Repository navigation
chore: sync agent-skills 0.7.0 - #61
Merged
Merged
Conversation
elastic-vault-github-plugin-prod
Bot
requested a review
from a team
as a code owner
October 28, 2026 17:51
dennis-tismenko
approved these changes
Oct 28, 2026
There was a problem hiding this comment.
🟡 Changes recommended
The manifest omits all five new skills, and a deleted query script is still referenced by documented workflows, leaving functionality inaccessible or broken.
8 open issues
What changed in this PR
Syncs the plugin’s skill content from elastic/agent-skills 0.7.0, expanding investigation workflows and updating Elasticsearch and Kibana guidance.
Changes:
- Adds security alert analysis, ML integration management, cloud-provider investigation, and cross-solution case management.
- Refreshes ES|QL compatibility guidance, onboarding access patterns, and ingest safeguards.
- Consolidates dashboard examples and design references, and removes legacy alert-triage scripts.
| File | Description |
|---|---|
skills/security/ml-integrations/SKILL.md |
Adds ML package installation and management workflow. |
skills/security/ml-integrations/references/README.md |
Documents ML skill requirements and usage. |
skills/security/ml-integrations/references/package-capabilities.md |
Defines package mappings, pipelines, and source patterns. |
skills/security/alert-triage/scripts/run-query.js |
Removes the legacy query runner. |
skills/security/alert-triage/scripts/kibana-client.js |
Removes the standalone Kibana client. |
skills/security/alert-triage/scripts/fetch-next-alert.js |
Removes the scripted alert fetcher. |
skills/security/alert-triage/scripts/es-client.js |
Removes the standalone Elasticsearch client. |
skills/security/alert-triage/scripts/acknowledge-alert.js |
Removes scripted alert acknowledgement. |
skills/security/alert-analysis/SKILL.md |
Adds CLI-based alert investigation and acknowledgement. |
skills/security/alert-analysis/references/classification-guide.md |
Adds evidence-based alert classification guidance. |
skills/observability/sre-triage/SKILL.md |
Bumps skill metadata version. |
skills/observability/sre-triage/references/apm-signals.md |
Clarifies duration units and attribute correlation. |
skills/observability/csp-investigation/SKILL.md |
Adds cloud-resource investigation workflow. |
skills/observability/csp-investigation/references/aws.md |
Adds AWS telemetry schemas and failure signatures. |
skills/kibana/kibana-dashboards/references/dashboard-design.md |
Adds dashboard composition, controls, and layout guidance. |
skills/kibana/kibana-dashboards/references/color-palettes.md |
Adds palette identifiers and color previews. |
skills/kibana/kibana-dashboards/references/chart-types-reference.md |
Clarifies trend backgrounds and duration formatting. |
skills/kibana/kibana-dashboards/assets/metric-esql.json |
Removes the standalone metric example. |
skills/kibana/kibana-dashboards/assets/line-chart-timeseries.json |
Removes the standalone time-series example. |
skills/kibana/kibana-dashboards/assets/ecommerce-analytics-dashboard.json |
Removes the e-commerce dashboard example. |
skills/kibana/kibana-dashboards/assets/demo-dashboard.json |
Removes the previous demo dashboard. |
skills/kibana/kibana-dashboards/assets/datatable.json |
Removes the standalone table example. |
skills/kibana/kibana-dashboards/assets/dashboard-with-visualizations.json |
Removes the previous visualization dashboard example. |
skills/kibana/kibana-dashboards/assets/dashboard-esql.json |
Adds a sectioned ES|QL dashboard with controls. |
skills/kibana/kibana-dashboards/assets/dashboard-data-view.json |
Adds a sectioned data-view dashboard with controls. |
skills/kibana/kibana-dashboards/assets/dashboard-basic.json |
Removes the basic markdown dashboard example. |
skills/kibana/kibana-dashboards/assets/bar-chart-esql.json |
Removes the standalone bar-chart example. |
skills/kibana/kibana-cases/SKILL.md |
Adds solution-scoped case management workflows. |
skills/kibana/kibana-cases/references/kibana-cases-api.md |
Documents case endpoints and payloads. |
skills/elasticsearch/elasticsearch-onboarding/SKILL.md |
Adds CLI access guidance and write confirmation. |
skills/elasticsearch/elasticsearch-onboarding/references/mcp-setup/mcp-setup.md |
Removes the previous MCP setup reference. |
skills/elasticsearch/elasticsearch-onboarding/references/elasticsearch-onboarding-playbook.md |
Updates discovery, cluster access, and validation steps. |
skills/elasticsearch/elasticsearch-onboarding/references/code-generation/code-generation.md |
Separates application connections from agent access. |
skills/elasticsearch/elasticsearch-onboarding/references/cluster-access/cluster-access.md |
Adds access protocols and optional IDE setup guidance. |
skills/elasticsearch/elasticsearch-ingest/SKILL.md |
Reinforces connectivity checks and deletion confirmation. |
skills/elasticsearch/elasticsearch-ingest/references/ndjson-bulk-format.md |
Clarifies reuse of prepared bulk NDJSON. |
skills/elasticsearch/elasticsearch-ingest/references/mapping-design.md |
Requires confirmation before destructive mapping repair. |
skills/elasticsearch/elasticsearch-esql/SKILL.md |
Expands version gates, feature routing, and fallbacks. |
skills/elasticsearch/elasticsearch-esql/references/time-series-queries.md |
Updates PromQL status and metric casts. |
skills/elasticsearch/elasticsearch-esql/references/query-patterns.md |
Updates feature availability labels. |
skills/elasticsearch/elasticsearch-esql/references/generation-tips.md |
Adds syntax constraints and newer query patterns. |
skills/elasticsearch/elasticsearch-esql/references/esql-search.md |
Clarifies search placement and expression support. |
skills/elasticsearch/elasticsearch-esql/references/esql-search-strategy.md |
Updates availability and corrects reranking syntax. |
CHANGELOG.md |
Records the release sync and added skills. |
Review effort: Balanced
| ### Added | ||
|
|
||
| - chore: sync agent-skills 0.7.0 (#61) | ||
| - Skills added: `kibana/kibana-cases`, `kibana/kibana-context-engine`, `observability/csp-investigation`, `security/alert-analysis`, `security/ml-integrations` |
Comment on lines
+245
to
+246
| ¹ `find-cases` exposes no filter flags in the current CLI release; for `owner`, `status`, `tags`, `search`, and | ||
| pagination, run `GET kbn:/api/cases/_find` with query params via the HTTP transport directly. |
| 5. **Install the Fleet package, then apply shared mappings.** After confirmation: | ||
| - `POST kbn:/api/fleet/epm/packages/{package}` to install assets (transforms may be deferred until started). | ||
| - If the package uses a component template: `PUT /_component_template/{name}` with the merged or new body. Then | ||
| `POST /{data_stream}/_rollover` on the rollover target so new indices pick up mappings. |
| 2. Present the plan: warn about empty source data; merge `process.command_line_entropy`; create the PAD pipeline | ||
| processor; start both transforms; create the PAD data view. Wait for confirm. | ||
| 3. After confirm: `POST kbn:/api/fleet/epm/packages/pad`, merge-and-`PUT` the shared template, `PUT` the pipeline, | ||
| restamp via existing description (reset only if transforms are new or stopped), `POST /_aliases` for each `.all` |
Comment on lines
+195
to
+196
| | `GET kbn:/internal/ml/modules/get_module/{module_id}` | CLI gap — ML module get is an internal Kibana API; keep this shorthand as the contract | | ||
| | `POST kbn:/internal/ml/modules/setup/{module_id}` | CLI gap — ML module setup is an internal Kibana API; keep this shorthand as the contract | |
Comment on lines
+86
to
+88
| When `GET /_ingest/pipeline/{name}` returns a pipeline, append the package processor to the existing `processors` list. | ||
| When it returns 404, create a pipeline with a single processor. PAD and ProblemChild share | ||
| `logs-endpoint.events.process@custom` — always append. |
Comment on lines
+107
to
+109
| **One instance degrading while its fleet siblings stay healthy = the cause is scoped to that instance.** Check the same | ||
| metric on sibling resources. Healthy siblings rule out platform-wide issues, shared event sources, and shared downstream | ||
| dependencies — the fault is in the affected instance's own code, configuration, or deployment. |
Comment on lines
+142
to
+146
| **Absence of a metric field is data.** Cloud providers omit zero-valued sparse counters (error counts, per-code 5xx, | ||
| throttle counts), so the field may be unmapped in Elastic until the first such event ever occurs — and ES|QL fails the | ||
| whole query on an unknown column. Check the field with `GET /_field_caps` before referencing it, or query sparse fields | ||
| in separate small queries; a verification failure or empty result on a sparse counter means "no such events ever | ||
| recorded," never "data missing." |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated sync from elastic/agent-skills release 0.7.0