Summary
Agent Builder gets a new built-in Security skill, alert-triage, that answers "what should I focus on right now?" by ranking the open alert queue instead of investigating a single alert. The skill's inline security.alert-triage tool fetches open (optionally acknowledged) alerts, scores them by base risk score, MITRE tactic boost, Entity Analytics entity risk, asset criticality, and status penalties, clusters them by shared host or user, and returns up to 10 ranked groups with score breakdowns and the top alert ID per group. The existing alert-analysis skill remains the path for investigating a single known alert. The skill is registered unconditionally (no feature flag) and follows the same solution scoping as the other Security skills.
Why this needs docs: This is a new user-facing Agent Builder capability, and the two pages that catalog Security skills currently attribute alert-queue triage to alert-analysis, which becomes misleading once alert-triage ships.
Resources
- PR #273439 — [Security solution] Add alert-triage skill for queue prioritization
Availability
| Channel |
Details |
| Stack |
v9.5.0 |
| Serverless |
Jul 13–Jul 17 |
| Feature flag |
None — active by default |
Created with Docs Quest Scanner by @florent-leborgne
Suggested edits
Elastic Agent Builder built-in skills reference > Security skills
- What the docs say: Lists alert-analysis, entity-analytics, find-security-ml-jobs, threat-hunting, detection-rule-edit, and automatic_troubleshooting. The alert-analysis entry says: "Use when investigating a specific alert, triaging alert queues, or understanding alert context."
- What to add: Add an alert-triage entry alongside the other Security skills: it ranks the open alert queue by weighted risk factors (base risk score, MITRE tactic boost, Entity Analytics entity risk, asset criticality, and -5 status penalties for acknowledged or in-case alerts), clusters alerts by shared host or user, and returns up to 10 ranked groups with score breakdowns and the top alert ID per group. Assigned tool: security.alert-triage (single inline tool). Entity Analytics enrichment is best-effort, so the skill still works when risk scoring or asset criticality is unavailable; building-block alerts are excluded. Also revise the alert-analysis entry: "triaging alert queues" now belongs to alert-triage, and alert-analysis is the path for a single known alert. Applies from 9.5.0 and in Security serverless projects.
Security use cases for Elastic Agent Builder > Alert triage and investigation
- What the docs say: Enable: alert-analysis (optionally combine with entity-analytics for deeper entity context). Use this skill to triage a specific alert or work through an alert queue.
- What to add: Split queue prioritization from single-alert investigation: name alert-triage as the skill for queue-ranking prompts (for example "What should I focus on right now?", "Prioritize alerts from the last 8 hours", or "Which of these alerts should I look at first?" with an alert selection) and keep alert-analysis for investigating a specific alert. Note the handoff between the two: triage output recommends investigating each top group's alert with alert-analysis, which also makes a natural addition to the "Combining skills across use cases" flows. Preserve the existing alert-analysis prompts. Applies from 9.5.0 and in Security serverless projects.
Summary
Agent Builder gets a new built-in Security skill, alert-triage, that answers "what should I focus on right now?" by ranking the open alert queue instead of investigating a single alert. The skill's inline security.alert-triage tool fetches open (optionally acknowledged) alerts, scores them by base risk score, MITRE tactic boost, Entity Analytics entity risk, asset criticality, and status penalties, clusters them by shared host or user, and returns up to 10 ranked groups with score breakdowns and the top alert ID per group. The existing alert-analysis skill remains the path for investigating a single known alert. The skill is registered unconditionally (no feature flag) and follows the same solution scoping as the other Security skills.
Why this needs docs: This is a new user-facing Agent Builder capability, and the two pages that catalog Security skills currently attribute alert-queue triage to alert-analysis, which becomes misleading once alert-triage ships.
Resources
Availability
Created with Docs Quest Scanner by @florent-leborgne
Suggested edits
Elastic Agent Builder built-in skills reference > Security skills
Security use cases for Elastic Agent Builder > Alert triage and investigation