Update Agent Builder built-in skills reference for 9.5#7255
Merged
Conversation
Contributor
Elastic Docs AI PR menuCheck the box to run an AI review for this pull request.
Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team. |
Aligns the built-in skills reference with the current skill registry (allow_lists.ts) in Kibana: - Add the 9.5 built-in skills across Platform, Streams and significant events, Security, Observability, and Elasticsearch - Handle renames and consolidations cumulatively with applies_to badges (streams-exploration to streams-management; hybrid-search, semantic-search, and vector-database consolidated into search.vector-hybrid-search) - Move workflow-authoring to GA in 9.5 with an inline preview 9.4 note - Collapse each skill's assigned tools into a dropdown to reduce noise - Fix a stale skill example link in skills.md Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
🔍 Preview links for changed docs |
leemthompo
force-pushed
the
update-agent-builder-builtin-skills
branch
from
July 7, 2026 09:21
bb88694 to
e2e4e28
Compare
Contributor
Elastic Docs Style Checker (Vale)Summary: 2 warnings found
|
| File | Line | Rule | Message |
|---|---|---|---|
| explore-analyze/ai-features/agent-builder/builtin-skills-reference.md | 384 | Elastic.Spelling | 'chatbots' is a possible misspelling. |
| explore-analyze/ai-features/agent-builder/builtin-skills-reference.md | 384 | Elastic.Spelling | 'chatbot' is a possible misspelling. |
The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.
Point the preview Security skills at their specific Security Solution experimental feature flags and settings, distinct from the Agent Builder agentBuilder:experimentalFeatures advanced setting. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Member
Author
|
@leemthompo check #7172 |
- Fix cases-management tool IDs to platform.core.cases.* (were platform.cases.*) - Mark rule-management action-policy tool and dashboard-management dashboard tool as skill-scoped inline tools, not built-in registry tools Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Control is agentBuilder:tracing:enabled (on by default), not the experimental features flag (per kibana #276174) - Note dashboard-building capability and that it's part of the default agent Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This was referenced Jul 7, 2026
Brand-new capabilities ship as technical preview, so tag skills that debut in 9.5 as preview 9.5 / serverless preview: discover-data-analysis, cases-management, rule-management, significant-events-management, significant-events-onboarding, knowledge-indicators-management, ki-identification-management, streams-gap-detection, skill-authoring, observability.service-map, siem-readiness, and search.elasticsearch-tutorial. Left as ga 9.5+: streams-management and search.vector-hybrid-search (successors of skills marked ga 9.4, removed 9.5 — flagging preview here would misrepresent a GA capability as a downgrade), and workflow-authoring and automatic_troubleshooting (which already existed as preview in 9.4). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Member
Author
|
👋 This PR updates the built-in skills reference for 9.5. If you added one of the new skills below, could you sanity-check its entry — description, assigned tools (built-in vs skill-scoped inline), and availability/gating?
Thanks! |
|
@leemthompo lgtm ( |
tcalopes
reviewed
Jul 8, 2026
|
|
||
| ::: | ||
|
|
||
| {applies_to}`stack: ga 9.5+` From 9.5, the skill can also list watchlists to discover watchlist names and members, using the `security.list_watchlists` tool. |
There was a problem hiding this comment.
this skill also now also have access to set_asset_criticality tool
elastic/kibana#275477
Per kibana #275477, entity-analytics can now also set entity asset criticality via the built-in security.set_asset_criticality tool. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Comment on lines
+177
to
+185
| ### Agent and skill authoring | ||
|
|
||
| $$$agent-builder-skill-authoring-skill$$$ `skill-authoring` {applies_to}`stack: preview 9.5` {applies_to}`serverless: preview` | ||
| : Authors a new {{agent-builder}} skill from a chat description. Use when a user asks to create, build, generate, or design a skill, capability, or expertise area for an agent. | ||
|
|
||
| :::{dropdown} Assigned tools | ||
| Internal tools to list available tools and to propose or patch a skill definition. | ||
|
|
||
| ::: |
There was a problem hiding this comment.
