elastic/agent-skills
35 skills77.4k installs19.1k starsGitHub
Install
npx skills add https://github.com/elastic/agent-skillsSkills in this repo
1Elasticsearch EsqlElasticsearch ES|QL executes piped ES|QL queries against Elasticsearch clusters using the bundled node scripts/esql.js CLI. ES|QL differs from Query DSL, SQL, and EQL, chaining commands like FROM, WHERE, STATS, SORT, and LIMIT with pipes. Prerequisites require _source enabled on indices and version-aware feature gates documented in esql-version-history.md, with serverless build_flavor treating all GA features as available regardless of version.number. Workflow starts with node scripts/esql.js test to detect deployment type, then mandatory schema discovery via indices and schema commands before writing queries. Generation tips cover time series TS syntax with TBUCKET and RATE, LOOKUP JOIN versus ENRICH fallback, CATEGORIZE, CHANGE_POINT, MATCH, and PROMQL preview on 9.4+. Guidelines prefer the simplest query answering the question, avoid guessing field names, and map user intent to the right ES|QL feature before composing pipes. TSV output flags support clean tab-separated exports for dashboards. References span generation tips, time series queries, search strategy, and the complete command reference for advanced syntax.2.9kinstalls2Kibana DashboardsThe Kibana dashboards and visualizations APIs provide a declarative Git friendly format for defining dashboards and visualizations Definitions are minimal diffable and suitable for version control and LLM assisted generation Minimal payloads no implementation details or derivable properties Easy to diff in Git Consistent patterns for GitOps workflows Designed for LLM one shot generation Robust validation via OpenAPI spec Version Requirement Kibana 9 4 SNAPSHOT ES QL Visualizations ES QL based visualizations cannot be created via api visualizations They must be created as inline panels within dashboards using the Dashboard API Inline vs Saved Object References When embedding visualization panels in dashboards prefer inline definitions over ref_id references Inline definitions are more reliable and self contained Kibana connection is configured via environment variables Run node scripts kibana dashboards js test to verify the connection If the test fails suggest these setup options to the user then stop Do not try to explore further until a successful connection test2.5kinstalls3Observability Logs SearchThe observability-logs-search skill supports incident investigation by searching Observability logs using ES|QL POST /_query endpoints mirroring Kibana Discover workflows. Parameter conventions use start and end date math, kqlFilter for scope narrowing, limit caps of 10 to 100 samples, and optional groupBy histogram fields like log.level or service.name. The funnel workflow requires iterative NOT exclusions until fewer than twenty distinct log patterns remain, concatenating each round's filters rather than zooming out. Round one runs a broad scope query with histogram, sample logs, and message categorization; subsequent rounds add NOT clauses for dominant noise patterns. Context minimization keeps samples small with KEEP on message, error.message, service.name, container fields, and kubernetes metadata. Entity filters use ECS names such as service.name and kubernetes.pod.name. The skill explicitly avoids metrics or traces and rejects Query DSL in favor of ES|QL only. Use when investigating log spikes, errors, anomalies, or drilling into services and containers during production incidents.2.5kinstalls4Security Case ManagementManage SOC cases through the Kibana Cases API All cases are scoped to securitySolution this skill operates exclusively within Elastic Security Cases appear in Kibana Security and can be assigned to analysts linked to alerts and pushed to external incident management systems via connectors Install dependencies before first use from the skills security directory bash cd skills security npm install Set the required environment variables or add them to a env file in the workspace root bash export KIBANA_URL https your cluster kb cloud example com 443 export KIBANA_API_KEY your kibana api key The security case management agent skill provides documented workflows prerequisites triggers and safety guidance from its SKILL md source Agents load it when user requests match the description and follow step by step instructions without inventing capabilities It integrates with standard agent tooling for the tasks inputs outputs and failure modes described in the repository documentation2.5kinstalls5Elasticsearch OnboardingThe elasticsearch-onboarding skill. Help developers new to Elasticsearch get from zero to a working search experience. Guide them through understanding their intent, mapping their data, and building a search experience with best practices baked in. Use this when the user shows intent to build search-related functionality, asks about Elasticsearch-related concepts for their use case, or expresses the need for help getting started wit. Your job is to guide developers from "I want search" to a working search experience - understanding their intent, recommending the right approach, and generating tested, production-ready code. Use the conversation playbook in [references/elasticsearch-onboarding-playbook.md](references/elasticsearch-onboarding-playbook.md) to structure the conversation. Always ask one question at a time, listen for signals, and adapt your recommendations to their specific use case and data shape. - Only generate code once the user confirms the approach and the mapping. - Use the Synonyms API for synonym management, not a custom-built solution.2.5kinstalls6Elasticsearch Authn> --- name: elasticsearch-authn description: > Authenticate to Elasticsearch using native, file-based, LDAP/AD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured. compatibility: > Requires curl or an HTTP client and network access to the target Elasticsearch cluster endpoint. Environment variables: ELASTICSEARCH_URL (required), plus one of ELASTICSEARCH_API_KEY, ELASTICSEARCH_USERNAME/ELASTICSEARCH_PASSWORD, or realm-specific credentials depending on the authentication method. metadata: author: elastic version: 0.1.0 --- # Elasticsearch Authentication Authenticate to an Elasticsearch cluster using any supported authentication realm that is already configured. This skill covers all built-in realms, credential verification, and the full API key lifecycle. For roles, users, role assignment, and role mappings, see the **elasticsearch-authz** skill. For detailed API endpoints, see [references/api-reference.md](references/api-reference.md). > **Deployment note:** Not all realms are available on every deployment type.2.4kinstalls7Elasticsearch File Ingest> The elasticsearch-file-ingest skill documents workflows and patterns from the repository SKILL.md. --- name: elasticsearch-file-ingest description: > Ingest and transform data files (CSV/JSON/Parquet/Arrow IPC) into Elasticsearch with stream processing and custom transforms. Use when loading files or batch importing data - not for reindexing, general ingest pipeline design, or bulk API patterns. metadata: author: elastic version: 0.2.0 --- # Elasticsearch File Ingest Stream-based ingestion and transformation of large data files (NDJSON, CSV, Parquet, Arrow IPC) into Elasticsearch. ## Features & Use Cases - **Stream-based**: Handle large files without running out of memory - **High throughput**: 50k+ documents/second on commodity hardware - **Formats**: NDJSON, CSV, Parquet, Arrow IPC - **Transformations**: Apply custom JavaScript transforms during ingestion (enrich, split, filter) - **Batch processing**: Ingest multiple files matching a pattern (e.g., `logs/*.json`) - **Document splitting**: Transform one source document into multiple targets ## Prerequisites - **Elasticsearch 8.x or 9.x** accessible (local or remote) - **Node.js 22+** installed ## Setup This skill is self-con.2.3kinstalls8Kibana Alerting Rules> The kibana-alerting-rules skill documents workflows and patterns from the repository SKILL.md. --- name: kibana-alerting-rules description: > Create and manage Kibana alerting rules via REST API or Terraform. Use when creating, updating, or managing rule lifecycle (enable, disable, mute, snooze) or rules-as-code workflows. metadata: author: elastic version: 0.1.0 --- # Kibana Alerting Rules ## Core Concepts A rule has three parts: **conditions** (what to detect), **schedule** (how often to check), and **actions** (what happens when conditions are met). When conditions are met, the rule creates **alerts**, which trigger **actions** via **connectors**. ## Authentication All alerting API calls require either API key auth or Basic auth. Every mutating request must include the `kbn-xsrf` header. ```http kbn-xsrf: true ``` ## Required Privileges - `all` privileges for the appropriate Kibana feature (e.g., Stack Rules, Observability, Security) - `read` privileges for Actions and Connectors (to attach actions to rules) ## API Reference Base path: `<kibana_url>/api/alerting` (or `/s/<space_id>/api/alerting` for non-default spaces).2.3kinstalls9Elasticsearch Audit> The elasticsearch-audit skill documents workflows and patterns from the repository SKILL.md. --- name: elasticsearch-audit description: > Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins. metadata: author: elastic version: 0.1.0 --- # Elasticsearch Audit Logging Enable and configure security audit logging for Elasticsearch via the cluster settings API. Audit logs record security events such as authentication attempts, access grants and denials, role changes, and API key operations - essential for compliance and incident investigation. For Kibana audit logging (saved object access, login/logout, space operations), see **kibana-audit**. For authentication and API key management, see **elasticsearch-authn**. For roles and user management, see **elasticsearch-authz**. For diagnosing security errors, see **elasticsearch-security-troubleshooting**. For detailed API endpoints and event types, see [references/api-reference.md](references/api-reference.md). > **Deployment note:** Audit logging configuration differs across deployment types.2.3kinstalls10Elasticsearch AuthzThe elasticsearch-authz skill documents agent workflows from the repository SKILL.md. It covers create a native user with a specific set of privileges. Key workflows include define a custom role with least-privilege index and cluster access. Developers invoke elasticsearch-authz when the task matches the triggers and reference files in SKILL.md for grounded, stepwise execution. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation.2.3kinstalls11Kibana Agent BuilderThe kibana-agent-builder skill documents agent workflows from the repository SKILL.md. It covers name required - The agent's display name. Default: $ARGUMENTS .. Key workflows include description optional - Brief description of what the agent does. Default: same as name.. Tools Connect an agent to an Elastic Workflow - a YAML-defined multi-step automation. Use when the agent needs to take action beyond data retrieval send notifications, create tickets, call external APIs . json { "id": "investigate-alert-workflow", "type": "workflow", "description": "Triggers automated alert investigation.", "configuration": { "workflow_id": "security-alert-investigation" } } Par Developers invoke kibana-agent-builder when the task matches the triggers and reference files in SKILL.md for grounded, stepwise execution. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation.2.3kinstalls12Kibana StreamsThe kibana-streams skill documents agent workflows from the repository SKILL.md. It covers listing all streams or getting a single stream's definition and metadata. Key workflows include reading a stream's ingest or query settings. - Listing all streams or getting a single stream's definition and metadata - Reading a stream's ingest or query settings - Listing a stream's queries - Reading significant events for a stream - Listing attachments dashboards, rules, SLOs linked to a stream - Enabling, disabling, or resyncing streams Developers invoke kibana-streams when the task matches the triggers and reference files in SKILL.md for grounded, stepwise execution. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation.2.3kinstalls13Kibana ConnectorsThe kibana-connectors skill documents agent workflows from the repository SKILL.md. It covers config and secrets must be JSON-encoded strings via jsonencode. Key workflows include secrets are stored in Terraform state; use a remote backend with encryption and restrict state file access. Developers invoke kibana-connectors when the task matches the triggers and reference files in SKILL.md for grounded, stepwise execution. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation.2.3kinstalls14Kibana VegaThe kibana-vega skill documents agent workflows from the repository SKILL.md. It covers h: 10 - Compact bar charts ≤7 items , fits above fold. Key workflows include h: 12-13 - Standard charts, timelines. Vega is a declarative visualization grammar for creating custom charts in Kibana. Combined with ES|QL queries, it enables highly customized visualizations beyond standard Kibana charts. Important Version Requirement: This skill strictly supports ES|QL data sources and requires Serverless Kibana or version 9.4+ SNAPSHOT . It will not work reliably on older versions or with older Lucene/KQL data sou Developers invoke kibana-vega when the task matches the triggers and reference files in SKILL.md for grounded, stepwise execution. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation.2.3kinstalls15Elasticsearch Security TroubleshootingThe elasticsearch-security-troubleshooting skill documents agent workflows from the repository SKILL.md. It covers diagnose HTTP 401 authentication failures. Key workflows include diagnose HTTP 403 permission denied errors. Developers invoke elasticsearch-security-troubleshooting when the task matches the triggers and reference files in SKILL.md for grounded, stepwise execution. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation.2.3kinstalls16Observability Llm ObsThis skill automates Elastic Cloud environment setup by managing authentication credentials, configuring regional defaults, and validating API connectivity. Developers use it as a prerequisite foundation before running dependent cloud skills. The workflow guides users through three steps: verifying EC_API_KEY existence, setting defaults for base URL and region, and testing connection integrity. Built-in security practices prevent credential exposure in chat history, directing users to store secrets in .env files or sandboxed shells. Supports custom region selection via API enumeration and includes comprehensive troubleshooting for authentication and network failures.2.2kinstalls17Observability Service HealthThe observability-service-health skill walks agents through a seven-step APM health investigation for a named service and time range. It combines Kibana Observability APIs (SLOs API for burn rate and error budget, Alerting API for active APM rules filtered by serviceName) with ES|QL queries on traces*apm* and metrics*apm* indices for throughput, avg/p95/p99 latency, and error rate. Health synthesis covers firing alerts, ML anomaly severity, dependency latency, infrastructure CPU/memory via k8s.pod.name and host.name attributes, and logs filtered by service.name or trace.id. The apm-correlations script finds attributes over-represented in slow or failed transactions. Services are unhealthy when SLOs violate, critical alerts fire, or severe ML anomalies appear. Guidelines require user-provided time ranges, LIMIT on ES|QL, and Alerting API as source of truth for active alerts rather than .alerts* indices. Use when users ask if a service is healthy, why latency spiked, or how to correlate APM with infra and logs.2.2kinstalls18Kibana AuditThe kibana-audit skill helps with >. Key workflows include Kibana Audit Logging; Jobs to Be Done; Prerequisites; Enable Kibana Audit Logging. Documented capabilities cover Enable or disable Kibana audit logging; Configure audit log output (rolling file, console); Filter out noisy events (e.g. `saved_object_find`); Investigate saved object access or deletion events; Track Kibana login/logout and session activity. Agents should invoke it when users ask about kibana audit or mention triggers defined in the skill frontmatter. Follow the SKILL.md steps, reference files, and output formats rather than improvising outside documented scope. login/logout, session expiry, space operations, and Kibana-level RBAC enforcement. For Elasticsearch audit logging (authentication failures, access grants/denials, security config changes), see **elasticsearch-audit**. For authentication and API key management, see **elasticsearch-authn**. For roles and user management, see **elasticsearch-authz**. For detailed event types, schema, and correlation queries, see [references/api-reference.md](references/api-reference.md). > **Deployment note:** Kibana audit configuration differs across deployment types. S.2.2kinstalls19Security Alert TriageThe security-alert-triage Elastic skill analyzes alerts one at a time or in grouped agent and time windows using bundled Node scripts. Workflow is fetch next alert, run two to four targeted ES|QL context queries, create or update cases via case-management, then acknowledge related alerts. Critical rules forbid premature benign or malicious classification, treat most alerts as false positives until corroborated, and require MALICIOUS labels only with persistence plus C2 or lateral movement evidence. Agents start executing tools immediately without browsing SKILL.md first, write ES|QL to temp files, and copy tool output verbatim. Prerequisites include Node 22+, Elasticsearch and Kibana URLs, and API keys. Use for SOC triage, detection investigation, and Elastic Security alert response workflows.2.2kinstalls20Observability Manage SlosThe observability-manage-slos Elastic skill documents SLO lifecycle through Kibana API calls with ApiKey or basic auth and required kbn-xsrf headers. SLI types include custom KQL, custom and timeslice metrics, histogram metrics, APM latency and availability, and Synthetics availability with budgeting method rules. Guidelines cover objective targets as decimals, transform role requirements, reset after mapping changes, group-by cardinality cautions, and separate burn-rate alert setup. Agents reference official Elastic docs for create, update, delete, enable, disable, and reset endpoints. Use when defining SLIs, error budgets, or managing SLO lifecycle in Elastic Observability stacks.2.2kinstalls21Security Detection Rule ManagementThe security-detection-rule-management skill creates and tunes Elastic Security detection rules through the Kibana Detection Engine API via rule-manager.js. It covers noisy SIEM rule tuning, endpoint behavior exceptions, new rule creation after query validation, and alert volume investigation workflows. Prerequisites require Node.js 22+, KIBANA_URL, ELASTICSEARCH_URL, and API keys or username/password pairs. Multi-step workflows pair rule_manager find/noisy-rules with run_query investigations before patch, exception, or create actions. Endpoint rules must use fetch_endpoint_rule then add_endpoint_exception rather than manual script calls. Agents report exact rule IDs, names, alert counts, and API errors without abbreviation. Install dependencies from skills/security with npm install before first use. Invoke when false positives spike, new threat coverage is needed, or