Alert Triage

Prioritize the Elastic Security alert queue by weighted risk and return ranked entity groups, a starting point before investigation begins, not an investigation itself.

<!-- begin-partial: preamble -->

Environment Configuration

This skill executes Elasticsearch operations through the elastic CLI. If the elastic CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., GET /, GET /_cat/indices, GET /{index}/_mapping, GET /{index}/_settings/index.mode, POST /_query). The Operations table at the end of this document maps each shorthand to the equivalent elastic CLI command, always use the CLI rather than calling the HTTP API directly.

<!-- end-partial: preamble -->

When to use this skill

Use this skill when:

• An analyst asks "what should I focus on right now?" or "which alerts are most urgent?"
• An analyst wants to prioritize the queue for a specific time window (for example, "last 8 hours")
• An analyst provides a set of alert IDs and asks "which of these are most important?"
• An analyst is starting a shift and needs a ranked starting point before investigation begins

Do not use this skill to investigate a single known alert, use the security-alert-analysis skill for that. This skill does not acknowledge alerts, create cases, or gather per-alert context. Those actions belong in the investigation phase.

Scoring model

The score for each alert is computed as:

alert_score = base_risk_score + mitre_boost + status_modifier
group_score = MAX(alert_score across group) + entity_risk_boost + asset_criticality_boost

The weights, mirroring the Kibana Agent Builder alert-triage skill, are: