security-alert-analysis
From the author
Investigate a specific Elastic Security detection alert: gather context, assess entity risk, classify the threat, document findings, and optionally acknowledge. Use when triaging a single known alert, performing SOC investigation, or following up after the security-alert-triage skill identifies a group to investigate.
Install
npx skills add elastic/agent-skills --skill security-alert-analysis -a claude-code
Installs to .claude/skills/security-alert-analysis/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 92
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- soc-analystUnitOneAI/SecuritySkillsSOC Analyst role bundle covering Tier 1 through Tier 3 operations. Orchestrates alert triage, threat hunting, incident investigation, and detection engineering workflows. Auto-invoked when the user needs help with security monitoring, alert analysis, threat hunting hypotheses, incident timelines, or detection rule development. Sequences the appropriate security skills based on the operational engagement type.Security★ 94
- security-alert-triageelastic/agent-skillsPrioritize and rank the Elastic Security alert queue by weighted risk — base risk score, MITRE tactic boost, entity risk, and asset criticality — then cluster alerts into entity groups. Use when an analyst asks what to focus on, which alerts are most urgent, or wants a ranked starting point across the queue before deeper investigation begins.OfficialSecurity★ 602
- triaging-security-alerts-in-splunk26zl/cybersec-toolkitTriages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when SOC analysts face queued alerts from correlation searches, need to prioritize investigation order, or must document triage decisions for handoff to Tier 2/3 analysts.Security★ 85
- secops-triagegoogle/skillsExpert guidance for security alert triage in Google SecOps. Use when investigating and triaging security alerts, determining false positives vs. true positives, assessing entity risk, adjusting alert severity or priority, and closing or escalating alerts and cases. Don't use for deep multi-hop incident investigations across host timelines (use secops-investigate), proactive threat hunting or retroactive IoC sweeps (use secops-hunt), or authoring new detection rules (use secops-detection-engineering).OfficialSecurity★ 21.6K
- threat-detectionborghei/Claude-SkillsThis skill should be used when the user asks to "analyze logs for threats", "detect suspicious activity", "scan for brute force attempts", "identify injection attacks", or "audit access patterns for anomalies".Other★ 999
- analyzing-securitytelagod/code-abyssScans code for security vulnerabilities, detects dangerous patterns, and ensures security decisions are documented. Use when running security scans, auditing code, or checking for OWASP issues, injection risks, or sensitive data leaks. Automatically triggered on new modules, security-related changes, or post-refactor.Security★ 244
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in