[Sig Events] Add significant events management skill + tools by mykolaharmash · Pull Request #271430 · elastic/kibana

mykolaharmash · 2026-05-27T11:54:45Z

This PR adds a new Significant Events management skill plus built-in tools for searching, creating, and updating event verdicts.

Added a new significant-events-management skill with workflow guidance and examples
Added new built-in tools: event_search, event_create, and event_verdict_update
Updated kbn-streams-schema to share SigEvent verdict/impact option schemas
Made several SigEvent fields optional in schema (discovery_id, discovery_slug, verdict_id, workflow_execution_id, rule_names) as they cannot be set when sig events are created by an agent directly.

CleanShot.2026-05-27.at.13.59.28-converted.2.mp4

coderabbitai · 2026-05-27T11:55:48Z

Caution

Review failed

An error occurred during the review process. Please try again later.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

🛠️ Update Documentation

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-05-27T11:56:21Z

@mykolaharmash, it looks like you're updating the parameters for a rule type!

Please review the guidelines for making additive changes to rule type parameters and determine if your changes require an intermediate release.

github-actions · 2026-05-27T11:56:27Z

A documentation preview will be available soon.

🔨 Buildkite builds
📚 HTML diff
📙 Preview page

Request a new doc build by commenting

Rebuild this PR: run docs-build
Rebuild this PR and all Elastic docs: run docs-build rebuild

_{run docs-build is much faster than run docs-build rebuild. A rebuild should only be needed in rare situations.}

_{If your PR continues to fail for an unknown reason, the doc build pipeline may be broken. Elastic employees can check the pipeline status here.}

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds Significant Events (SigEvents) management support to Streams Agent Builder by introducing a new skill and new built-in tools for searching, creating, and updating SigEvents, while centralizing shared SigEvent verdict/impact schemas in @kbn/streams-schema.

Changes:

Added significant-events-management skill content and registered it as an allow-listed built-in skill.
Implemented new SigEvents tools: event_search, event_create, and event_verdict_update, including telemetry events for create/update.
Centralized verdict/impact option constants + schemas in @kbn/streams-schema and updated UI to consume shared verdict options.

