performing-alert-triage-with-elastic-siem skill (Anthropic-Cybersecurity-Skills)

From Public Agent Wiki

What it does. Perform systematic alert triage in Elastic Security SIEM—classifying, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Upstream mukul975/Anthropic-Cybersecurity-Skills
Skill file skills/performing-alert-triage-with-elastic-siem/SKILL.md
License Apache-2.0 (skill folder LICENSE)
Author mukul975
Fetched 2026-09-10

Install

  • npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-alert-triage-with-elastic-siem, or copy the skill folder into ~/.claude/skills/performing-alert-triage-with-elastic-siem/.
  • Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-alert-triage-with-elastic-siem/SKILL.md

SKILL.md (verbatim)

name: performing-alert-triage-with-elastic-siem
description: Perform systematic alert triage in Elastic Security SIEM—classifying,
  prioritizing, and investigating alerts using Kibana, ES|QL queries, and ECS-normalized
  data—to drive SOC analyst workflows. Use when triaging incoming Elastic Security
  detections, prioritizing an analyst's alert queue, or investigating alerts during
  SOC operations.
domain: cybersecurity
subdomain: soc-operations
tags:
- elastic
- siem
- alert-triage
- soc
- elastic-security
- detection
- esql
- kibana
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Token Binding
- Restore Access
- Application Protocol Command Analysis
- Password Authentication
- Reissue Credential
nist_csf:
- DE.CM-01
- DE.AE-02
- RS.MA-01
- DE.AE-06
mitre_attack:
- T1078
- T1685.002
- T1685.005
- T1566

Performing Alert Triage with Elastic SIEM

Overview

Alert triage in Elastic Security is the systematic process of reviewing, classifying, and prioritizing security alerts to determine which represent genuine threats. Elastic's AI-driven Attack Discovery feature can triage hundreds of alerts down to discrete attack chains, but skilled analyst triage remains essential. A structured triage workflow typically takes 5-10 minutes per alert cluster using Elastic's built-in tools.

When to Use

  • When conducting security assessments that involve performing alert triage with elastic siem
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing

Prerequisites

  • Elastic Security deployed (version 8.x or later)
  • Elastic Agent or Beats configured for endpoint and network data collection
  • Detection rules enabled and generating alerts
  • Elastic Common Schema (ECS) compliance across data sources
  • Analyst access to Kibana Security app with appropriate privileges

Alert Triage Workflow

Step 1: Initial Alert Assessment (2 minutes)

When viewing an alert in Elastic Security, review the alert details panel:

Alert Details Panel:
- Rule Name and Description
- Severity and Risk Score
- MITRE ATT&CK Mapping
- Host and User Context
- Process Tree (for endpoint alerts)
- Timeline of related events

Key Fields to Examine First

Field Purpose ECS Field
Rule severity Initial priority assessment kibana.alert.severity
Risk score Quantified threat level kibana.alert.risk_score
Host name Affected system host.name
User name Affected identity user.name
Process name Executing process process.name
Source IP Origin of activity source.ip
Destination IP Target of activity destination.ip
MITRE tactic Attack stage threat.tactic.name

Step 2: Context Gathering (3 minutes)

Query Related Events with ES|QL

FROM logs-endpoint.events.*
| WHERE host.name == "affected-host" AND @timestamp > NOW() - 1 HOUR
| STATS count = COUNT(*) BY event.category, event.action
| SORT count DESC

Find All Activity from Suspicious User

FROM logs-*
| WHERE user.name == "suspicious-user" AND @timestamp > NOW() - 24 HOURS
| STATS count = COUNT(*), unique_hosts = COUNT_DISTINCT(host.name) BY event.category
| SORT count DESC

Check for Related Alerts from Same Source

FROM .alerts-security.alerts-default
| WHERE source.ip == "10.0.0.50" AND @timestamp > NOW() - 24 HOURS
| STATS alert_count = COUNT(*) BY kibana.alert.rule.name, kibana.alert.severity
| SORT alert_count DESC

Investigate Lateral Movement from Same IP

FROM logs-system.auth-*
| WHERE source.ip == "10.0.0.50" AND event.outcome == "success"
| STATS login_count = COUNT(*), hosts = COUNT_DISTINCT(host.name) BY user.name
| WHERE hosts > 3

Step 3: Threat Intelligence Enrichment (2 minutes)

Check indicators against threat intelligence:

FROM logs-ti_*
| WHERE threat.indicator.ip == "203.0.113.50"
| KEEP threat.indicator.type, threat.indicator.provider, threat.indicator.confidence, threat.feed.name

Check File Hash Against Known Threats

FROM logs-endpoint.events.file-*
| WHERE file.hash.sha256 == "abc123..."
| STATS occurrences = COUNT(*) BY host.name, file.path, user.name

Step 4: Classification Decision (2 minutes)

Classification Criteria Action
True Positive Confirmed malicious activity Escalate to incident, begin containment
Benign True Positive Expected behavior matching rule Document in alert notes, acknowledge
False Positive Rule triggered on benign activity Mark as false positive, create tuning task
Needs Investigation Insufficient data for determination Assign for deeper investigation

Step 5: Documentation and Escalation (1 minute)

For each triaged alert, document:

  • Classification decision with rationale
  • Evidence artifacts examined
  • Related alerts or investigations
  • Recommended next steps

Detection Rules for Triage

Pre-Built Detection Rules

Elastic Security includes 1000+ pre-built detection rules organized by:

  • MITRE ATT&CK Tactic: Initial Access, Execution, Persistence, etc.
  • Platform: Windows, Linux, macOS, Cloud
  • Data Source: Endpoint, Network, Cloud, Identity

Custom Alert Correlation Rule

{
  "name": "Multiple Failed Logins Followed by Success",
  "type": "threshold",
  "query": "event.category:authentication AND event.outcome:failure",
  "threshold": {
    "field": ["source.ip", "user.name"],
    "value": 5,
    "cardinality": [
      {
        "field": "user.name",
        "value": 3
      }
    ]
  },
  "severity": "high",
  "risk_score": 73,
  "threat": [
    {
      "framework": "MITRE ATT&CK",
      "tactic": {
        "id": "TA0006",
        "name": "Credential Access"
      },
      "technique": [
        {
          "id": "T1110",
          "name": "Brute Force"
        }
      ]
    }
  ]
}

AI-Assisted Triage

Elastic AI Assistant Integration

  1. Open alert in Elastic Security
  2. Click AI Assistant panel
  3. Use quick prompts:
    • "Summarize this alert" - Get initial assessment
    • "Generate ES|QL query to find related activity" - Expand investigation
    • "What are the recommended response actions?" - Get playbook guidance
    • "Is this likely a false positive?" - Get AI confidence assessment

Attack Discovery

Elastic's Attack Discovery automatically:

  • Groups related alerts into attack chains
  • Maps alerts to MITRE ATT&CK kill chain stages
  • Filters false positives using ML models
  • Prioritizes based on business impact
  • Provides narrative summary of the attack

Triage Prioritization Matrix

Risk Score Severity Asset Criticality Response SLA
90-100 Critical High 15 minutes
70-89 High High 30 minutes
70-89 High Medium 1 hour
50-69 Medium Any 4 hours
21-49 Low Any 8 hours
1-20 Informational Any 24 hours

Triage Metrics and KPIs

Metric Target Measurement
Mean Time to Triage (MTTT) < 10 minutes Time from alert creation to classification
False Positive Rate < 30% False positives / total alerts
Escalation Rate 10-20% Escalated alerts / total alerts
Alert Coverage > 80% Triaged alerts / generated alerts per shift
Reclassification Rate < 5% Changed classifications / total classified

References

Other files in this skill

assets/template.md (verbatim)

Elastic SIEM Alert Triage Template

Alert Information

Field Value
Alert ID
Rule Name
Severity
Risk Score
Timestamp
MITRE Tactic
MITRE Technique

Affected Entities

Entity Value Criticality
Host
User
Source IP
Destination IP

Triage Assessment

Initial Review

  • Reviewed alert details and severity
  • Checked MITRE ATT&CK mapping
  • Examined process tree (endpoint alerts)

Context Gathered

  • Queried related host activity
  • Checked user activity history
  • Searched for related alerts from same source
  • Reviewed network connections

Threat Intelligence

  • Checked IPs against TI feeds
  • Checked file hashes against TI feeds
  • Checked domains against TI feeds

Classification

Classification Selected
True Positive [ ]
False Positive [ ]
Benign True Positive [ ]
Needs Investigation [ ]

Findings

Evidence Summary

Analyst Notes

Escalation

Field Value
Escalated Yes / No
Escalated To
Incident ID
Reason

references/api-reference.md (verbatim)

1 placeholder credential shortened to pass the site's secret filter.

Alert Triage with Elastic SIEM - API Reference

elasticsearch-py Client

Connection

from elasticsearch import Elasticsearch
es = Elasticsearch(
    hosts=["https://elastic:9200"],
    api_key=YOUR_KEY
    verify_certs=True
)

SIEM Signals Index

Elastic Security stores alerts in .siem-signals-<space>-* indices.

