Repository
elastic/agent-skills agent skills
- skills
- 26
- official
- 26
- GitHub stars
- 592
GitHub description: “Official Elastic Skills”
- Stars
- 592 (53 forks)
- Licence
- Apache-2.0
- Last push
- Oct 2026
- Created
- Mar 2026
Install all skills
npx skills add elastic/agent-skillsAdd --skill <name> for a single skill and -a <agent> to choose the agent (see the agent guides).
Skills in elastic/agent-skills, ranked
Ranked by score. Sort bymost stars,trending,newest,recently updated
| # | Skill | Repository | Stars | Used in | Tokens | Auto-check | Licence | Updated |
|---|---|---|---|---|---|---|---|---|
| 1 | Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge. | elastic/ | 592 | 1 repo | ~3.5k | Automated safety check: Notes | Apache-2.0 | yesterday |
| 2 | Create, search, update, and manage SOC cases via the Kibana Cases API. | elastic/ | 592 | 1 repo | ~2.6k | Automated safety check: Notes | Apache-2.0 | yesterday |
| 3 | Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint). | elastic/ | 592 | 1 repo | ~3.9k | Automated safety check: Notes | Apache-2.0 | yesterday |
| 4 | Create and manage Kibana Dashboards and Lens visualizations. | elastic/ | 592 | 1 repo | ~3.7k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 5 | Generate sample security events, attack scenarios, and synthetic alerts for Elastic Security. | elastic/ | 592 | — | ~2k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 6 | Onboard an Elastic Cloud organization: configure the elastic CLI's Cloud context and API key, establish a default region, then invite users, assign predefined or custom Serverless project roles, and… | elastic/ | 592 | — | ~4.1k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 7 | Create and manage Elastic ML anomaly detection jobs via the API. | elastic/ | 592 | — | ~2.4k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 8 | Explain Elasticsearch ML anomaly detection scores, model behavior, and result interpretation. | elastic/ | 592 | — | ~4.5k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 9 | Design and review Elasticsearch index mappings for stated access patterns: correct field types, text+keyword multi-fields, docvalues tuning, mapping-explosion avoidance, and explicit shard settings. | elastic/ | 592 | — | ~3.1k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 10 | Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL… | elastic/ | 592 | 2 repos | ~5.8k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 11 | Load CSV and JSON files into Elasticsearch indices using the bulk API and explicit mappings when field types matter. | elastic/ | 592 | — | ~2.7k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 12 | Help developers new to Elasticsearch get from zero to a working search experience. | elastic/ | 592 | — | ~665 | Automated safety check: Pass | Apache-2.0 | yesterday |
| 13 | Diagnose slow Elasticsearch Query DSL searches and propose measured fixes. | elastic/ | 592 | — | ~2.8k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 14 | Guide Elasticsearch reindex for performance: local and remote, slicing, throttling, task API. | elastic/ | 592 | — | ~3.2k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 15 | Improve Elasticsearch search relevance for content and catalog indices: pin or promote results with query rules (correct rule type, criteria, and rule-query wiring) and tune organic ranking with… | elastic/ | 592 | — | ~3.2k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 16 | Create and manage Kibana Agent Builder agents and custom tools. | elastic/ | 592 | — | ~3.4k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 17 | Create and manage Kibana alerting rules. An agent skill from elastic/agent-skills. | elastic/ | 592 | — | ~4.2k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 18 | Author, validate, test, run, and inspect Elastic Workflow YAML definitions. | elastic/ | 592 | — | ~4.8k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 19 | Answer questions about LLM and agentic-application behavior from data already ingested into Elastic: latency and error rate, token and cost utilization, response quality and guardrail events, and… | elastic/ | 592 | — | ~4.9k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 20 | Onboard an application into Elastic Observability with the Elastic Distribution of OpenTelemetry (EDOT): route on language and runtime, detect and replace a classic Elastic APM agent, apply the… | elastic/ | 592 | — | ~4.1k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 21 | Provision and operate Elastic Cloud infrastructure: create, connect to, update, and delete Serverless projects (Elasticsearch, Observability, Security); manage traffic filters (IP and AWS… | elastic/ | 592 | — | ~5.4k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 22 | Diagnose a non-green Elasticsearch cluster and surface the single most likely cause with remediation. | elastic/ | 592 | — | ~3.3k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 23 | Elastic ML anomaly detection — investigation/RCA, score explanation, job lifecycle troubleshooting, and job operations. | elastic/ | 592 | — | ~6k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 24 | Investigate Kubernetes workload, node, and control-plane issues using OTel telemetry (EDOT). | elastic/ | 592 | — | ~8.3k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 25 | Design and operate service reliability targets in Elastic Observability: choose an SLI type and a defensible target, pick a time window and budgeting method, create and maintain SLOs through the… | elastic/ | 592 | — | ~9.2k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 26 | Triage a degraded or suspect service end to end: read SLO status and burn rate, check active alerting rules and ML anomalies, measure throughput, latency, and error rate, assess dependency health… | elastic/ | 592 | — | ~7.4k | Automated safety check: Pass | Apache-2.0 | yesterday |
Questions, answered from the data.
What is the best skill in elastic/agent-skills?
Security Alert Triage (official) from elastic/agent-skills ranks first of the 26 skills in elastic/agent-skills listed here, with the highest score: its repository has 592 GitHub stars, 1 other GitHub owner carry a copy, its SKILL.md loads about 3.5k tokens and it has informational notes only in the automated safety check. Next come Security Case Management and Security Detection Rule Management.
Are the skills in elastic/agent-skills official?
26 of the 26 skills in elastic/agent-skills are official, published by the vendor's own GitHub organization: Security Alert Triage, Security Case Management, Security Detection Rule Management, Kibana Dashboards, Security Generate Security Sample Data and 21 more.
How do I install all skills from elastic/agent-skills?
Run npx skills add elastic/agent-skills in your project: the open-source skills CLI installs the repository's skills into your coding agent's skills folder. To install a single skill, open its page here for the exact command.
How are these skills ranked?
By Skill Navigator score, which combines the GitHub stars of the skill's repository (shared across that repo's skills and discounted for large collections), how many other GitHub owners carry a copy of the skill, and automated SKILL.md quality checks, minus penalties for safety-check warnings and for each further skill from the same repository. Skills that fail the safety check are not listed.