elastic/example-mcp-app-security
5 skills31 installs100 starsGitHub
Install
npx skills add https://github.com/elastic/example-mcp-app-securitySkills in this repo
1Case Managementcase-management drives Elastic Security SOC cases via elastic-security MCP tools. Maps natural language requests to manage-cases dashboards, create-case, attach-alert-to-case, update-case, and add-case-comment with tag conventions for classification and MITRE techniques.8installs2Alert Triagealert-triage skill documents Triage Elastic Security alerts - fetch, investigate, classify threats, create cases, and acknowledge. Use when triaging alerts, performing SOC analysis, investigating detections, reviewing security incidents, or when the user mentions ransomware, malware, lateral movement, credential theft, DLL inje. name: alert-triage description: >6installs3Attack Discovery Triageattack-discovery-triage skill documents Triage Elastic Security Attack Discovery findings - fetch correlated attack narratives, assess confidence with entity risk and rule frequency signals, and present an interactive triage dashboard for approval, case creation, and acknowledgment. Use when triaging attack discoveries, reviewing correlat. name: attack-discovery-triage description: >6installs4Detection Rule Managementdetection-rule-management skill documents Create, tune, and manage Elastic Security detection rules. Use for false positive tuning, adding exceptions, creating new detection coverage, finding noisy rules, enabling/disabling rules, or any detection engineering task. Also trigger for "detection rules", "noisy rules", "false positives", "add e. name: detection-rule-management description: >6installs5Generate Sample Datagenerate-sample-data skill documents Generate sample security events, attack scenarios, and synthetic alerts for Elastic Security. Use when demoing, populating dashboards, testing detection rules, setting up a POC, or when the user asks for test data, demo data, or sample alerts.. name: generate-sample-data description: >5installs