Agent workflows for building and maintaining Elastic integrations — works with Cursor, Claude Code, Codex, and any LLM-powered coding environment.

Beta — This is the initial release. Skills are under active development — expect changes, and please report any issues you find.

Integration Skills is a public collection of agentic workflows that cover the full lifecycle of building, reviewing, and maintaining Elastic integration packages. The skills are LLM-agnostic by design: they work with whatever AI-powered coding environment you already use — Cursor, Claude Code, Codex, or anything else that can read skill/instruction files from a directory.

The toolkit is organized around two top-level skills that cover the core lifecycle of an Elastic integration:

• /research-integration — Researches a vendor, product, or feature before you start building. Investigates API documentation, data collection methods, sample data formats, and ECS mapping candidates. Produces a structured research brief that feeds directly into /create-integration.
• /create-integration — Scaffolds a new integration package end-to-end: package creation, data stream scaffolding, manifest configuration, CEL programs, ingest pipelines, field mappings, and system tests.

Together, these skills turn integration development from a slow, manual process into a fast, structured, agent-assisted workflow.

This toolkit is designed for engineers who:

• Build or maintain Elastic integration packages — whether as contributors to elastic/integrations, as Elastic partners, or as independent developers building custom integrations
• Are familiar with the Elastic Stack (Elasticsearch, Kibana, Elastic Agent) at an integration-development level
• Want structured, repeatable, agent-assisted workflows instead of figuring out each integration from scratch

You will get the most out of these skills if you are comfortable with:

• Elastic Agent and integrations — how integration packages are structured, how data streams work, and the basics of the elastic-package CLI. The Elastic integrations developer guide is the canonical reference.
• Elastic Common Schema (ECS) — field naming conventions and event categorization. See the ECS reference.
• Ingest pipelines — Elasticsearch ingest pipeline fundamentals (processors, conditions, error handling). See the ingest pipeline docs.
• CEL programs (for REST API integrations) — the Common Expression Language as used in Elastic Agent's CEL input type. See the Elastic Agent CEL input docs.

The following tools must be installed and available on $PATH for the agent workflows to function.

All Go tools require a working Go installation with $GOPATH/bin on your $PATH.

The fastest way to install skills is with the skills CLI. No need to clone this repository — just run:

npx skills add elastic/integration-skills

This launches an interactive prompt to select skills and target agents. The CLI copies each skill folder into the correct location for the agent to discover.

Install a specific skill by name:

npx skills add elastic/integration-skills --skill cel-programs

Install to specific agents (see supported agents):

npx skills add elastic/integration-skills -a cursor -a claude-code

List available skills without installing:

npx skills add elastic/integration-skills --list

Install all skills to all agents (non-interactive):

npx skills add elastic/integration-skills --all

If you use Claude Code, you can install the skills natively through the Claude Code plugin marketplace. This path supports autoUpdate, so your local copy stays current whenever the skills are updated upstream.

Register the marketplace and install the plugin:

/plugin marketplace add elastic/integration-skills
/plugin install integration-skills@elastic-integration-skills

Once installed, skills are namespaced under the plugin name when invoked explicitly (e.g. /integration-skills:create-integration). They still trigger automatically from their descriptions, so you can also just describe what you want and the agent picks the right skill.

Auto-update: After installation, Claude Code keeps the plugin current in the background. No manual npx skills update step needed.

If you prefer to work from a local checkout, or your environment does not have Node.js / npx, clone the repository and copy the skills/ folder into the config directory your agent expects:

git clone https://github.com/elastic/integration-skills.git
cd integration-skills
cp -r skills ~/.cursor/skills    # or ~/.claude/skills or your agent's config directory

Check whether any installed skills have changed upstream:

npx skills check

Pull the latest versions of all installed skills:

npx skills update

Working with the integrations repository: If you are developing integrations against elastic/integrations, run these skills from a checkout of that repo or point your agent at that tree. This gives the agent the real package layout, shared conventions, and surrounding packages for context. Several elastic-package commands (system tests, workspace-aware workflows) also require an integrations-style workspace to run correctly.

These skills map directly to the lifecycle of building and maintaining an Elastic integration. You invoke them by name in your agent.

Researches a vendor, product, or feature before building an integration. Launches parallel research subagents to investigate data collection methods, API documentation, sample data formats, field schemas, and ECS mapping candidates. Writes a structured research brief to research_results/<product_slug>/ that feeds directly into /create-integration.

Invoke this first when building an integration for a product you haven't worked with before. Pass the research output as context when you run /create-integration.

/research-integration I want to create a Checkpoint Harmony Endpoint integration with alerts, threat events, and audit logs

Scaffolds a new Elastic integration package end-to-end: package creation, data stream scaffolding, manifest configuration, CEL program building, ingest pipeline creation, field mappings, and system testing. Also handles adding data streams to an existing package — automatically provides the target package, stream details, and the correct skill routes to the workflow.

Recommended flow: run /research-integration first, then pass the research brief as input for the highest-quality output.

/create-integration @research_results/checkpoint_harmony/ Package name: checkpoint_harmony, single data stream "event" using CEL input

In addition to the top-level skills, you can invoke any domain skill directly when you need focused help on a specific area:

Found a bug, unexpected behavior, or a skill that consistently produces wrong output? Open a bug report.

Want to suggest a new skill or improvement? Open a feature request.

See CONTRIBUTING.md for details on how to contribute.

Skills in this repository follow the Agent Skills open standard for packaging procedural knowledge for AI agents.

This project is licensed under the Apache License 2.0.