skills/o11y-full-setup/SKILL.md
Interactive guide for complete Observability setup — discovers data, presents summary, creates dashboards and SLOs based on user approval.
npx skillsauth add patrykkopycinski/elastic-cursor-plugin o11y-full-setupInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Guide the user through a complete Observability configuration for their Elastic deployment.
This is the umbrella skill. For focused tasks, see the related skills:
o11y-slo-setupfor SLO creation,o11y-service-dashboardfor individual service dashboards.
Use when the user asks to:
Also activates on keywords: "observability setup", "O11Y onboarding", "monitoring setup", "full observability", "end-to-end monitoring"
Do NOT use when:
o11y-slo-setup)o11y-service-dashboard)Call get_cluster_context to get cached cluster awareness — version, health, installed features, and observability capabilities. This determines what's already configured and what needs setup.
Call discover_o11y_data with no filters to get a complete picture of available data.
Present the results to the user as a summary:
Call get_data_summary with the discovery results and format: "json".
Present the recommendations to the user:
Ask the user which recommended dashboards they want to create:
For each approved dashboard, call kibana_api with POST /api/dashboards/dashboard and the recommended configuration as the request body.
Report each created dashboard with its URL.
Ask the user which recommended SLOs they want to create:
For each approved SLO, call kibana_api with POST /api/observability/slos and the configured parameters as the request body.
Report each created SLO with its ID and URL.
Present a final summary:
If APM data is missing or the user wants to add new services, call setup_apm to guide application instrumentation:
If log data is missing or incomplete, call setup_log_shipping to configure log ingestion:
After dashboards and SLOs are created, offer to set up alerting using create_alert_rule:
get_cluster_context — cached cluster awareness (version, health, capabilities)discover_o11y_data — discover available O11Y dataget_data_summary — generate summary with recommendationssetup_apm — guide application instrumentation setupsetup_log_shipping — configure log ingestioncreate_alert_rule — create alert rules for services and infrastructurecreate_dashboard — high-level dashboard creation from discovered datakibana_api — create dashboards (POST /api/dashboards/dashboard) and SLOs (POST /api/observability/slos)elastic://docs/api/kibana — Kibana REST API reference for dashboard and SLO endpointsES_URL and ES_API_KEY (or basic auth) configuredo11y-slo-setup — focused SLO creation workflowo11y-service-dashboard — focused service dashboard creationtesting
Interactive threat hunting workflow using ES|QL and Elasticsearch queries — from hypothesis formulation through data exploration, IOC search, and finding documentation.
testing
Start your security session with a personalized briefing — attacks, alerts, cases, rules, threat intel. Use as the first thing when starting security work.
testing
Interactive guide for complete Elastic Security setup — discovers data sources, assesses detection coverage, configures rules, and creates security dashboards.
testing
Guide for authoring custom detection rules — from threat hypothesis through rule creation, testing, and tuning with KQL, EQL, ES|QL, and threshold rules.