# Security Ml Integrations

Install and manage Elastic security ML integration packages (beaconing, ded, dga, lmd...

- Repository: https://github.com/elastic/agent-skills (603 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-29
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elastic/agent-skills --skill security-ml-integrations -g -a claude-code -y`
Codex: `npx skills add elastic/agent-skills --skill security-ml-integrations -g -a codex -y`
Cursor: `npx skills add elastic/agent-skills --skill security-ml-integrations -g -a cursor -y`
Gemini CLI: `npx skills add elastic/agent-skills --skill security-ml-integrations -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add elastic/agent-skills`

## Description

Install and manage Elastic security ML integration packages (beaconing, ded, dga, lmd, pad, problemchild). Handles the full lifecycle: pre-flight checks, Fleet package install, component templates, ingest pipelines, transforms, data views, ML anomaly detection jobs, and detection rules. Use when a user asks to install, set up, check the status of, or troubleshoot a security ML integration package.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Security ML Integration Package Management

Install, check, or troubleshoot a security ML package. Supported packages: `beaconing` (Network Beaconing
Identification), `ded` (Data Exfiltration Detection), `dga` (Domain Generation Algorithm Detection), `lmd` (Lateral
Movement Detection), `pad` (Privileged Access Detection), `problemchild` (Living off the Land Attack Detection).

<!-- begin-partial: preamble -->

## Environment Configuration

This skill executes Elasticsearch operations through the `elastic` CLI. If the
[`elastic` CLI](https://github.com/elastic/cli#configuration) is not installed, tell the user what it is needed for. Do
not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., `GET /`, `GET /_cat/indices`, `GET /{index}/_mapping`,
`GET /{index}/_settings/index.mode`, `POST /_query`). The [Operations](#operations) table at the end of this document
maps each shorthand to the equivalent `elastic` CLI command, always use the CLI rather than calling the HTTP API
directly.

<!-- end-partial: preamble -->

Package source patterns, shared template fields, and ingest-pipeline wiring live in
[package capabilities](references/package-capabilities.md).

## Process

1. **Classify the request.** Status, README, or install. Status and README stay read-only, do not install, start
   transforms, deploy jobs, or enable rules. After identifying the package, branch: status uses
   `GET kbn:/api/fleet/epm/packages/{package}` only (title, version, status); README adds
   `GET kbn:/api/fleet/epm/packages/{package}/{version}/docs/README.md` and returns that document; install continues.

2. **Identify the package.** Map the user's words to one of the six package names above. If the name is ambiguous, ask
   before calling any API. Load that package's row from [package capabilities](references/package-capabilities.md), omit fields that are empty for that package.

The rest: https://github.com/elastic/agent-skills/blob/HEAD/skills/security/ml-integrations/SKILL.md