endpoint exclusions require scoped exceptions. Uses rule-manager.js against Kibana Detection Engine API. Workflows: noisy-rules, exceptions, create-after-run_query validation.2.2kinstalls22Security Generate Security Sample DataThe security-generate-security-sample-data skill populates Elastic Security dashboards, Alerts tab, and Attack Discovery with realistic sample data. It generates ECS-compliant events, multi-step attack scenarios, and synthetic alert documents for demos, POCs, detection rule testing, and dashboard validation. Requires Node.js 22+, network access to Kibana and Elasticsearch, and KIBANA_URL plus API key or username/password plus Elasticsearch URL or cloud ID credentials. Quick start path generates everything and opens Kibana with zero-friction defaults. Use when demoing Elastic Security, testing detection rules, or seeding POC environments without production traffic. ECS-compliant security events and multi-step attack scenarios Synthetic alerts for dashboards, Alerts tab, and Attack Discovery Requires Node 22+, Kibana and Elasticsearch credentials via env vars Zero-friction quick start generates data and opens Kibana Supports detection rule testing and security POC seeding security-generate-security-sample-data seeds Elastic Security with ECS events, attacks, and synthetic alerts Seeded dashboards and alerts with ECS-compliant attack scenarios for testing User demos Elastic Security,.2.1kinstalls23Cloud Network SecurityThe cloud-network-security Elastic skill creates, updates, and deletes Serverless traffic filters including IP allowlists and AWS PrivateLink VPC endpoint filters. Agents configure restricted network access and private connectivity paths following Elastic Cloud API patterns. Prerequisites tie to cloud-setup credentials and project context. Use when locking down Serverless deployments or enabling private link access. Serverless IP traffic filter CRUD operations. AWS PrivateLink VPC filter configuration. Restricts network access for Elastic Cloud. Pairs with cloud-setup authentication. Private connectivity management workflows. Manage Elastic Cloud Serverless network security with IP filters and AWS PrivateLink VPC filters. Structured deliverables and steps from the cloud-network-security skill workflow. User mentions cloud-network-security or related skill triggers from the description. How do I apply cloud-network-security for the workflow described in SKILL.md?. Teams using cloud-network-security as documented in the skill repository.2.1kinstalls24Cloud Manage ProjectThe cloud-manage-project skill performs day-2 Elastic Cloud Serverless operations via Serverless REST API listing getting updating deleting resetting credentials resuming projects and loading saved credentials while resolving endpoints and scoped Elasticsearch API keys. Requires EC_API_KEY from cloud-setup with Admin or Editor for updates; 403 prompts permission verification. Manual fallback documents EC_API_KEY EC_BASE_URL in dotenv without pasting secrets in chat. Python 3.8 plus network to api.elastic-cloud.com for API commands; load-credentials works locally. Use connecting to existing serverless projects rotating credentials or looking up project details after provisioning. Day-2 Serverless REST API operations. List update delete resume reset credentials. EC_API_KEY Admin or Editor for updates. load-credentials works without network. dotenv fallback without chat secrets. Elastic Serverless project management. Day-2 serverless operations.2.1kinstalls25Cloud SetupThe cloud-setup Elastic skill configures Elastic Cloud API authentication and environment defaults required by sibling cloud skills. It documents EC_API_KEY setup, Cloud API access patterns, and profile validation before deploy or security operations. Agents verify credentials with minimal scope and never exfiltrate secrets. Use as the first step before cloud-network-security, cloud-create-project, or other Elastic Cloud agent skills. Sets EC_API_KEY and Elastic Cloud API defaults. Prerequisite for other Elastic cloud skills. Validates Cloud API access before mutations. Documents credential scope and safety rules. Environment configuration for Serverless projects. Configure Elastic Cloud authentication with EC_API_KEY and defaults for other cloud skills.2.1kinstalls26Observability Edot Python InstrumentThe cached observability-edot listing documents Elastic Cloud environment setup prerequisite for cloud skills. Workflow verifies EC_API_KEY sets EC_BASE_URL and EC_REGION defaults lists serverless regions via API and validates authentication without receiving secrets in chat. Users generate Organization owner API keys with Project Admin privileges storing in dotenv preferred over terminal export for sandboxed agents. Directs free trial registration when no account exists. Never echo API keys in conversation. Other cloud skills refer here when EC_API_KEY missing. Use setting