Querying Alerts

Search Open Alerts

es.search(
    index=".siem-signals-*",
    query={"bool": {"must": [
        {"range": {"@timestamp": {"gte": "now-24h"}}},
        {"term": {"signal.status": "open"}}
    ]}},
    sort=[{"@timestamp": {"order": "desc"}}],
    size=500
)

Alert Fields

Field Path Description
Rule name signal.rule.name Detection rule that triggered
Rule ID signal.rule.id Unique rule identifier
Severity signal.rule.severity critical, high, medium, low
Risk score signal.rule.risk_score 0-100 numeric score
Status signal.status open, acknowledged, closed
Source IP source.ip Alert source address
Destination IP destination.ip Alert destination address
User user.name Associated username
Host host.name Affected hostname
Process process.name Triggering process

Aggregations

es.search(
    index=".siem-signals-*",
    query={"bool": {"must": [...]}},
    aggs={
        "by_severity": {"terms": {"field": "signal.rule.severity", "size": 10}},
        "by_rule": {"terms": {"field": "signal.rule.name.keyword", "size": 20}},
        "by_host": {"terms": {"field": "host.name.keyword", "size": 20}}
    },
    size=0
)

Alert Status Management

Update Alert Status

es.update(
    index=".siem-signals-default-000001",
    id="alert_doc_id",
    body={"doc": {"signal": {"status": "closed"}}}
)

Triage Prioritization

Severity Priority

  1. Critical (risk score 90-100)
  2. High (risk score 70-89)
  3. Medium (risk score 40-69)
  4. Low (risk score 0-39)

Alert Clustering

Alerts from the same host within a time window are grouped as potential incidents. Three or more alerts from the same host suggest a multi-stage attack.

Elastic Security API

List Detection Rules

GET /api/detection_engine/rules/_find?per_page=100

Get Rule Execution Status

GET /api/detection_engine/rules/_find_statuses

Output Schema

{
  "report": "elastic_siem_alert_triage",
  "total_open_alerts": 45,
  "severity_summary": {"critical": 3, "high": 12, "medium": 20, "low": 10},
  "alert_clusters": [{"host": "web01", "alert_count": 5, "max_severity": "high"}],
  "aggregations": {"by_severity": [{"key": "high", "count": 12}]}
}

CLI Usage

python agent.py --host https://elastic:9200 --api-key "key" --hours 24 --output report.json

references/standards.md (verbatim)

Standards and References - Alert Triage with Elastic SIEM

Elastic Common Schema (ECS)

ECS is a standardized field naming convention for Elasticsearch data. All Elastic Security detections and triage workflows rely on ECS compliance.

Key ECS Field Categories for Triage

Category Fields Usage
Base @timestamp, message, tags Event timing and classification
Agent agent.name, agent.type Data source identification
Host host.name, host.ip, host.os Affected system context
User user.name, user.domain Identity attribution
Process process.name, process.pid, process.command_line Execution context
Network source.ip, destination.ip, destination.port Network activity
File file.name, file.hash.sha256, file.path File-related events
Threat threat.tactic.name, threat.technique.id MITRE ATT&CK mapping

MITRE ATT&CK Integration

Elastic Security maps detection rules and alerts to MITRE ATT&CK tactics and techniques, providing a common taxonomy for triage prioritization.

NIST SP 800-61 Rev 2

Triage aligns with NIST incident handling phases:

  • Detection and Analysis (triage is the core of this phase)
  • Prioritization based on functional impact, information impact, and recoverability

SOC Maturity Model

Triage Capability Levels

Level Capability
Level 1 Manual review of individual alerts
Level 2 Grouped alert triage with correlation
Level 3 AI-assisted triage with automated enrichment
Level 4 Automated classification with human oversight
Level 5 Fully autonomous triage with exception-based review

references/workflows.md (verbatim)

Workflows - Alert Triage with Elastic SIEM

5-Step Rapid Triage Framework

1. Alert Reception (30 seconds)
   - Review alert title, severity, risk score
   - Check MITRE ATT&CK mapping
   |
   v
2. Context Assessment (2 minutes)
   - Examine affected host and user
   - Check asset criticality
   - Review process tree for endpoint alerts
   |
   v
3. Intelligence Enrichment (2 minutes)
   - Check threat intelligence feeds
   - Query for related alerts (same source/user)
   - Search for known IOCs
   |
   v
4. Classification (1 minute)
   - True Positive / False Positive / Needs Investigation
   - Assign confidence level
   |
   v
5. Action (2 minutes)
   - Document findings in alert notes
   - Escalate or close with rationale
   - Create tuning task if false positive

Alert Grouping Strategy

Smart Grouping Criteria

  • Time window: Group alerts within 15-minute windows
  • Entity: Group by affected host or user
  • Kill chain stage: Group by MITRE ATT&CK tactic
  • Source: Group by originating IP or detection rule

Group Triage Process

  1. Sort alert groups by highest severity member
  2. Triage group as single unit when correlated
  3. Escalate entire group if attack chain detected
  4. Close group if false positive pattern identified

Shift-Based Triage Queue Management

Queue Priority Alert Criteria Analyst Tier
Immediate Critical severity, critical assets Tier 2+
High High severity or multiple related alerts Tier 1/2
Standard Medium severity, standard assets Tier 1
Low Low/info severity, non-critical Tier 1 (batch review)

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.