@leemthompo has 9.5 been cut for release? i think the skill_authoring_skill is now called skill_management_skill https://github.com/elastic/kibana/pull/271463/changes#diff-c0bcb0f583598be2dbf7d273ffc206d7eb932385e7ce3e5945354a37686e2ea1 based on this change
Member
Author
There was a problem hiding this comment.
Good catch. 9.5 hasn't been released yet (current GA is 9.4.x). Renamed the skill to skill-management and updated the description to cover the view and edit flows in 16912b5
charlotte-hoblik
approved these changes
Jul 12, 2026
|
|
||
| $$$agent-builder-search-hybrid-search-skill$$$ `search.hybrid-search` {applies_to}`stack: ga 9.4+` | ||
| : Guides agents through building hybrid search solutions that combine keyword and semantic search. | ||
| $$$agent-builder-search-elasticsearch-tutorial-skill$$$ `search.elasticsearch-tutorial` {applies_to}`stack: preview 9.5` |
Contributor
There was a problem hiding this comment.
Suggested change
| $$$agent-builder-search-elasticsearch-tutorial-skill$$$ `search.elasticsearch-tutorial` {applies_to}`stack: preview 9.5` | |
| $$$agent-builder-search-elasticsearch-tutorial-skill$$$ `search.elasticsearch-tutorial` {applies_to}`stack: preview 9.5` {applies_to}`serverless: preview` |
natasha-moore-elastic
left a comment
natasha-moore-elastic
left a comment
Contributor
There was a problem hiding this comment.
Thanks for adding the EA skills – left a small suggestion.
|
|
||
| **Prerequisites:** The `leadGenerationEnabled` {{elastic-sec}} [experimental feature flag](kibana://reference/configuration-reference/security-solution-settings.md#experimental-features) must be enabled. | ||
|
|
||
| $$$agent-builder-manage-watchlists-skill$$$ `manage-watchlists` {applies_to}`stack: preview 9.5` {applies_to}`serverless: preview` |
Contributor
There was a problem hiding this comment.
Suggested change
| $$$agent-builder-manage-watchlists-skill$$$ `manage-watchlists` {applies_to}`stack: preview 9.5` {applies_to}`serverless: preview` | |
| $$$agent-builder-manage-watchlists-skill$$$ `manage-watchlists` {applies_to}`stack: ga 9.5` {applies_to}`serverless: ga` |
Member
Author
There was a problem hiding this comment.
Added in 16912b5. Used the open-ended ga 9.5+ form to match the rest of the file, and dropped the on-by-default feature-flag prerequisite.
@leemthompo Since this stuff is still behind a feature flag, I wonder whether we should omit it from the docs for now, wdyt? |
- Rename skill-authoring to skill-management (kibana #271463), covering create and edit flows - manage-watchlists to GA (stack: ga 9.5+, serverless: ga) and drop the on-by-default feature-flag prerequisite (per @tcalopes) - entity-analytics-leads: "threat hunting leads" wording (stays preview); drop the on-by-default feature-flag prerequisite - rule-management: drop "notification policies", list the platform.alerting.manage_action_policy tool (per @miguelmartin-elastic) - search.elasticsearch-tutorial: add serverless: preview badge Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The significant events and Knowledge Indicators skills (significant-events- management, significant-events-onboarding, knowledge-indicators-management, ki-identification-management, streams-investigation-management, streams-gap-detection) are gated by the streams.significantEventsAvailable feature flag, which defaults off and is Elastic-controlled, not a user-facing setting. Comment them out with a TODO until the flag is generally available. streams-management is not gated and stays live. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Member
Author
|
👋 @flash1293 good call. We've been documenting features gated by the |
leemthompo
added a commit
that referenced
this pull request
Jul 15, 2026
Aligns the {{agent-builder}} built-in tools reference with the current
tool registry in Kibana (`AGENT_BUILDER_BUILTIN_TOOLS` in
[`allow_lists.ts`](https://github.com/elastic/kibana/blob/main/x-pack/platform/packages/shared/agent-builder/agent-builder-server/allow_lists.ts#L19))
for 9.5, using the code as the source of truth. Companion to the
built-in skills reference update in
#7255.
