Individual skill
kibana-anomaly-detection
Elastic ML anomaly detection — investigation/RCA, score explanation, job lifecycle troubleshooting, and job operations. Use when answering "what broke?"/"which entity?"/RCA, "why is score high/low?"/renormalization, "datafeed stopped"/"memory limit"/hard_limit, or configuring ML anomaly detection jobs. Reads results from `.ml-anomalies-*` and job state from ML REST APIs.
skills/kibana/kibana-anomaly-detection/SKILL.md
Source commit 09d879dfe23436684e11391a5e5a74a2aedd6b04
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 6, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 604
- Repository last updated
- Nov 6, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- operations Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 24,276 bytesSKILL.mdcore · 24,276 bytesSKILL.mdcore · 24,276 bytesSKILL.mdcore · 24,276 bytesSKILL.mdcore · 24,276 bytesSKILL.mdcore · 24,276 bytesSKILL.mdcore · 24,276 bytesSKILL.mdcore · 24,276 bytesreferences/README.mddoc · 1,998 bytesreferences/agent-builder-companion.mddoc · 882 bytesreferences/anomaly-detection-functions.mddoc · 12,049 bytesreferences/investigation-queries.mddoc · 3,459 bytesreferences/job-creation-recipes.mddoc · 7,911 bytesreferences/observability-anomaly-expert.mddoc · 4,667 bytesreferences/protocols/investigation.mddoc · 5,864 bytesreferences/score-reference.mddoc · 7,182 bytesreferences/security-anomaly-expert.mddoc · 5,168 bytesreferences/troubleshooting-reference.mddoc · 4,153 bytesreferences/worked-example.mddoc · 7,742 bytes
Read excerpt
# Elastic ML Anomaly Detection
Expert process for ML anomaly detection: attribute incidents to entities, explain scores and model behavior, diagnose
job lifecycle failures, and manage jobs. Read anomaly **results** from `POST /.ml-anomalies-*/_search` (Serverless-safe)
and **job/datafeed state** from ML REST APIs. When the user embeds fixture evidence (influencer rows, job stats) in the
prompt, apply the judgment below directly — do not re-fetch fields already supplied.
<!-- begin-partial: preamble -->
## Environment Configuration
This skill executes Elasticsearch operations through the `elastic` CLI. If the
[`elastic` CLI](https://github.com/elastic/cli#configuration) is not installed, tell the user what it is needed for. Do
not guess credentials, call the HTTP API directly, or attempt other workarounds.