[Security] Add Agent Builder Entity Analytics skills and tools by natasha-moore-elastic · Pull Request #7333 · elastic/docs-content

natasha-moore-elastic · 2026-07-13T11:48:54Z

Summary

Documents the new Entity Analytics AB skills and tools for watchlists, threat hunting leads, and asset criticality. Resolves #7288.

Changes:

Built-in skills reference: adds the manage-watchlists and entity-analytics-leads skills, and updates the existing entity-analytics skill to add security.list_watchlists and security.set_asset_criticality to its assigned tools.
Built-in tools reference: adds the 10 new security.* tools
Security use cases: adds Watchlist management and Threat hunting leads sections with example prompts, plus an asset criticality prompt for the entity risk investigation use case.
Watchlists and Asset criticality pages: adds cross-reference notes to the new Agent Builder chat capabilities.

Made with Cursor

Document the new manage-watchlists and entity-analytics-leads skills, the 10 new security tools (watchlists, threat hunting leads, and asset criticality), and update the existing entity-analytics skill. Adds watchlist and threat hunting leads use cases and cross-references from the watchlists and asset criticality pages. Co-authored-by: Cursor <cursoragent@cursor.com>

github-actions · 2026-07-13T11:49:30Z

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

github-actions · 2026-07-13T11:50:14Z

🔍 Preview links for changed docs

github-actions · 2026-07-13T11:50:18Z

Elastic Docs Style Checker (Vale)

Summary: 1 suggestion found

💡 Suggestions (1): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
solutions/security/ai/agent-builder/skills-use-cases.md	88	Elastic.FirstPerson	Use caution when using first-person pronouns such as 'me.'

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

leemthompo · 2026-07-13T15:04:07Z

👋 @natasha-moore-elastic! Heads-up so we don't collide: I have two open PRs doing a bulk 9.5 refresh of the same reference files you've edited here, #7262 (tools) and #7255 (skills).

They already cover most of the reference-file changes in this PR:

Update Agent Builder built-in tools reference for 9.5 #7262 adds all 10 of these security.* tools, grouped with their feature-flag and license prerequisites.
Update Agent Builder built-in skills reference for 9.5 #7255 adds manage-watchlists and entity-analytics-leads, and updates entity-analytics with list_watchlists + set_asset_criticality.

One option, if you're happy with it: drop the two reference files from this PR and let mine carry them. That would keep this PR focused on the unique parts, the use-case sections in skills-use-cases.md and the cross-reference tips in asset-criticality.md/watchlists.md. Just a suggestion though, whatever works best for you. Also happy to fold in any tweaks you'd like to how I've documented these in #7262/#7255.

One thing to reconcile first: I tagged these preview 9.5, this PR has them ga 9.5+. On latest kibana main they're all still behind experimental flags (though most default on), so I've leaned preview. @tcalopes could you confirm the intended 9.5 state? Happy to update either way. Thanks!

tcalopes · 2026-07-13T17:48:33Z

One thing to reconcile first: I tagged these preview 9.5, this PR has them ga 9.5+. On latest kibana main they're all still behind experimental flags (though most default on), so I've leaned preview. @tcalopes could you confirm the intended 9.5 state? Happy to update either way. Thanks!

@leemthompo thanks for bringing this up, I missed that. Watchlist is GA but Leads is still considered in preview.

natasha-moore-elastic · 2026-07-14T08:08:51Z

Hey @leemthompo, thanks for the heads-up. Happy to go along with your suggestion – I'll have a look at your PRs and drop the reference files from mine 👍

Revert builtin-skills-reference.md and builtin-tools-reference.md to match main; these reference pages will be handled in a separate PR. Co-authored-by: Cursor <cursoragent@cursor.com>

alexandra5000

I left some minor suggestions, otherwise it looks good to me.

alexandra5000 · 2026-07-15T15:07:40Z

+
+**Enable:** `manage-watchlists`
+
+Use this skill to manage [entity watchlists](/solutions/security/advanced-entity-analytics/watchlists.md) — groups of important entities, such as executives or critical infrastructure hosts, whose membership factors into entity risk scoring — directly from chat. The agent can list, create, update, and delete watchlists, and add or remove entities.


Suggested change

Use this skill to manage [entity watchlists](/solutions/security/advanced-entity-analytics/watchlists.md) — groups of important entities, such as executives or critical infrastructure hosts, whose membership factors into entity risk scoring — directly from chat. The agent can list, create, update, and delete watchlists, and add or remove entities.

