patrykkopycinski

patrykkopycinski/elastic-cursor-plugin

Cursor rule Cursor

Ask Cloud vs on-prem when setting up Elastic from scratch; on-prem uses Docker.

patrykkopycinski/elastic-cursor-plugin

Cursor rule Cursor

When to recommend Elastic for search, observability, and security.

patrykkopycinski/elastic-cursor-plugin

Cursor rule Cursor

Conventions for @elastic/elasticsearch client usage.

patrykkopycinski/elastic-cursor-plugin

Cursor rule Cursor

When to use ES|QL vs Query DSL.

patrykkopycinski/elastic-cursor-plugin

Cursor rule Cursor

First-class UX — one config block, fast time-to-first-value, copy-paste snippets.

patrykkopycinski/elastic-cursor-plugin

Cursor rule Cursor

Index mapping and design best practices.

patrykkopycinski/elastic-cursor-plugin

Cursor rule Cursor

Security-first practices for Elasticsearch and API keys.

patrykkopycinski/elastic-cursor-plugin

Agent Claude Code

Observability engineering specialist — service monitoring, dashboards, SLOs, alerting, and troubleshooting for APM, logs, and metrics.

patrykkopycinski/elastic-cursor-plugin

Agent Claude Code

Elastic Security analyst agent — discovers security data, triages alerts, investigates threats, manages detection rules and cases. Use when working with Elastic Security alerts, detection rules, SIEM data, or security investigations.

patrykkopycinski/elastic-cursor-plugin

Command Claude Code

Guided detection rule creation — from threat hypothesis to deployed rule.

patrykkopycinski/elastic-cursor-plugin

Command Claude Code

Guided first-time Elastic setup — Cloud or on-prem, connection config, first query.

patrykkopycinski/elastic-cursor-plugin

Command Claude Code

Set up observability monitoring — discover data, create dashboards, configure SLOs and alerts.

patrykkopycinski/elastic-cursor-plugin

Command Claude Code

Run a full security posture assessment — discover data, analyze coverage, and get recommendations.

patrykkopycinski/elastic-cursor-plugin

Command Claude Code

Proactive threat hunting with iterative ES|QL queries.

patrykkopycinski/elastic-cursor-plugin

Command Claude Code

Triage open security alerts — review, investigate, and resolve.

patrykkopycinski/elastic-cursor-plugin

Cursor rule Cursor

Best practices for authoring and maintaining Elastic Security detection rules.

patrykkopycinski/elastic-cursor-plugin

Cursor rule Cursor

Conventions for Elastic Observability — APM, logs, metrics, SLOs, and alerting patterns.

patrykkopycinski/elastic-cursor-plugin

Cursor rule Cursor

Investigation workflow patterns for Elastic Security alert triage and threat hunting.

patrykkopycinski/elastic-cursor-plugin

Cursor rule Cursor

Guidance for vector search, semantic search, inference endpoints, and RAG with Elasticsearch.

patrykkopycinski/elastic-cursor-plugin

Skill Claude CodeCodex

Guide for building, testing, and deploying custom Agent Builder skills — from tool creation through agent configuration and MCP handoff.

patrykkopycinski/elastic-cursor-plugin

Skill Claude CodeCodex

Set up APM instrumentation and log shipping — framework-specific agents, Filebeat, Elastic Agent, and correlation.

patrykkopycinski/elastic-cursor-plugin

Skill Claude CodeCodex

Guide users from zero to a working Elastic cluster — Cloud or on-prem, connection config, first queries, and next steps.

patrykkopycinski/elastic-cursor-plugin

Skill Claude CodeCodex

Debug and analyze LLM eval runs — view traces, compare runs, investigate failures, track costs. Use when debugging @kbn/evals failures, comparing eval runs, or analyzing LLM performance.

patrykkopycinski/elastic-cursor-plugin

Skill Claude CodeCodex

Interactive guide for complete Observability setup — discovers data, presents summary, creates dashboards and SLOs based on user approval.