up Elastic Cloud credentials before serverless project create or manage operations. Verify EC_API_KEY without chat secrets. Set EC_BASE_URL and EC_REGION defaults. Validate via serverless regions API. dotenv preferred for agent shells. Prerequisite for all cloud skills. Elastic Cloud environment setup skill. Setup EC_API_KEY cloud environment.2.1kinstalls27Cloud Create ProjectThe cloud-create-project skill creates Elastic Cloud Serverless projects using Serverless REST API deferring day-2 to cloud-manage-project. Requires EC_API_KEY with Admin or Organization owner role attempting operation letting API enforce 403 on insufficient permissions. Manual setup documents EC_API_KEY EC_BASE_URL in dotenv without chat secrets. Prerequisites cloud-setup skill for credential configuration. Use provisioning new serverless Elasticsearch projects after cloud environment setup validated. Create Serverless projects via REST API. Requires EC_API_KEY Admin or Org owner. Day-2 ops use cloud-manage-project skill. dotenv secrets not chat pasted keys. cloud-setup prerequisite for credentials. Elastic Serverless project creation. User create Elastic serverless project.2.1kinstalls28Observability Edot Java InstrumentThe observability edot java instrument skill Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials. Documentation covers workflows, commands, and guardrails agents should follow when users invoke this capability. Key documented areas include [ ] Step 1: Verify API key; [ ] Step 2: Set defaults; [ ] Step 3: Validate connection; Generate a key at [Elastic Cloud API keys](https://cloud.elastic.co/account/keys). Only **Organization owners** can. Reference commands include Check whether `EC_API_KEY` is already set:; appear in conversation history.. Use when developers or agents need structured guidance for observability edot java instrument tasks with evidence grounded in the bundled SKILL.md rather than generic advice. [ ] Step 1: Verify API key [ ] Step 2: Set defaults [ ] Step 3: Validate connection Generate a key at [Elastic Cloud API keys](https://cloud.elastic.co/account/keys). Only **Organization owners** can When creating this key, include **Project Admin** privileges or higher (Org Owner) so it can create and manage Create a `.env` file in2.1kinstalls29Observability Edot Dotnet InstrumentThe observability edot dotnet instrument skill Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials. Documentation covers workflows, commands, and guardrails agents should follow when users invoke this capability. Key documented areas include [ ] Step 1: Verify API key; [ ] Step 2: Set defaults; [ ] Step 3: Validate connection; Generate a key at [Elastic Cloud API keys](https://cloud.elastic.co/account/keys). Only **Organization owners** can. Reference commands include Check whether `EC_API_KEY` is already set:; appear in conversation history.. Use when developers or agents need structured guidance for observability edot dotnet instrument tasks with evidence grounded in the bundled SKILL.md rather than generic advice. [ ] Step 1: Verify API key [ ] Step 2: Set defaults [ ] Step 3: Validate connection Generate a key at [Elastic Cloud API keys](https://cloud.elastic.co/account/keys). Only **Organization owners** can When creating this key, include **Project Admin** privileges or higher (Org Owner) so it can create and manage Create a `.env` file in2.1kinstalls30Cloud Access ManagementThe cloud access management skill Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access. Documentation covers workflows, commands, and guardrails agents should follow when users invoke this capability. Key documented areas include Invite a user to the organization and assign them a Serverless project role; List organization members and their current role assignments; Update a user's roles (org-level or project-level); Remove a user from the organization. Reference commands include EC_API_KEY=your-api-key; EC_BASE_URL=https://api.elastic-cloud.com. Use when developers or agents need structured guidance for cloud access management tasks with evidence grounded in the bundled SKILL.md rather than generic advice. Invite a user to the organization and assign them a Serverless project role List organization members and their current role assignments Update a user's roles (org-level or project-level) Remove a user from the organization Create an additional Cloud API key with scoped roles and expiration Create a Cloud API key that can also call Elasticsearch and.2.1kinstalls31Observability Edot Dotnet MigrateThe observability edot dotnet migrate skill Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials. Documentation covers workflows, commands, and guardrails agents should follow when users invoke this capability. Key documented areas include [ ] Step 1: Verify API key; [ ] Step 2: Set defaults; [ ] Step 3: Validate connection; Generate a key at [Elastic Cloud API