Reviewed changes

Copilot reviewed 32 out of 32 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
x-pack/platform/plugins/shared/streams_app/public/components/sig_events/significant_events_discovery/components/sig_events_tab/index.tsx	Switches verdict filter options to shared schema constants.
x-pack/platform/plugins/shared/streams_app/public/components/sig_events/significant_events_discovery/components/sig_events_tab/filter_constants.ts	Aligns verdict typing with schema; adds impact color mapping.
x-pack/platform/plugins/shared/streams/server/routes/internal/sig_events/events/route.ts	Adjusts lifecycle route to handle missing `discovery_slug`.
x-pack/platform/plugins/shared/streams/server/lib/telemetry/ebt/types.ts	Adds telemetry prop types for event create and verdict update tools.
x-pack/platform/plugins/shared/streams/server/lib/telemetry/ebt/service.ts	Registers new telemetry event types.
x-pack/platform/plugins/shared/streams/server/lib/telemetry/ebt/schemas.ts	Adds telemetry schemas for event create and verdict update.
x-pack/platform/plugins/shared/streams/server/lib/telemetry/ebt/events.ts	Declares new telemetry event types mapping to schemas.
x-pack/platform/plugins/shared/streams/server/lib/telemetry/ebt/constants.ts	Defines string constants for new telemetry event types.
x-pack/platform/plugins/shared/streams/server/lib/telemetry/ebt/client.ts	Adds client methods to report new telemetry events.
x-pack/platform/plugins/shared/streams/server/agent_builder/tools/register_tools.ts	Registers new SigEvents tools and exports tool IDs.
x-pack/platform/plugins/shared/streams/server/agent_builder/tools/register_tools.test.ts	Extends tool registration test coverage for new tool IDs.
x-pack/platform/plugins/shared/streams/server/agent_builder/tools/event_verdict_update/tool.ts	Adds built-in tool to update an event’s verdict (with telemetry).
x-pack/platform/plugins/shared/streams/server/agent_builder/tools/event_verdict_update/tool.test.ts	Adds tests for the verdict update tool wrapper.
x-pack/platform/plugins/shared/streams/server/agent_builder/tools/event_verdict_update/handler.ts	Implements verdict update handler creating a new event version.
x-pack/platform/plugins/shared/streams/server/agent_builder/tools/event_verdict_update/handler.test.ts	Adds unit tests for verdict update handler logic.
x-pack/platform/plugins/shared/streams/server/agent_builder/tools/event_search/tool.ts	Adds built-in tool to search significant events.
x-pack/platform/plugins/shared/streams/server/agent_builder/tools/event_search/tool.test.ts	Adds tests for the event search tool wrapper.
x-pack/platform/plugins/shared/streams/server/agent_builder/tools/event_search/handler.ts	Implements search handler mapping tool params to client API.
x-pack/platform/plugins/shared/streams/server/agent_builder/tools/event_search/handler.test.ts	Adds unit tests for search handler param mapping.
x-pack/platform/plugins/shared/streams/server/agent_builder/tools/event_create/tool.ts	Adds built-in tool to create significant events (with telemetry + confirmation).
x-pack/platform/plugins/shared/streams/server/agent_builder/tools/event_create/tool.test.ts	Adds tests for the event create tool wrapper.
x-pack/platform/plugins/shared/streams/server/agent_builder/tools/event_create/handler.ts	Implements event creation handler producing a `SigEvent` document.
x-pack/platform/plugins/shared/streams/server/agent_builder/tools/event_create/handler.test.ts	Adds unit tests for event creation handler.
x-pack/platform/plugins/shared/streams/server/agent_builder/skills/sig_events_management/skill.md.text	Adds workflow guidance and examples for SigEvents management.
x-pack/platform/plugins/shared/streams/server/agent_builder/skills/sig_events_management/index.ts	Defines and exposes the new skill with its tool dependencies.
x-pack/platform/plugins/shared/streams/server/agent_builder/skills/sig_events_management/description.text	Adds the skill description text.
x-pack/platform/plugins/shared/streams/server/agent_builder/skills/register_skills.ts	Registers the new SigEvents management skill.
x-pack/platform/packages/shared/kbn-streams-schema/src/sig_events/index.ts	Re-exports verdict/impact schemas, types, and options for reuse.
x-pack/platform/packages/shared/kbn-streams-schema/src/sig_events/events/index.ts	Introduces shared verdict/impact schemas and relaxes optional SigEvent fields.
x-pack/platform/packages/shared/kbn-streams-schema/index.ts	Exposes new SigEvent schema exports at package root.
x-pack/platform/packages/shared/agent-builder/agent-builder-server/allow_lists.ts	Allow-lists the new built-in skill.
x-pack/platform/packages/shared/agent-builder/agent-builder-common/tools/constants.ts	Adds tool IDs for SigEvents search/create/verdict update.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

crespocarlos

I haven't tested it, just had a quick look at the code. Looks pretty cool.

crespocarlos · 2026-05-28T08:34:39Z

  STREAMS_SEARCH_KNOWLEDGE_INDICATORS_TOOL_ID,
+  STREAMS_SEARCH_EVENTS_TOOL_ID,
+  STREAMS_CREATE_EVENT_TOOL_ID,
+  STREAMS_EVENT_VERDICT_UPDATE_TOOL_ID,


Verdict will be dropped soon https://github.com/elastic/streams-program/pull/1390. We'll only have events. Just flagging it. I'm not sure if we should already discount it here or as a follow-up. up to you.

But events still have a verdict property, right? The tool only changes the verdict on an event, doesn't create a verdict document.

The term verdict itself will be dropped too. Probably status makes more sense

Renamed to status in e001d97.

Haven't touched the SigEvent schema, assuming it will be renamed as part of your change.

crespocarlos · 2026-05-28T08:36:14Z

+- `criticality`:
+  - Number in range 0..100 indicating system criticality.
+  - Suggested scale:
+    - 0-30 low
+    - 31-60 medium
+    - 61-80 high
+    - 81-100 critical


just FYI: criticality will be renamed to severity soon.

crespocarlos · 2026-05-28T08:36:58Z

+- `impact`:
+  - Always set to exactly one of: `critical`, `high`, `medium`, `low`.


Making LLMs assign impact makes me a bit nervous. This was something done for the prototype, but we need to review if we want this

Let's see, if we decide to get rid of it, I'll follow up with the skill change.

crespocarlos · 2026-05-28T08:38:57Z

+  "criticality": 86,
+  "confidence": 0.84,
+  "impact": "high",
+  "recommended_action": "Scale checkout pods and increase upstream timeout budget temporarily.",


This diverges from what the workflow does. In fact, I feel like this field is a dead weight. It's deterministic in the workflow and I'm not sure it adds more value than recommendations

got it, I'll make it optional on the schema remove it from the skill for now

Updated in 47adb29

crespocarlos · 2026-05-28T08:40:12Z

+    '@timestamp': now,
+    created_at: now,
+    event_id: eventId,
+    discovery_slug: `agent-event-${eventId.slice(0, 8)}`,


This will also diverge from what discovery workflows expect. We'll need to find better ways for this as a follow-up.