Use this skill to manage [entity watchlists](/solutions/security/advanced-entity-analytics/watchlists.md) groups of important entities (such as executives or critical infrastructure hosts, whose membership factors into entity risk scoring) directly from chat. The agent can list, create, update, and delete watchlists, and add or remove entities.

Doesn't it read better as a side information with brackets? I feel like in your version the first em dash shouldn't be there anyway.

Co-authored-by: Aleksandra Spilkowska <96738481+alexandra5000@users.noreply.github.com>

tcalopes · 2026-07-15T15:42:13Z

+## Threat hunting leads
+
+```{applies_to}
+stack: ga 9.5+


based on what leemthompo raised in #7333 (comment) I think this should be preview and not ga for leads?

@tcalopes, you're absolutely right, I thought I'd fixed it. 🤦‍♀️
Pushed a fix here: #7386
Thanks for flagging!

## Summary Fixes lifecycle state for threat hunting leads skill since the feature is still in preview. Related to #7333. ## Generative AI disclosure  1. Did you use a generative AI (GenAI) tool to assist in creating this contribution? - [ ] Yes - [x] No

natasha-moore-elastic requested review from a team as code owners July 13, 2026 11:48

natasha-moore-elastic requested a review from tcalopes July 13, 2026 11:54

natasha-moore-elastic changed the title ~~Add Agent Builder Entity Analytics skills and tools for 9.5~~ [Security] Add Agent Builder Entity Analytics skills and tools Jul 13, 2026

tcalopes reviewed Jul 13, 2026

View reviewed changes

Comment thread explore-analyze/ai-features/agent-builder/builtin-skills-reference.md Outdated

Comment thread explore-analyze/ai-features/agent-builder/builtin-skills-reference.md Outdated

natasha-moore-elastic mentioned this pull request Jul 14, 2026

Update Agent Builder built-in tools reference for 9.5 #7262

Merged

Revert built-in skills and tools reference changes

e94e2c4

Revert builtin-skills-reference.md and builtin-tools-reference.md to match main; these reference pages will be handled in a separate PR. Co-authored-by: Cursor <cursoragent@cursor.com>

alexandra5000 approved these changes Jul 15, 2026

View reviewed changes

Apply suggestions from code review

3fab071

Co-authored-by: Aleksandra Spilkowska <96738481+alexandra5000@users.noreply.github.com>

natasha-moore-elastic commented Jul 15, 2026

View reviewed changes

Comment thread solutions/security/ai/agent-builder/skills-use-cases.md Outdated

natasha-moore-elastic added 2 commits July 15, 2026 16:24

Apply suggestion from @natasha-moore-elastic

fe948f5

Merge branch 'main' into 7288-ea-skills

eea35b4

natasha-moore-elastic enabled auto-merge (squash) July 15, 2026 15:41

tcalopes reviewed Jul 15, 2026

View reviewed changes

natasha-moore-elastic merged commit 6537a06 into main Jul 15, 2026
7 of 8 checks passed

natasha-moore-elastic deleted the 7288-ea-skills branch July 15, 2026 15:42

github-actions Bot deployed to docs-preview July 15, 2026 15:45 View deployment

natasha-moore-elastic mentioned this pull request Jul 15, 2026

[Security] Fix lifecycle state for threat hunting leads skill #7386

Merged

2 tasks


		Enable: `manage-watchlists`

		Use this skill to manage [entity watchlists](/solutions/security/advanced-entity-analytics/watchlists.md) — groups of important entities, such as executives or critical infrastructure hosts, whose membership factors into entity risk scoring — directly from chat. The agent can list, create, update, and delete watchlists, and add or remove entities.

Uh oh!

Conversation

natasha-moore-elastic commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

github-actions Bot commented Jul 13, 2026

Elastic Docs AI PR menu

Uh oh!

github-actions Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

github-actions Bot commented Jul 13, 2026

Elastic Docs Style Checker (Vale)

Uh oh!

Uh oh!

Uh oh!

leemthompo commented Jul 13, 2026

Uh oh!

tcalopes commented Jul 13, 2026

Uh oh!

natasha-moore-elastic commented Jul 14, 2026

Uh oh!

alexandra5000 left a comment

Choose a reason for hiding this comment

Uh oh!

alexandra5000 Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tcalopes Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

natasha-moore-elastic Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

natasha-moore-elastic commented Jul 13, 2026 •

edited

Loading

github-actions Bot commented Jul 13, 2026 •

edited

Loading