## Changes
- **New platform tools:** workflow execution tools (`generate_workflow`,
`execute_workflow`, `list_workflow_executions`), Cases CRUD tools
(`platform.core.cases.*`), the workflows authoring namespace
(`platform.workflows.*`), significant events and Knowledge Indicator
tools (`platform.sig_events.*`), and the new streams tools
(`inspect_streams`, `diagnose_stream`, `design_pipeline`,
`list_ilm_policies`, `update_stream`, `create_partition`,
`delete_stream`).
- **New security tools:** `set_asset_criticality`, the four SIEM
readiness tools, and the feature-flagged tools for rule preview,
watchlists, lead generation, and PCI compliance — each with its
experimental flag and license prerequisites.
- **Cumulative streams consolidation:** the six read tools replaced in
9.5 (`list_streams`, `get_stream`, `get_schema`, `get_data_quality`,
`get_lifecycle_stats`, `get_failed_documents`) are kept and marked
`removed 9.5`, each pointing to its replacement.
- **Lifecycle tagging:** every tool that debuts in 9.5 is tagged
`preview 9.5` (brand-new capabilities ship as technical preview; this
isn't inferred from feature-flag presence). Pre-9.5 tools keep their
existing GA tags.
- **Protected namespaces:** adds `platform.alerting.*` and
`platform.sig_events.*` to the list on `custom-tools.md`, tagged `ga
9.5+` (git history of `namespaces.ts` shows both were added to the
`protectedNamespaces` array after the 9.5 branch cut; the same method
reproduces the existing `platform.streams.* ga 9.4+` entry).
## Judgment calls for review
A few allow-list entries aren't straightforward standalone tools. I
resolved them as follows — flagging in case you'd prefer differently:
- `platform.alerting.manage_rule` and `security.alert-triage` are
`BuiltinSkillBoundedTool`s exposed only through their skill, not
registered standalone. Per the issue's "skill-scoped inline tools should
not be listed" guidance, they're covered under **Inline tools** rather
than the namespaced lists.
- `platform.workflows.list_workflows` and
`platform.workflows.get_workflow` exist only as internal HTTP routes
(`access: 'internal'`) backing the workflow-tool editor, not as
agent-callable tools. Omitted.
- `platform.core.sml_search` / `sml_attach` (Semantic Metadata Layer)
require the experimental Context Engine (`contextEngine:enabled`) and
map to no documented feature, so they're commented out following the
page's existing pattern for not-yet-public tools.
Built and previewed locally with docs-builder (0 errors / 0 warnings).
Closes elastic/docs-content-internal#1431
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Sean Story <sean.story@elastic.co>
Co-authored-by: Charlotte Hoblik <116336412+charlotte-hoblik@users.noreply.github.com>
leemthompo
marked this pull request as ready for review
July 15, 2026 10:15
miguelmartin-elastic
approved these changes
Jul 15, 2026
miguelmartin-elastic
left a comment
miguelmartin-elastic
left a comment
There was a problem hiding this comment.
thanks for addressing the comments! 🚀
leemthompo
enabled auto-merge (squash)
July 15, 2026 12:30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
9 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the Agent Builder built-in skills reference to match the current skill registry in Kibana (
allow_lists.ts) for 9.5, using the code as the source of truth.Changes
applies_tobadges:streams-exploration→streams-managementsearch.hybrid-search,search.semantic-search, andsearch.vector-database→search.vector-hybrid-searchworkflow-authoringto GA in 9.5, with a dropdown for the earlier 9.4 behavior.skills.md.Built and previewed locally with
docs-builder(0 errors / 0 warnings).Part of the Agent Builder 9.5 docs audit (elastic/docs-content-internal#1425). The built-in tools reference update is tracked separately in elastic/docs-content-internal#1431.
🤖 Generated with Claude Code