Add /seed-ea Claude Code skill and fix README inaccuracies by CAWilson94 · Pull Request #437 · elastic/security-documents-generator

CAWilson94 · 2026-07-30T10:42:46Z

Summary

New: /seed-ea Claude Code skill

Adds a Claude Code slash command that helps developers populate every Entity Analytics V2 page in Kibana without needing to remember which security-documents-generator command covers which page.
Open the repo in Claude Code, type /seed-ea followed by what you want to populate, and it gives you the exact yarn start command - or runs it for you.
.claude/commands/seed-ea.md - skill definition (auto-discovered by Claude Code)
SEED_EA_SKILL.md - full documentation: usage examples, page→command mapping, known gaps
.gitignore - allow .claude/commands/ to be tracked (same pattern already used for .cursor/rules/)

README fixes
The bulk of the README diff is prettier reformatting table column widths - the actual content changes are small:

Node.js version: 24.13.1 → 24.18.0 to match package.json
Missing commands: added risk-score-v2, generate-entity-maintainers-data, and leads to the commands table and quick list - these existed in the codebase but weren't documented
Agent skills section: renamed to "AI assistant skills" and clarified the difference between Claude Code skills (.claude/commands/, auto-discovered slash commands) and agent skills (.agents/skills/, manual context files)

- .claude/commands/seed-ea.md: Claude Code slash command for populating EA pages - SEED_EA_SKILL.md: full documentation for the skill - .gitignore: allow .claude/commands/ to be tracked - README: fix Node.js version (24.13.1 → 24.18.0) - README: add missing commands risk-score-v2, generate-entity-maintainers-data, leads - README: improve agent skills section to distinguish Claude Code vs agent skill formats

romulets · 2026-07-30T11:01:24Z

+
+Use `security-documents-generator` to populate Entity Analytics pages for development or testing.
+
+Run commands from the repo root with: `yarn start <command>`


maybe good to teach to use nvm to always select the proper node version and skip de failure + figuring it out how to do it?

romulets · 2026-07-30T11:02:00Z

+
+Run commands from the repo root with: `yarn start <command>`
+
+## Input


Maybe also as input potential target cluster?

opauloh · 2026-07-30T19:27:46Z

+## Full End-to-End Sequence
+
+When the user wants everything populated, recommend these in order:
+
+```bash
+# 1. Core: entity store, risk engine, criticality, watchlists
+yarn start risk-score-v2 --entity-kinds host,idp_user,local_user,service --hosts 20 --users 20 --services 10 --alerts-per-entity 10
+
+# 2. Risk history + relationships + anomaly behaviours (flyouts, home history panel)
+yarn start generate-entity-maintainers-data --space default --quick
+
+# 3. Privileged user monitoring
+yarn start privmon-quick --space default
+
+# 4. AI insights + anomaly records (ai_summary, flyout panels)
+yarn start generate-entity-ai-insights --v2 --correlate-with-entity-store -h 20 -u 20 -s default
+
+# 5. Threat hunting leads (requires inference connector pre-configured in Kibana)
+yarn start leads --space default
+# → choose "Generate leads now"
+
+# 6. Generic entities (for generic flyout — not covered by risk-score-v2)
+yarn start quick-entity-store --space default


Honestly I don't feel strong about it, this will get the UI fully populated, but the information does not correlates, I think for this we should focus on a single command that does it all by ingesting source logs, creating detection rules, watchlists, criticality and installing the ML jobs. Then kick-offs the entity store extraction and all the maintainers. Its a bit more work letting it process everything instead of populate the entity store indices directly, but then it would be helpful to catch entity store / maintainers errors as well

…ster input Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Adds a Claude Code /seed-ea slash command (and supporting documentation) to help developers choose/run the correct security-documents-generator commands for seeding Entity Analytics UI pages, and updates the README to correct/expand command + skills documentation.

Changes:

Added Claude Code skill definition at .claude/commands/seed-ea.md plus end-user docs in SEED_EA_SKILL.md.
Updated README.md to match the Node engine version and to document additional existing commands + clarify “AI assistant skills” vs agent skills.
Updated .gitignore intent to allow tracking Claude Code command files (but needs a small fix to work as intended).

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
`SEED_EA_SKILL.md`	Adds user-facing `/seed-ea` documentation, page→command mapping, and an end-to-end seeding sequence.
`README.md`	Updates Node version, documents missing commands, and clarifies Claude Code skills vs agent skills.
`.gitignore`	Attempts to allow `.claude/commands/` to be tracked while keeping other Claude artifacts ignored.
`.claude/commands/seed-ea.md`	Defines the Claude Code slash command behavior and the recommended command mappings/flags.

+| AI summary / anomalies                                   | `generate-entity-ai-insights --v2`                                      |
+| Entity flyouts — host/user/service                       | `generate-entity-maintainers-data` + `generate-entity-ai-insights --v2` |
+| Entity flyout — generic                                  | `quick-entity-store`                                                    |
+| Explore pages (hosts/users/network)                      | `risk-score-v2` alerts + `generate-alerts`                              |
+| CSP / cloud posture                                      | `csp --data-sources elastic_all`                                        |


+- `--no-setup` — skip entity store installation (use when already installed)
+- `--space <id>` — target a non-default space
+- `--dangerous-clean` — wipe existing data before seeding (use with care)


Updated the title formatting and removed unnecessary text.

CAWilson94 requested a review from a team as a code owner July 30, 2026 10:42

CAWilson94 requested review from Copilot and opauloh and removed request for Copilot July 30, 2026 10:42

romulets approved these changes Jul 30, 2026

View reviewed changes

opauloh reviewed Jul 30, 2026

View reviewed changes

Address review comments on seed-ea skill: nvm guidance and target clu…

ee7dc10

…ster input Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings July 31, 2026 06:51

Copilot started reviewing on behalf of CAWilson94 July 31, 2026 06:52 View session

Update SEED_EA_SKILL.md with nvm requirement and target cluster guidance

559bf90

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Copilot AI reviewed Jul 31, 2026

View reviewed changes

Refine title formatting in SEED_EA_SKILL.md

e4565b1

Updated the title formatting and removed unnecessary text.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add /seed-ea Claude Code skill and fix README inaccuracies - #437

Add /seed-ea Claude Code skill and fix README inaccuracies#437
CAWilson94 wants to merge 4 commits into
elastic:mainfrom
CAWilson94:add-seed-ea-claude-skill

CAWilson94 commented Jul 30, 2026

Uh oh!

romulets Jul 30, 2026

Uh oh!

romulets Jul 30, 2026

Uh oh!

Uh oh!

opauloh Jul 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants


		Use `security-documents-generator` to populate Entity Analytics pages for development or testing.

		Run commands from the repo root with: `yarn start <command>`


		Run commands from the repo root with: `yarn start <command>`

		## Input

Uh oh!

Conversation

CAWilson94 commented Jul 30, 2026

Summary

Uh oh!

romulets Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

romulets Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

opauloh Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants