---
title: Elastic Agent Builder built-in skills reference
description: Reference of all built-in skills available in Elastic Agent Builder.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/builtin-skills-reference
products:
  - Elastic Cloud Serverless
  - Elastic Observability
  - Elastic Security
  - Elasticsearch
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Planned
---

# Elastic Agent Builder built-in skills reference
This page lists all built-in skills available in Elastic Agent Builder. Skills give agents domain-specific knowledge and tools for common task types. Built-in skills are read-only: you can't modify or delete them.
<tip>
  For an overview of how skills work in Elastic Agent Builder, refer to [Skills in Elastic Agent Builder](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/skills).
</tip>


## Availability

Skills are solution-scoped: the set of available built-in skills depends on your deployment type. Platform skills are available across all deployments. Observability, Security, and Elasticsearch skills are available in their respective serverless projects or solution views.

## Platform skills

<definitions>
  <definition term="visualization-creation Elastic Stack: Planned">
    Creates standalone or reusable Lens visualizations from index and field context. Use when a user asks for a chart, metric, trend, or breakdown visualization, or wants to update an existing one.
  </definition>
  <definition term="graph-creation Elastic Stack: Planned">
    Creates graph attachments by transforming relationship data into nodes and edges rendered inline in the conversation. Use for topology, dependency, or entity-link visualizations.
  </definition>
  <definition term="dashboard-management Elastic Stack: Planned Elastic Cloud Serverless: Preview">
    Composes and updates in-memory Kibana dashboards. Use when a user asks to find, create, or modify a dashboard, add or remove panels, or edit existing panel visualizations.
  </definition>
  <definition term="streams-exploration Elastic Stack: Planned">
    Discovers, inspects, and queries Elasticsearch streams. Use when a user wants to list available streams, understand a stream's schema, check data quality or retention, or sample documents from a stream. This is a read-only skill: it cannot create, update, or delete streams or modify stream configuration.
  </definition>
</definitions>


## Observability skills

<applies-to>
  - Serverless Observability projects: Generally available
</applies-to>

<definitions>
  <definition term="observability.investigation Elastic Stack: Unavailable">
    Answers observability questions and diagnoses issues across APM services and infrastructure. Use when a user asks about service health, error rates, latency, failed transactions, service topology, trace analysis, log patterns, SLO breaches, alert investigations, or general questions about services and their performance.
  </definition>
  <definition term="observability.rca Elastic Stack: Planned">
    Performs structured root cause analysis for incidents, outages, errors, and service degradations. Use when a user asks why something is broken, slow, or failing; when an alert has fired; or when they need to trace a cascading failure across services.
  </definition>
</definitions>


## Security skills

<applies-to>
  - Serverless Security projects: Generally available
</applies-to>

<definitions>
  <definition term="entity-analytics Elastic Stack: Planned">
    Finds and investigates security entities including hosts, users, services, and generic entities. Analyzes entity risk scores, asset criticality, and historical behavior. Use to discover risky entities or profile a specific entity by ID.
  </definition>
  <definition term="find-security-ml-jobs Elastic Stack: Planned">
    Investigates anomalous behavior detected by Machine Learning jobs, including abnormal access patterns, lateral movement, unexpected logins, suspicious domain activity, and large data transfers.
  </definition>
  <definition term="threat-hunting Elastic Stack: Planned">
    Runs hypothesis-driven threat hunts using iterative ES|QL exploration. Covers IOC search, anomaly identification, baseline behavioral comparison, and lateral movement tracking.
  </definition>
  <definition term="detection-rule-edit Elastic Stack: Planned">
    Creates and edits Elastic Security detection rules. Use when a user asks to build a rule from natural language or edit rule fields such as severity, tags, MITRE ATT&CK mappings, schedule, query, or index patterns.
  </definition>
</definitions>


## Elasticsearch skills

<applies-to>
  - Serverless Elasticsearch projects: Generally available
</applies-to>

<definitions>
  <definition term="search.catalog-ecommerce Elastic Stack: Planned">
    Guides agents through building catalog and e-commerce search solutions on Elasticsearch.
  </definition>
  <definition term="search.hybrid-search Elastic Stack: Planned">
    Guides agents through building hybrid search solutions that combine keyword and semantic search.
  </definition>
  <definition term="search.keyword-search Elastic Stack: Planned">
    Guides agents through building keyword and full-text search solutions on Elasticsearch.
  </definition>
  <definition term="search.rag-chatbot Elastic Stack: Planned">
    Guides agents through building retrieval-augmented generation chatbot solutions on Elasticsearch.
  </definition>
  <definition term="search.semantic-search Elastic Stack: Planned">
    Guides agents through building semantic and vector search solutions on Elasticsearch.
  </definition>
  <definition term="search.vector-database Elastic Stack: Planned">
    Guides agents through using Elasticsearch as a vector database.
  </definition>
</definitions>


## Related pages

- [Skills in Elastic Agent Builder](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/skills)
- [Custom skills](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/custom-skills)
- [Skill creation guidelines](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/skill-creation-guidelines)
- [Tools in Elastic Agent Builder](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/tools)
- [Built-in tools reference](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/tools/builtin-tools-reference)
- [Custom agents](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/custom-agents)