Elastic ML anomaly detection — investigation/RCA, score explanation, job lifecycle troubleshooting, and job operations. Use when answering "what broke?"/"which entity?"/RCA, "why is score high/low?"/renormalization, "datafeed stopped"/"memory limit"/hard_limit, or configuring ML anomaly detection jobs. Reads results from `.ml-anomalies-*` and job state from ML REST APIs.
Install
npx skills add elastic/agent-skills --skill kibana-anomaly-detectionnpx skills add elastic/agent-skills --skill kibana-anomaly-detection -a claude-code -gnpx skills add elastic/agent-skills --skill kibana-anomaly-detection -a codex -ggemini skills install https://github.com/elastic/agent-skills.git --path skills/kibana/kibana-anomaly-detectiongh skill install elastic/agent-skills kibana-anomaly-detectiongit clone --depth 1 https://github.com/elastic/agent-skills /tmp/elastic__agent-skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/elastic__agent-skills/skills/kibana/kibana-anomaly-detection ~/.claude/skills/kibana-anomaly-detection # Claude Code
cp -R /tmp/elastic__agent-skills/skills/kibana/kibana-anomaly-detection ~/.agents/skills/kibana-anomaly-detection # Codex, Cursor, Gemini CLI, Copilot, OpenCode