keys](https://cloud.elastic.co/account/keys). Only **Organization owners** can. Reference commands include Check whether `EC_API_KEY` is already set:; appear in conversation history.. Use when developers or agents need structured guidance for observability edot dotnet migrate tasks with evidence grounded in the bundled SKILL.md rather than generic advice. [ ] Step 1: Verify API key [ ] Step 2: Set defaults [ ] Step 3: Validate connection Generate a key at [Elastic Cloud API keys](https://cloud.elastic.co/account/keys). Only **Organization owners** can When creating this key, include **Project Admin** privileges or higher (Org Owner) so it can create and manage Create a `.env` file in2.1kinstalls32Observability Edot Python MigrateThe observability edot python migrate skill Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials. Documentation covers workflows, commands, and guardrails agents should follow when users invoke this capability. Key documented areas include [ ] Step 1: Verify API key; [ ] Step 2: Set defaults; [ ] Step 3: Validate connection; Generate a key at [Elastic Cloud API keys](https://cloud.elastic.co/account/keys). Only **Organization owners** can. Reference commands include Check whether `EC_API_KEY` is already set:; appear in conversation history.. Use when developers or agents need structured guidance for observability edot python migrate tasks with evidence grounded in the bundled SKILL.md rather than generic advice. [ ] Step 1: Verify API key [ ] Step 2: Set defaults [ ] Step 3: Validate connection Generate a key at [Elastic Cloud API keys](https://cloud.elastic.co/account/keys). Only **Organization owners** can When creating this key, include **Project Admin** privileges or higher (Org Owner) so it can create and manage Create a `.env` file in2.1kinstalls33Observability Edot Java MigrateThe observability edot java migrate skill Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials. Documentation covers workflows, commands, and guardrails agents should follow when users invoke this capability. Key documented areas include [ ] Step 1: Verify API key; [ ] Step 2: Set defaults; [ ] Step 3: Validate connection; Generate a key at [Elastic Cloud API keys](https://cloud.elastic.co/account/keys). Only **Organization owners** can. Reference commands include Check whether `EC_API_KEY` is already set:; appear in conversation history.. Use when developers or agents need structured guidance for observability edot java migrate tasks with evidence grounded in the bundled SKILL.md rather than generic advice. [ ] Step 1: Verify API key [ ] Step 2: Set defaults [ ] Step 3: Validate connection Generate a key at [Elastic Cloud API keys](https://cloud.elastic.co/account/keys). Only **Organization owners** can When creating this key, include **Project Admin** privileges or higher (Org Owner) so it can create and manage Create a `.env` file in2.1kinstalls34Kibana Anomaly DetectionThe kibana-anomaly-detection skill covers all Elastic ML anomaly detection work through Kibana Agent Builder MCP at the agent_builder/mcp endpoint. A mode selector routes questions to Investigate for RCA and blast radius, Explain for score drift and renormalization, Troubleshoot for datafeed stops and memory limits, or Manage for job and datafeed creation. It reads .ml-anomalies-*, .ml-config, .ml-notifications-*, and .ml-annotations-* via ES|QL and ad_* tools. Score bands treat record_score above 75 as critical and multi_bucket_impact at or above 3 as sustained shifts. Investigate mode follows a 14-step protocol ending in written RCA with root cause entity, affected jobs, and ad_rca_source_evidence confirmation. Troubleshoot fixes memory hard_limit before query_delay and uses stop-close-update-open-start lifecycle for config changes. Manage mode builds job plus datafeed JSON with smart defaults for bucket_span, query_delay, and detector functions.1.4kinstalls35Observability K8s InvestigationThe observability-k8s-investigation skill diagnoses Kubernetes workload, node, and control-plane issues using OTel telemetry from EDOT and the kube-stack collector. It scopes OTel-receiver indices such as metrics-kubeletstatsreceiver.otel-*, metrics-k8sclusterreceiver.otel-*, logs-k8seventsreceiver.otel-*, and logs-k8sobjectsreceiver.otel-* with k8s.pod.name and related semantic conventions. Legacy ECS kubernetes.* fields are explicitly out of scope. A failure-mode taxonomy covers OOMKilled, CPU throttling, CrashLoopBackOff, ImagePullBackOff, node NotReady cascades, admission webhook blocks, and HPA unready-pod dampening. Investigation flows orient on pod and namespace, characterize restarts and utilization, classify via pivotal signals, corroborate with K8s events and app logs, and synthesize with confidence calibration. Guidelines forbid confabulating from empty log results, treat restart count as boolean, and prefer reporting uncertainty over false confidence.1.4kinstalls