Security Alert Triage
elastic/agent-skillsSecurity teams deal with many alerts every day. This skill helps you triage Elastic Security alerts step by step. You can gather context, classify threats, create cases, and acknowledge alerts. It makes SOC analysis faster and more organized.
Start by fetching the next alert. Then run targeted queries to understand process tree, network, and related alerts. After gathering enough context, classify the alert as benign, unknown, or malicious. Finally, create a case and acknowledge the alert.
Remember that most alerts are false positives. Do not classify too early. Use the full workflow to avoid mistakes. This skill keeps your investigation organized and complete.
Add Security Alert Triage skill to your workflow
Global
mkdir -p ~/.claude/skills/security-alert-triageProject
mkdir -p .claude/skills/security-alert-triageSource Repository
More Security Claude Code Skills
Azure Compliancemicrosoft/azure-skills
Audit Azure compliance and Key Vault expiration with azqr scans
Firebase Security Rules Auditorfirebase/agent-skills
Find weak spots in Firestore rules and get clear fixes
Golang Securitysamber/cc-skills-golang
Find and fix security flaws in Go code using expert guidance and automated tools
Clerk Nextjs Patternsclerk/skills
Secure your Next.js app with Clerk middleware, server actions, and caching
Persona It Admingoogleworkspace/cli
Keep your digital workspace safe with IT admin security workflows
Two Factor Authentication Best Practicesbetter-auth/skills
Secure user logins with two-factor authentication using Better Auth
Gws Modelarmor Create Templategoogleworkspace/cli
Create new templates for Google Model Armor to protect AI apps from harmful content
Gws Modelarmor Sanitize Promptgoogleworkspace/cli
Clean user prompts safely with Google Model Armor templates