Security Alert Analysis

Investigate a specific Elastic Security detection alert: gather context, assess entity...

- Repository: https://github.com/elastic/agent-skills (603 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-29
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elastic/agent-skills --skill security-alert-analysis -g -a claude-code -y`
Codex: `npx skills add elastic/agent-skills --skill security-alert-analysis -g -a codex -y`
Cursor: `npx skills add elastic/agent-skills --skill security-alert-analysis -g -a cursor -y`
Gemini CLI: `npx skills add elastic/agent-skills --skill security-alert-analysis -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add elastic/agent-skills`

## Description

Investigate a specific Elastic Security detection alert: gather context, assess entity risk, classify the threat, document findings, and optionally acknowledge. Use when triaging a single known alert, performing SOC investigation, or following up after the security-alert-triage skill identifies a group to investigate.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Alert Analysis

Investigate one Elastic Security alert (or one group of related alerts) end to end: gather context, classify the threat,
document findings, and, after confirming scope with the analyst, acknowledge.

<!-- begin-partial: preamble -->

## Environment Configuration

This skill executes Elasticsearch operations through the `elastic` CLI. If the
[`elastic` CLI](https://github.com/elastic/cli#configuration) is not installed, tell the user what it is needed for. Do
not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., `GET /`, `GET /_cat/indices`, `GET /{index}/_mapping`,
`GET /{index}/_settings/index.mode`, `POST /_query`). The [Operations](#operations) table at the end of this document
maps each shorthand to the equivalent `elastic` CLI command, always use the CLI rather than calling the HTTP API
directly.

<!-- end-partial: preamble -->

## Critical principles

- **Do not classify prematurely.** Gather ALL context before deciding benign, unknown, or malicious.
- **Most alerts are false positives**, even when they look alarming. Rule names such as "Malicious Behavior" and
  severity "critical" are NOT evidence.
- **"Unknown" is an acceptable outcome** and is often the correct one when evidence is insufficient.
- **Malicious requires strong corroborating evidence**, persistence plus C2, credential theft, or lateral movement, not a single suspicious API call.
- **Report tool output verbatim.** Copy IDs, hostnames, timestamps, and counts exactly as returned. Do not round
  numbers, abbreviate IDs, or paraphrase error messages.

See [references/classification-guide.md](references/classification-guide.md) for detailed evidence-weighting criteria,
the behavioral weight table, and common false positive sources.

## Process

### Step 1, Fetch the alert

The rest: https://github.com/elastic/agent-skills/blob/HEAD/skills/security/alert-analysis/SKILL.md