# Security Alert Triage

Prioritize and rank the Elastic Security alert queue by weighted risk, base risk...

- Repository: https://github.com/elastic/agent-skills (603 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-29
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elastic/agent-skills --skill security-alert-triage -g -a claude-code -y`
Codex: `npx skills add elastic/agent-skills --skill security-alert-triage -g -a codex -y`
Cursor: `npx skills add elastic/agent-skills --skill security-alert-triage -g -a cursor -y`
Gemini CLI: `npx skills add elastic/agent-skills --skill security-alert-triage -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add elastic/agent-skills`

## Description

Prioritize and rank the Elastic Security alert queue by weighted risk, base risk score, MITRE tactic boost, entity risk, and asset criticality, then cluster alerts into entity groups. Use when an analyst asks what to focus on, which alerts are most urgent, or wants a ranked starting point across the queue before deeper investigation begins.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Alert Triage

Prioritize the Elastic Security alert queue by weighted risk and return ranked entity groups, a starting point before
investigation begins, not an investigation itself.

<!-- begin-partial: preamble -->

## Environment Configuration

This skill executes Elasticsearch operations through the `elastic` CLI. If the
[`elastic` CLI](https://github.com/elastic/cli#configuration) is not installed, tell the user what it is needed for. Do
not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., `GET /`, `GET /_cat/indices`, `GET /{index}/_mapping`,
`GET /{index}/_settings/index.mode`, `POST /_query`). The [Operations](#operations) table at the end of this document
maps each shorthand to the equivalent `elastic` CLI command, always use the CLI rather than calling the HTTP API
directly.

<!-- end-partial: preamble -->

## When to use this skill

Use this skill when:

- An analyst asks "what should I focus on right now?" or "which alerts are most urgent?"
- An analyst wants to prioritize the queue for a specific time window (for example, "last 8 hours")
- An analyst provides a set of alert IDs and asks "which of these are most important?"
- An analyst is starting a shift and needs a ranked starting point before investigation begins

Do not use this skill to investigate a single known alert, use the **security-alert-analysis** skill for that. This
skill does not acknowledge alerts, create cases, or gather per-alert context. Those actions belong in the investigation
phase.

## Scoring model

The score for each alert is computed as:

```text
alert_score = base_risk_score + mitre_boost + status_modifier
group_score = MAX(alert_score across group) + entity_risk_boost + asset_criticality_boost
```

The weights, mirroring the Kibana Agent Builder alert-triage skill, are:

The rest: https://github.com/elastic/agent-skills/blob/HEAD/skills/security/alert-triage/SKILL.md