Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint). Use for false positives, exceptions, new coverage, noisy rules, or rule management via Kibana API.
Install
npx skills add elastic/agent-skills --skill security-detection-rule-managementnpx skills add elastic/agent-skills --skill security-detection-rule-management -a claude-code -gnpx skills add elastic/agent-skills --skill security-detection-rule-management -a codex -ggemini skills install https://github.com/elastic/agent-skills.git --path skills/security/detection-rule-managementgh skill install elastic/agent-skills security-detection-rule-managementgit clone --depth 1 https://github.com/elastic/agent-skills /tmp/elastic__agent-skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/elastic__agent-skills/skills/security/detection-rule-management ~/.claude/skills/security-detection-rule-management # Claude Code
cp -R /tmp/elastic__agent-skills/skills/security/detection-rule-management ~/.agents/skills/security-detection-rule-management # Codex, Cursor, Gemini CLI, Copilot, OpenCode