skills/o11y-slo-setup/SKILL.md
Interactive guide for creating SLOs from discovered APM and metric data — identifies candidates, lets user configure targets, and creates SLOs.
npx skillsauth add patrykkopycinski/elastic-cursor-plugin o11y-slo-setupInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Guide the user through creating Service Level Objectives based on their available data.
Use when the user asks to:
Also activates on keywords: "SLO", "service level", "burn rate", "error budget", "SLI", "availability target"
Do NOT use when:
o11y-service-dashboard)o11y-full-setup)Call get_cluster_context to get cached cluster awareness — version, health, installed features, and SLO capabilities. This confirms that the SLO feature is available in the Kibana deployment.
Call discover_o11y_data to find APM services and metrics that can support SLOs.
Call get_data_summary with format: "json" to get SLO recommendations.
Present each candidate:
Ask the user:
Call kibana_api with GET /api/observability/slos to check for duplicates.
If any existing SLOs overlap with selections, warn the user and ask whether to skip or create anyway.
For each approved SLO, call kibana_api with POST /api/observability/slos and the configured parameters as the request body.
Report each created SLO:
Present:
For each created SLO, offer to set up burn rate alerts using create_alert_rule. Burn rate alerts trigger when the error budget is being consumed faster than expected, giving early warning before an SLO breach.
get_cluster_context — cached cluster awareness (version, health, capabilities)discover_o11y_data — discover APM services and metrics for SLO candidatesget_data_summary — generate SLO recommendationskibana_api — list existing SLOs (GET /api/observability/slos) and create new ones (POST /api/observability/slos)create_alert_rule — create burn rate alerts for SLOselastic://docs/api/kibana — Kibana REST API reference for SLO endpoints (/api/observability/slos)ES_URL and ES_API_KEY configuredInteractive Dashboard: When using Claude Desktop or other ext-apps hosts,
slo_dashboardrenders an interactive SLO monitoring view with burn rate gauges and error budget tracking, andslo_forecasterprojects SLO compliance with confidence intervals. In Cursor/CLI, both return markdown.
o11y-full-setup — complete observability setup including dashboards and SLOso11y-service-dashboard — create service dashboards to complement SLO monitoringtesting
Interactive threat hunting workflow using ES|QL and Elasticsearch queries — from hypothesis formulation through data exploration, IOC search, and finding documentation.
testing
Start your security session with a personalized briefing — attacks, alerts, cases, rules, threat intel. Use as the first thing when starting security work.
testing
Interactive guide for complete Elastic Security setup — discovers data sources, assesses detection coverage, configures rules, and creates security dashboards.
testing
Guide for authoring custom detection rules — from threat hypothesis through rule creation, testing, and tuning with KQL, EQL, ES|QL, and threshold rules.