security-ml-integrations

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Security ML Integration Package Management

安全 ML 集成包管理

Install, check, or troubleshoot a security ML package. Supported packages:

beaconing

(Network Beaconing Identification),

ded

(Data Exfiltration Detection),

dga

(Domain Generation Algorithm Detection),

lmd

(Lateral Movement Detection),

pad

(Privileged Access Detection),

problemchild

(Living off the Land Attack Detection).

安装、检查或排查安全 ML 包。支持的包：

beaconing

（Network Beaconing Identification）、

ded

（Data Exfiltration Detection）、

dga

（Domain Generation Algorithm Detection）、

lmd

（Lateral Movement Detection）、

pad

（Privileged Access Detection）、

problemchild

（Living off the Land Attack Detection）。

Environment Configuration

环境配置

This skill executes Elasticsearch operations through the

elastic

CLI. If the

elastic

CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g.,

GET /

GET /_cat/indices

GET /{index}/_mapping

GET /{index}/_settings/index.mode

POST /_query

). The Operations table at the end of this document maps each shorthand to the equivalent

elastic

CLI command — always use the CLI rather than calling the HTTP API directly.

Package source patterns, shared template fields, and ingest-pipeline wiring live in package capabilities.

此 skill 通过

elastic

CLI 执行 Elasticsearch 操作。如果未安装

elastic

CLI，告知用户安装它的用途。不要猜测凭据、直接调用 HTTP API 或尝试其他变通方案。

此 skill 以 HTTP 简写形式引用操作（例如

GET /

、

GET /_cat/indices

、

GET /{index}/_mapping

、

GET /{index}/_settings/index.mode

、

POST /_query

）。文档末尾的操作表将每种简写映射到对应的

elastic

CLI 命令——始终使用 CLI，而不是直接调用 HTTP API。

包源模式、共享模板字段和 ingest pipeline 连接配置位于 package capabilities。

Process

流程

Classify the request. Status, README, or install. Status and README stay read-only — do not install, start transforms, deploy jobs, or enable rules. After identifying the package, branch: status uses
```
GET kbn:/api/fleet/epm/packages/{package}
```
only (title, version, status); README adds
```
GET kbn:/api/fleet/epm/packages/{package}/{version}/docs/README.md
```
and returns that document; install continues.
Identify the package. Map the user's words to one of the six package names above. If the name is ambiguous, ask before calling any API. Load that package's row from package capabilities — omit fields that are empty for that package.
Gather environment state before any mutation. Install only.
```
GET /_license
```
first — continue only for
```
platinum
```
,
```
enterprise
```
,
```
trial
```
, or Serverless. If
```
GET /_ml/info
```
returns 403, report missing
```
manage_ml
```
and stop. Then collect:
- Package:
```
GET kbn:/api/fleet/epm/packages/{package}
```
  for name, title, version, and
```
status
```
  .
- Source data:
```
POST /{source_patterns}/_search
```
  with
```
size: 0
```
  and
```
track_total_hits: true
```
  . If every pattern has zero hits, warn that jobs will not produce useful anomalies.
- Shared template (DGA, PAD, ProblemChild only):
```
GET /_component_template/{name}
```
  . Exists → plan a merge of the fields in the reference. 404 → plan a create with only those fields.
- Shared pipeline (DGA, PAD, ProblemChild only):
```
GET /_ingest/pipeline/{name}
```
  . Exists → plan to append a processor. 404 → plan a single-processor pipeline.
- Transforms:
```
GET /_transform/{pattern}
```
  (skip if the package has no transform pattern). Record each
```
id
```
  ,
```
dest.index
```
  , and the
```
.all
```
  alias (
```
dest.aliases
```
  where
```
move_on_creation
```
  is false).
- Data views:
```
GET kbn:/api/data_views
```
  and check whether the package's data-view pattern already exists.
- ML capacity:
```
GET /_ml/info
```
  (total memory) and
```
GET /_ml/anomaly_detectors/_all/_stats
```
  (sum memory of opened jobs).
```
GET kbn:/internal/ml/modules/get_module/{module_id}
```
  for job count and per-job memory. If jobs do not fit, say so and suggest prioritizing job groups — do not deploy anyway without the user accepting the risk.
- Rules:
```
GET kbn:/api/detection_engine/rules/prepackaged/_status
```
  and
```
POST kbn:/internal/detection_engine/prebuilt_rules/installation/_review
```
  filtered by the package detection tag.
Present a plan and wait for confirmation. Show package identity and status, source-data hits (warn if all zero), template/pipeline merge-or-create, transform count and states, data-view presence, ML memory fit, and rule count. Do not call any write API until the user confirms. If they decline, stop.
Install the Fleet package, then apply shared mappings. After confirmation:
- ```
POST kbn:/api/fleet/epm/packages/{package}
```
  to install assets (transforms may be deferred until started).
- If the package uses a component template:
```
PUT /_component_template/{name}
```
  with the merged or new body. Then
```
POST /{data_stream}/_rollover
```
  on the rollover target so new indices pick up mappings.
- If the package uses an ingest pipeline:
```
PUT /_ingest/pipeline/{name}
```
  with appended or new processors. Use the installed package version in the versioned pipeline name.
Skip template, pipeline, and rollover when the package row has no values for them (beaconing, ded, lmd).
Start transforms and create destination aliases. Skip this block (except
```
.ml-anomalies-shared
```
) when the package has no transform pattern. Fleet's first checkpoint often skips
```
.all
```
aliases. After install,
```
GET /_transform/{pattern}
```
again if IDs were missing. Reset only if the transform is new, never started, failed, or the user asked to rebuild:
```
POST /_transform/{id}/_stop
```
,
```
POST /_transform/{id}/_reset
```
,
```
POST /_transform/{id}/_update
```
with the existing description,
```
POST /_transform/{id}/_start
```
,
```
POST /_transform/{id}/_schedule_now
```
. If already
```
started
```
with
```
checkpointing.last.checkpoint >= 1
```
, skip reset; restamp via the existing description and ensure
```
.all
```
aliases exist. Then
```
POST /_aliases
```
to add the
```
.all
```
alias (and
```
.latest
```
if the dest defines it) on
```
dest.index
```
. If a data-view pattern is missing,
```
POST kbn:/api/data_views/data_view
```
. Also ensure a hidden
```
.ml-anomalies-shared
```
data view exists (
```
POST kbn:/api/data_views/data_view
```
) so package dashboards resolve.
Confirm the first transform checkpoint before ML. If the package row has no transform pattern, skip this step and continue to jobs. Otherwise call
```
GET /_transform/{pattern}/_stats
```
. Proceed only when each transform is
```
started
```
and
```
checkpointing.last.checkpoint >= 1
```
; do not use
```
documents_processed
```
as a substitute. Zero documents with a completed checkpoint is acceptable when source patterns are empty — destination aliases still let datafeeds start. Otherwise tell the user transforms must finish processing and wait for confirmation before the next step. Never set up the ML module against missing dest indices.
Deploy ML jobs, then detection rules. After transforms are confirmed (or skipped):
- ```
POST kbn:/internal/ml/modules/setup/{module_id}
```
  with
```
startDatafeed: true
```
  and
```
indexPatternName
```
  set to the package data-view pattern, or source patterns when that cell is empty. Do not put spaces after commas in
```
indexPatternName
```
  — the setup API splits on commas without trimming. Correct:
```
logs-*,ml_okta_multiple_user_sessions_pad.all,ml_windows_privilege_type_pad.all
```
  .
- Initialize the detection engine if needed (
```
POST kbn:/api/detection_engine/index
```
  ), install the prebuilt rules package (
```
POST kbn:/api/fleet/epm/packages/security_detection_engine
```
  ), review the package-tagged rules, then call
```
POST kbn:/internal/detection_engine/prebuilt_rules/installation/_perform
```
  with
```
{"mode":"SPECIFIC_RULES","rules":[{"rule_id":"<rule_id>","version":<version>}]}
```
  (one entry per reviewed rule). Enable the package's ML rules with
```
POST kbn:/api/detection_engine/rules/_bulk_action
```
  (
```
disable
```
  then
```
enable
```
  on immutable ML rules tagged with the package detection tag so API keys are stamped with the calling user).
Report created versus skipped. Package version and asset count; template/pipeline/rollover created, updated, or skipped; transforms started; data views created or already present; ML jobs and datafeeds started (and any that failed, with the mapping or index reason); rules installed and enabled.

对请求进行分类。 分为状态、README 或安装。状态和 README 查询保持只读——不得安装、启动 transform、部署作业或启用规则。确定包后分支处理：状态查询仅使用
```
GET kbn:/api/fleet/epm/packages/{package}
```
（title、version、status）；README 查询还使用
```
GET kbn:/api/fleet/epm/packages/{package}/{version}/docs/README.md
```
并返回该文档；安装则继续后续步骤。
确定包。 将用户的表述映射到上述六个包名之一。如果名称存在歧义，在调用任何 API 前询问用户。从 package capabilities 加载该包的条目——省略该包为空的字段。
在任何变更操作之前收集环境状态。 仅限安装流程。首先执行
```
GET /_license
```
——只有许可证为
```
platinum
```
、
```
enterprise
```
、
```
trial
```
或 Serverless 时才继续。如果
```
GET /_ml/info
```
返回 403，报告缺少
```
manage_ml
```
权限并停止。然后收集：
- 包：执行
```
GET kbn:/api/fleet/epm/packages/{package}
```
  ，获取 name、title、version 和
```
status
```
  。
- 源数据：执行
```
POST /{source_patterns}/_search
```
  ，并设置
```
size: 0
```
  和
```
track_total_hits: true
```
  。如果每个模式的命中数均为零，警告作业将无法生成有意义的异常。
- 共享 template（仅 DGA、PAD、ProblemChild）：执行
```
GET /_component_template/{name}
```
  。存在 → 计划合并参考文档中的字段。404 → 计划仅使用这些字段进行创建。
- 共享 pipeline（仅 DGA、PAD、ProblemChild）：执行
```
GET /_ingest/pipeline/{name}
```
  。存在 → 计划追加 processor。404 → 计划创建单 processor pipeline。
- Transforms：执行
```
GET /_transform/{pattern}
```
  （如果包没有 transform 模式则跳过）。记录每个
```
id
```
  、
```
dest.index
```
  和
```
.all
```
  别名（
```
dest.aliases
```
  中
```
move_on_creation
```
  为 false 的项）。
- Data views：执行
```
GET kbn:/api/data_views
```
  ，检查包的 data view 模式是否已存在。
- ML 容量：执行
```
GET /_ml/info
```
  （总内存）和
```
GET /_ml/anomaly_detectors/_all/_stats
```
  （已打开作业的内存总和）。执行
```
GET kbn:/internal/ml/modules/get_module/{module_id}
```
  ，获取作业数量和每个作业的内存。如果作业无法容纳，明确告知用户，并建议优先处理作业组——除非用户接受风险，否则不要部署。
- 规则：执行
```
GET kbn:/api/detection_engine/rules/prepackaged/_status
```
  ，并执行
```
POST kbn:/internal/detection_engine/prebuilt_rules/installation/_review
```
  ，按包的 detection tag 过滤。
展示计划并等待确认。 显示包身份和状态、源数据命中数（如果全部为零则发出警告）、template/pipeline 的合并或创建方案、transform 数量和状态、data view 是否存在、ML 内存是否足够，以及规则数量。在用户确认前，不得调用任何写 API。 如果用户拒绝，则停止。
安装 Fleet 包，然后应用共享映射。 确认后：
- 执行
```
POST kbn:/api/fleet/epm/packages/{package}
```
  安装资产（transform 可能会延迟到启动后再处理）。
- 如果包使用 component template：使用合并后或新建的请求体执行
```
PUT /_component_template/{name}
```
  。然后在 rollover 目标上执行
```
POST /{data_stream}/_rollover
```
  ，以便新索引采用更新后的映射。
- 如果包使用 ingest pipeline：使用追加后的 processor 或新的 processor 执行
```
PUT /_ingest/pipeline/{name}
```
  。在版本化 pipeline 名称中使用已安装的包版本。
当包条目中 template、pipeline 和 rollover 的值均为空时，跳过这些步骤（beaconing、ded、lmd）。
启动 transforms 并创建目标别名。 当包没有 transform 模式时，跳过此块，但
```
.ml-anomalies-shared
```
除外。Fleet 的首次 checkpoint 通常会跳过
```
.all
```
别名。安装后，如果之前缺少 ID，再次执行
```
GET /_transform/{pattern}
```
。仅当 transform 是新建的、从未启动、失败，或用户要求重建时才重置：执行
```
POST /_transform/{id}/_stop
```
、
```
POST /_transform/{id}/_reset
```
、
```
POST /_transform/{id}/_update
```
并保留现有 description，以及
```
POST /_transform/{id}/_start
```
、
```
POST /_transform/{id}/_schedule_now
```
。如果已经处于
```
started
```
状态且
```
checkpointing.last.checkpoint >= 1
```
，则跳过重置；通过现有 description 重新标记，并确保
```
.all
```
别名存在。然后执行
```
POST /_aliases
```
，在
```
dest.index
```
上添加
```
.all
```
别名（如果
```
dest
```
定义了
```
.latest
```
，也一并添加）。如果缺少 data view 模式，执行
```
POST kbn:/api/data_views/data_view
```
。还要确保存在隐藏的
```
.ml-anomalies-shared
```
data view（
```
POST kbn:/api/data_views/data_view
```
），以便包的 dashboard 正常解析。
在启动 ML 前确认首个 transform checkpoint。 如果包条目没有 transform 模式，跳过此步骤并继续处理作业。否则执行
```
GET /_transform/{pattern}/_stats
```
。仅当每个 transform 都处于
```
started
```
状态且
```
checkpointing.last.checkpoint >= 1
```
时继续；不要使用
```
documents_processed
```
作为替代指标。即使源模式为空，零文档但 checkpoint 已完成也是可接受的——目标别名仍可让 datafeed 启动。否则告知用户 transforms 必须完成处理，并在进入下一步前等待确认。绝不基于缺失的目标索引设置 ML 模块。
部署 ML 作业，然后部署检测规则。 确认（或跳过）transforms 后：
- 执行
```
POST kbn:/internal/ml/modules/setup/{module_id}
```
  ，设置
```
startDatafeed: true
```
  ，并将
```
indexPatternName
```
  设置为包的 data view 模式；如果相应字段为空，则使用源模式。不要在
  indexPatternName
  的逗号后添加空格——setup API 按逗号拆分时不会 trim。正确示例：
```
logs-*,ml_okta_multiple_user_sessions_pad.all,ml_windows_privilege_type_pad.all
```
  。
- 根据需要初始化 detection engine（
```
POST kbn:/api/detection_engine/index
```
  ），安装预构建规则包（
```
POST kbn:/api/fleet/epm/packages/security_detection_engine
```
  ），审查带包标签的规则，然后调用
```
POST kbn:/internal/detection_engine/prebuilt_rules/installation/_perform
```
  并传入
```
{"mode":"SPECIFIC_RULES","rules":[{"rule_id":"<rule_id>","version":<version>}]}
```
  （每个已审查规则一个条目）。通过
```
POST kbn:/api/detection_engine/rules/_bulk_action
```
  启用包的 ML 规则（对带包 detection tag 的不可变 ML 规则先执行
```
disable
```
  ，再执行
```
enable
```
  ，以便 API key 标记调用用户）。
报告已创建与已跳过的内容。 包版本和资产数量；template/pipeline/rollover 是已创建、已更新还是已跳过；已启动的 transforms；已创建或已存在的 data views；已启动的 ML 作业和 datafeeds（以及任何失败的作业及其映射或索引原因）；已安装并启用的规则。

Examples

示例

Install PAD

安装 PAD

User: "Install PAD"

Gather state for
```
pad
```
. Package not installed, zero source hits,
```
logs-endpoint.events.process@custom
```
already has ProblemChild fields, no
```
@custom
```
pipeline, two stopped transforms, 15 jobs fit in available memory, tagged rules available.
Present the plan: warn about empty source data; merge
```
process.command_line_entropy
```
; create the PAD pipeline processor; start both transforms; create the PAD data view. Wait for confirm.
After confirm:
```
POST kbn:/api/fleet/epm/packages/pad
```
, merge-and-
```
PUT
```
the shared template,
```
PUT
```
the pipeline, restamp via existing description (reset only if transforms are new or stopped),
```
POST /_aliases
```
for each
```
.all
```
alias.
```
GET /_transform/*pad*/_stats
```
. If checkpoint 1 is done (even with 0 docs), continue; otherwise wait for the user.

POST kbn:/internal/ml/modules/setup/pad-ml

with a no-space

indexPatternName

, then install and enable rules tagged

Use Case: Privileged Access Detection

Report each section as created, updated, or skipped.

用户："Install PAD"

为
```
pad
```
收集状态。包尚未安装，源命中数为零，
```
logs-endpoint.events.process@custom
```
已包含 ProblemChild 字段，没有
```
@custom
```
pipeline，两个 transforms 处于停止状态，15 个作业可容纳于可用内存中，并且存在带标签的规则。
展示计划：警告源数据为空；合并
```
process.command_line_entropy
```
；创建 PAD pipeline processor；启动两个 transforms；创建 PAD data view。等待确认。
确认后：执行
```
POST kbn:/api/fleet/epm/packages/pad
```
，合并并
```
PUT
```
共享 template，
```
PUT
```
pipeline，通过现有 description 重新标记（仅当 transforms 为新建或已停止时才重置），并为每个
```
.all
```
别名执行
```
POST /_aliases
```
。
执行
```
GET /_transform/*pad*/_stats
```
。如果 checkpoint 1 已完成（即使为 0 个文档），则继续；否则等待用户。

执行

POST kbn:/internal/ml/modules/setup/pad-ml

，并使用不含空格的

indexPatternName

，然后安装并启用标签为

Use Case: Privileged Access Detection

的规则。

将每个部分报告为已创建、已更新或已跳过。

Install beaconing (no template or pipeline)

安装 beaconing（无 template 或 pipeline）

User: "Set up beaconing"

Gather state. Omit template, pipeline, and rollover — the beaconing row has none.
Present a shorter plan (package, one transform, data view, jobs, rules). Wait for confirm.
Install the package, start the transform, create
```
ml_beaconing*
```
if missing, confirm checkpoint, set up
```
beaconing-ml
```
, enable rules tagged
```
Use Case: Network Beaconing Identification
```
.

用户："Set up beaconing"

收集状态。省略 template、pipeline 和 rollover——beaconing 条目中没有这些配置。
展示简化计划（包、一个 transform、data view、作业、规则）。等待确认。
安装包、启动 transform、在缺失时创建
```
ml_beaconing*
```
、确认 checkpoint、设置
```
beaconing-ml
```
，并启用标签为
```
Use Case: Network Beaconing Identification
```
的规则。

Status only

仅查询状态

User: "Is beaconing installed?"

GET kbn:/api/fleet/epm/packages/beaconing

only.

Report title, version, and status. A README request also fetches and returns the docs README. Do not install or start anything.

用户："Is beaconing installed?"

仅执行

GET kbn:/api/fleet/epm/packages/beaconing

。

报告 title、version 和 status。README 请求还会获取并返回文档 README。不得安装或启动任何内容。

Guidelines

准则

Gather environment state before every install. Do not skip the pre-flight reads.
Stay read-only on status and README questions.
Wait for explicit confirmation before any write. Check license before the Fleet POST.
Pause after transforms until
```
checkpointing.last.checkpoint >= 1
```
(0 docs is acceptable when source patterns are empty). Skip transform and package data-view steps when those capability cells are empty.
Never overwrite shared
```
@custom
```
templates or pipelines. PAD and ProblemChild share
```
logs-endpoint.events.process@custom
```
— merge fields and append processors.
Put no spaces after commas in ML
```
indexPatternName
```
.
Cite Fleet package APIs as
```
kbn:/api/fleet/...
```
. Do not use a
```
fleet:
```
prefix.
Restamp a Fleet transform by setting
```
--description
```
to the existing text, then start. Do not use
```
--body '{}'
```
.
On serverless,
```
GET /_ml/info
```
may return 410. Continue with opened-job stats from
```
GET /_ml/anomaly_detectors/_all/_stats
```
; do not abort the install.

每次安装前收集环境状态。不得跳过预检读取。
状态和 README 查询保持只读。
任何写操作前等待明确确认。在 Fleet POST 前检查许可证。
在 transforms 后暂停，直到
```
checkpointing.last.checkpoint >= 1
```
（源模式为空时 0 个文档可接受）。当相应能力条目为空时，跳过 transform 和包 data view 步骤。
绝不覆盖共享的
```
@custom
```
template 或 pipeline。PAD 和 ProblemChild 共用
```
logs-endpoint.events.process@custom
```
——合并字段并追加 processor。
ML
```
indexPatternName
```
的逗号后不要添加空格。
将 Fleet 包 API 引用为
```
kbn:/api/fleet/...
```
。不要使用
```
fleet:
```
前缀。
通过将
```
--description
```
设置为现有文本来重新标记 Fleet transform，然后启动。不要使用
```
--body '{}'
```
。
在 serverless 环境中，
```
GET /_ml/info
```
可能返回 410。继续使用
```
GET /_ml/anomaly_detectors/_all/_stats
```
获取已打开作业的统计信息；不要中止安装。

Operations

操作

HTTP API (shorthand)	`elastic` CLI command
`GET kbn:/api/fleet/epm/packages/{package}`	`elastic kb elastic-package-manager-epm get-fleet-epm-packages-pkgname --pkg-name '{package}'`
`GET kbn:/api/fleet/epm/packages/{package}/{version}/docs/README.md`	CLI gap — package-file fetch 404s on registry paths; keep this shorthand as the contract
`POST kbn:/api/fleet/epm/packages/{package}`	`elastic kb elastic-package-manager-epm post-fleet-epm-packages-pkgname --pkg-name '{package}'`
`POST /{source_patterns}/_search`	`elastic es count --index '{source_patterns}' --allow-no-indices true --ignore-unavailable true`
`GET /_component_template/{name}`	`elastic es cluster get-component-template --name '{name}'`
`PUT /_component_template/{name}`	`elastic es cluster put-component-template --name '{name}' --template '{json}'`
`GET /_ingest/pipeline/{name}`	`elastic es ingest get-pipeline --id '{name}'`
`PUT /_ingest/pipeline/{name}`	`elastic es ingest put-pipeline --id '{name}' --input-file '{path}'`
`POST /{data_stream}/_rollover`	`elastic es indices rollover --alias '{data_stream}'`
`GET /_transform/{pattern}`	`elastic es transform get-transform --transform-id '{pattern}'`
`GET /_transform/{pattern}/_stats`	`elastic es transform get-transform-stats --transform-id '{pattern}'`
`POST /_transform/{id}/_stop`	`elastic es transform stop-transform --transform-id '{id}' --force true --wait-for-completion true`
`POST /_transform/{id}/_reset`	`elastic es transform reset-transform --transform-id '{id}' --force true`
`POST /_transform/{id}/_update`	`elastic es transform update-transform --transform-id '{id}' --description '{existing}'`
`POST /_transform/{id}/_start`	`elastic es transform start-transform --transform-id '{id}'`
`POST /_transform/{id}/_schedule_now`	`elastic es transform schedule-now-transform --transform-id '{id}'`
`POST /_aliases`	`elastic es indices update-aliases --actions '{json}'`
`GET kbn:/api/data_views`	`elastic kb data-views get-all-data-views-default`
`POST kbn:/api/data_views/data_view`	`elastic kb data-views create-data-view-default --data-view '{json}'`
`GET /_license`	`elastic es license get`
`GET /_ml/info`	`elastic es ml info`
`GET /_ml/anomaly_detectors/_all/_stats`	`elastic es ml get-job-stats --job-id '_all'`
`GET kbn:/internal/ml/modules/get_module/{module_id}`	CLI gap — ML module get is an internal Kibana API; keep this shorthand as the contract
`POST kbn:/internal/ml/modules/setup/{module_id}`	CLI gap — ML module setup is an internal Kibana API; keep this shorthand as the contract
`GET kbn:/api/detection_engine/rules/prepackaged/_status`	CLI gap — no generated prepackaged-status command; keep this shorthand as the contract
`POST kbn:/api/detection_engine/index`	CLI gap — no generated detection-engine index command; keep this shorthand as the contract
`POST kbn:/api/fleet/epm/packages/security_detection_engine`	`elastic kb elastic-package-manager-epm post-fleet-epm-packages-pkgname --pkg-name 'security_detection_engine'`
`POST kbn:/internal/detection_engine/prebuilt_rules/installation/_review`	CLI gap — prebuilt-rule review is an internal Kibana API; keep this shorthand as the contract
`POST kbn:/internal/detection_engine/prebuilt_rules/installation/_perform`	CLI gap — prebuilt-rule install is an internal Kibana API; keep this shorthand as the contract
`POST kbn:/api/detection_engine/rules/_bulk_action`	CLI gap — generated `perform-rules-bulk-action` accepts only `edit` ; keep this shorthand for disable/enable

Internal ML-module APIs, prebuilt-rules

_review

_perform

, detection-engine index, and rules disable/enable have no usable generated CLI commands yet. Keep the HTTP shorthand as the contract; do not add skill-owned scripts as a workaround. Generated Fleet EPM get/install commands exist — use those instead of the shorthand.

HTTP API（简写）	`elastic` CLI 命令
`GET kbn:/api/fleet/epm/packages/{package}`	`elastic kb elastic-package-manager-epm get-fleet-epm-packages-pkgname --pkg-name '{package}'`
`GET kbn:/api/fleet/epm/packages/{package}/{version}/docs/README.md`	CLI 缺口——在 registry 路径上获取 package 文件会返回 404；保留此简写形式作为约定
`POST kbn:/api/fleet/epm/packages/{package}`	`elastic kb elastic-package-manager-epm post-fleet-epm-packages-pkgname --pkg-name '{package}'`
`POST /{source_patterns}/_search`	`elastic es count --index '{source_patterns}' --allow-no-indices true --ignore-unavailable true`
`GET /_component_template/{name}`	`elastic es cluster get-component-template --name '{name}'`
`PUT /_component_template/{name}`	`elastic es cluster put-component-template --name '{name}' --template '{json}'`
`GET /_ingest/pipeline/{name}`	`elastic es ingest get-pipeline --id '{name}'`
`PUT /_ingest/pipeline/{name}`	`elastic es ingest put-pipeline --id '{name}' --input-file '{path}'`
`POST /{data_stream}/_rollover`	`elastic es indices rollover --alias '{data_stream}'`
`GET /_transform/{pattern}`	`elastic es transform get-transform --transform-id '{pattern}'`
`GET /_transform/{pattern}/_stats`	`elastic es transform get-transform-stats --transform-id '{pattern}'`
`POST /_transform/{id}/_stop`	`elastic es transform stop-transform --transform-id '{id}' --force true --wait-for-completion true`
`POST /_transform/{id}/_reset`	`elastic es transform reset-transform --transform-id '{id}' --force true`
`POST /_transform/{id}/_update`	`elastic es transform update-transform --transform-id '{id}' --description '{existing}'`
`POST /_transform/{id}/_start`	`elastic es transform start-transform --transform-id '{id}'`
`POST /_transform/{id}/_schedule_now`	`elastic es transform schedule-now-transform --transform-id '{id}'`
`POST /_aliases`	`elastic es indices update-aliases --actions '{json}'`
`GET kbn:/api/data_views`	`elastic kb data-views get-all-data-views-default`
`POST kbn:/api/data_views/data_view`	`elastic kb data-views create-data-view-default --data-view '{json}'`
`GET /_license`	`elastic es license get`
`GET /_ml/info`	`elastic es ml info`
`GET /_ml/anomaly_detectors/_all/_stats`	`elastic es ml get-job-stats --job-id '_all'`
`GET kbn:/internal/ml/modules/get_module/{module_id}`	CLI 缺口——ML module get 是 Kibana 内部 API；保留此简写形式作为约定
`POST kbn:/internal/ml/modules/setup/{module_id}`	CLI 缺口——ML module setup 是 Kibana 内部 API；保留此简写形式作为约定
`GET kbn:/api/detection_engine/rules/prepackaged/_status`	CLI 缺口——没有生成的 prepackaged-status 命令；保留此简写形式作为约定
`POST kbn:/api/detection_engine/index`	CLI 缺口——没有生成的 detection-engine index 命令；保留此简写形式作为约定
`POST kbn:/api/fleet/epm/packages/security_detection_engine`	`elastic kb elastic-package-manager-epm post-fleet-epm-packages-pkgname --pkg-name 'security_detection_engine'`
`POST kbn:/internal/detection_engine/prebuilt_rules/installation/_review`	CLI 缺口——prebuilt-rule review 是 Kibana 内部 API；保留此简写形式作为约定
`POST kbn:/internal/detection_engine/prebuilt_rules/installation/_perform`	CLI 缺口——prebuilt-rule install 是 Kibana 内部 API；保留此简写形式作为约定
`POST kbn:/api/detection_engine/rules/_bulk_action`	CLI 缺口——生成的 `perform-rules-bulk-action` 仅接受 `edit` ；保留此简写形式以执行 disable/enable

内部 ML-module API、预构建规则

_review

_perform

、detection-engine index 以及规则 disable/enable 目前没有可用的自动生成 CLI 命令。保留 HTTP 简写形式作为约定；不要添加 skill 自有脚本作为变通方案。已生成 Fleet EPM get/install 命令——请使用这些命令，而不是简写形式。