Elasticsearch
DatabaseCommonly used with
Skills using Elasticsearch (19)
health
Service/infra health via liveness/readiness checks, resource usage, quick diagnostics. Triggers: health check, services up, system status, infra health, degraded service.
log-analysis--siem-integration
Security log parsing, anomaly detection, SIEM query building, Sigma rule creation, and correlation rule development across Splunk, Elastic, QRadar, and Microsoft Sentinel
building-detection-rules-with-sigma
Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.
building-super-timelines-with-plaso
Generate log2timeline and Plaso super-timelines and triage them in Timesketch.
log-analyzer
日志分析助手 — 智能解析日志文件，识别异常模式，定位问题根因
hunt-nosqli
Hunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump. Use when target uses MongoDB/Mongoose, CouchDB, Redis, or shows NoSQL error messages.
hunt-rag-vector
Hunt vector-store / embedding-layer weaknesses in RAG pipelines (OWASP LLM08 Vector and Embedding Weaknesses) — persistent corpus poisoning that survives across sessions and users (distinct from one-shot indirect prompt injection, which is owned by hunt-llm-ai), cross-tenant vector-database IDOR (unauthenticated or unscoped queries against Pinecone/Weaviate/Chroma/Milvus/Qdrant/pgvector), source-text/metadata leakage in similarity-search results, and retrieval-hijack via adversarial embedding proximity ('SEO poisoning' for RAG). Targets: any app with a shared knowledge base, document upload feeding a chatbot, or a directly reachable vector-DB port. Validate: a second, clean session/account must inherit a poisoned result, or a cross-tenant artifact must be independently verifiable — confabulation is not a finding, same bar as hunt-llm-ai. Use when target is RAG-backed, exposes a vector-DB port, or lets users upload documents that other users' queries later retrieve.
algo-ecom-bm25
"Implement BM25 ranking function for e-commerce product search relevance scoring. Use this skill when the user needs to build a text-based product search engine, improve search result relevance, or replace basic TF-IDF with a more robust ranking function — even if they say 'product search ranking', 'search relevance', or 'BM25 implementation'.".
hunt-cloud-misconfig
Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed CloudFront origin, public Lambda function URL, public RDS snapshot, IAM credentials in JS bundles, AWS metadata accessible via SSRF. GCP: public GCS buckets, exposed Cloud Run services, leaked service account JSON. Azure: public blob containers, exposed Function App. (Kubernetes/Docker exposure is owned by hunt-k8s; CI/CD pipeline attacks by hunt-cicd; post-credential IAM escalation by cloud-iam-deep.) Detection: targeted dorking, certificate transparency, JS bundle secret extraction, port scan for known service ports. Validate: actual data read / write / RCE. Use when hunting cloud-native storage and compute misconfig (S3/GCS/Blob, IMDS-via-SSRF, serverless, public managed services).
elasticsearch
Elasticsearch 集群管理
database
Database design, SQL, NoSQL, and data management
logging-patterns
Python logging patterns covering stdlib logging configuration, structured logging with structlog, log levels, handlers, formatters, and context binding. Use whenever a project uses Python logging, structlog, or the user asks about log levels, log formatting, structured logs, or JSON logging, even if "logging" is not mentioned by name.
btp-cloud-logging
SAP BTP Cloud Logging — OpenSearch-based centralized logging with structured logs, correlation IDs, Kibana dashboards, and retention management.
btp-developer-guide
SAP BTP Developer Guide — runtime selection, CAP/ABAP Cloud/SAP Build, integration patterns, CI/CD, monitoring
observability
Backend observability patterns — structured logging, Micrometer metrics, OpenTelemetry tracing, Spring Boot Actuator, Kubernetes health probes, alerting, and dashboards. Use when user mentions logging, metrics, tracing, monitoring, health checks, or Prometheus.
elk
Hub Q&A for ELK Stack — route log-check, es-query, logstash, kibana-dashboard, elk-health. Evidence-only.
es-query
Build Elasticsearch Query DSL / Kibana KQL / Lucene — filters, aggs, sort. Read-only samples; no prod API calls.
kibana-dashboard
Spec a Kibana dashboard — panels, KQL filters, on-call layout. No auto NDJSON export to prod.
zeal-docs
Consult offline documentation from locally installed Zeal (Linux) / Dash docsets. Use this WHENEVER a coding, debugging, or config task involves a technology that has a docset installed — to confirm exact signatures, flags, return values, defaults, or behavior instead of relying on memory, AND for conceptual "how do I / how does X work" questions, since docsets also contain tutorials and how-to guides. Installed docsets include Ansible, Bash, Bootstrap 5, C, Django, Docker, ElasticSearch, Emmet, Flask, Go, HTML, Jinja, Nginx, NodeJS, PostgreSQL, Python 3, Python Telegram Bot, Redis, Rust, SQLAlchemy, SQLite, Scrapy, and Wagtail. Trigger on questions like "what are the args to X", "does this function return Y", "which flag does Z", "how do I do X in Python/Go/...", or before writing non-trivial API calls in these languages/frameworks. Works fully offline; no network needed.
Integration detected automatically from skill content. Some results may be false positives.