Security ML Integration Package Management

Install, check, or troubleshoot a security ML package. Supported packages: beaconing (Network Beaconing Identification), ded (Data Exfiltration Detection), dga (Domain Generation Algorithm Detection), lmd (Lateral Movement Detection), pad (Privileged Access Detection), problemchild (Living off the Land Attack Detection).

<!-- begin-partial: preamble -->

Environment Configuration

This skill executes Elasticsearch operations through the elastic CLI. If the elastic CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., GET /, GET /_cat/indices, GET /{index}/_mapping, GET /{index}/_settings/index.mode, POST /_query). The Operations table at the end of this document maps each shorthand to the equivalent elastic CLI command, always use the CLI rather than calling the HTTP API directly.

<!-- end-partial: preamble -->

Package source patterns, shared template fields, and ingest-pipeline wiring live in package capabilities.

Process

1. Classify the request. Status, README, or install. Status and README stay read-only, do not install, start transforms, deploy jobs, or enable rules. After identifying the package, branch: status uses GET kbn:/api/fleet/epm/packages/{package} only (title, version, status); README adds GET kbn:/api/fleet/epm/packages/{package}/{version}/docs/README.md and returns that document; install continues.

2. Identify the package. Map the user's words to one of the six package names above. If the name is ambiguous, ask before calling any API. Load that package's row from package capabilities, omit fields that are empty for that package.