# Security Detection Rule Management

Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint).

- Repository: https://github.com/elastic/agent-skills (603 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-29
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add elastic/agent-skills --skill security-detection-rule-management -g -a claude-code -y`
Codex: `npx skills add elastic/agent-skills --skill security-detection-rule-management -g -a codex -y`
Cursor: `npx skills add elastic/agent-skills --skill security-detection-rule-management -g -a cursor -y`
Gemini CLI: `npx skills add elastic/agent-skills --skill security-detection-rule-management -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add elastic/agent-skills`

## Description

Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint). Use for false positives, exceptions, new coverage, noisy rules, or rule management via Kibana API.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Detection Rule Management

Create new detection rules for emerging threats and coverage gaps, and tune existing rules to reduce false positives.
All operations use the Kibana Detection Engine API via `rule-manager.js`.

## Execution rules

- Start executing tools immediately, do not read SKILL.md, browse the workspace, or list files first.
- Report tool output faithfully. Copy rule IDs, names, alert counts, exception IDs, and error messages exactly as
  returned by the API. Do not abbreviate rule UUIDs, invent rule names, or round alert counts.
- When a tool returns an error (rule not found, API failure), report the exact error, do not guess at alternatives.

## Prerequisites

Install dependencies before first use from the `skills/security` directory:

```bash
cd skills/security && npm install
```

Set the required environment variables (or add them to a `.env` file in the workspace root):

```bash
export ELASTICSEARCH_URL="https://your-cluster.es.cloud.example.com:443"
export ELASTICSEARCH_API_KEY="your-api-key"
export KIBANA_URL="https://your-cluster.kb.cloud.example.com:443"
export KIBANA_API_KEY="your-kibana-api-key"
```

## Common multi-step workflows

The rest: https://github.com/elastic/agent-skills/blob/HEAD/plugins/security/skills/detection-rule-management/SKILL.md