Yeah, agree, this field bothers me as well. I'll update the tool and the skill once we settle on a better solution, for now I added it because we use discovery_slug as a grouping key.

crespocarlos · 2026-05-28T08:42:29Z

@@ -0,0 +1,167 @@
+You manage Significant Events (SigEvents) for Streams.


q: was this based on the current investigator or judge agent instructions?

it will be great to use this in the workflows

Not really based on the agents, I just tried to tune it to the conversation flow with agent discovering and proactively suggesting sig events to the user. LLM generated the first draft and I tweaked it after experimenting with the chat.

crespocarlos · 2026-05-28T08:44:55Z

+  recommendations: string[];
+}
+
+export async function createEventToolHandler({


To confirm, we'll have events without a corresponding discovery and detections. correct? I wonder what will happen to the workflows once it sees these docs.

Yes, correct. Would it make sense to add some ignore logic into the workflow for this kind of "manual" events?

crespocarlos · 2026-05-28T08:48:08Z

+        message: i18n.translate(
+          'xpack.streams.agentBuilder.tools.eventCreate.confirmation.message',
+          {
+            defaultMessage: 'Create significant event "{title}"?',


Should we mention the stream in this message?

crespocarlos · 2026-05-28T08:50:27Z

+  verdict: EventVerdict;
+}): Promise<{ event_id: string; updated: number; ignored: number; verdict: EventVerdict }> {
+  const { hits } = await eventClient.findById(eventId);
+  const latest = hits[hits.length - 1];


Why not sort by timestamp?

Not sure I get what you mean, it's sorted inside runFindByIdEsqlQuery with @timestamp ASC

crespocarlos · 2026-05-28T09:16:59Z

One thing I just thought is that we need to ensure these changes are reflected in the workflow's agents. We also need these changes on the skill side, keeping up with updates on schemas and indices.

This skill replaces a bunch of lines of instructions and will help standardize what agents need to do WRT sigevent discovery.

…nt-agent-skill

crespocarlos

Tested the basic flow, everything works. Left some nits

crespocarlos · 2026-06-01T07:35:57Z

  STREAMS_SEARCH_KNOWLEDGE_INDICATORS_TOOL_ID,
+  STREAMS_SEARCH_EVENTS_TOOL_ID,
+  STREAMS_CREATE_EVENT_TOOL_ID,
+  STREAMS_EVENT_VERDICT_UPDATE_TOOL_ID,


The term verdict itself will be dropped too. Probably status makes more sense

crespocarlos · 2026-06-01T07:39:06Z

+import { v4 as uuidv4 } from 'uuid';
+import type { EventClient } from '../../../lib/sig_events/events';
+
+type EventVerdict = 'promoted' | 'acknowledged' | 'demoted';


SigEventVerdict?

crespocarlos · 2026-06-01T07:40:29Z

+    created_at: now,
+    event_id: eventId,
+    discovery_slug: `agent-event-${eventId.slice(0, 8)}`,
+    verdict: eventInput.verdict ?? 'promoted',


Should the default be promoted?

I think so, if the user decides explicitly to create a sig event, I assume it's about something ongoing that they just discovered.

Though there might be cases when user wants to save a sig event as a draft and do additional investigation before promoting it, we might need to introduce this additional draft state. WDYT?

We could leave it as-is and iterate. I'm keen to use it in the sigevent agents; eventually, these things will be refined.

…nt-agent-skill

mykolaharmash · 2026-06-01T09:55:51Z

@crespocarlos I pushed renaming to verdict into status, please take a look

kibanamachine · 2026-06-01T11:00:24Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 6832977
Build duration: 68 mins

Failed CI Steps

Test Failures

[job] [logs] FTR Configs #108 / Cloud Security Posture - Group 5 (KSPM + Flyouts) Security Network Page - Graph visualization expanded flyout - filter by node
[job] [logs] Scout Lane #10 - stateful-classic / default / local-stateful-classic - Saved query menu — CRUD (Discover) - save, load, update, save-as-new, delete via the popover
[job] [logs] Scout Lane #3 - stateful-classic / default / local-stateful-classic - UptimeIntegrationDeprecation - returns true when non-managed synthetics policies exist

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`agentBuilder`	1.9MB	1.9MB	+63.0B
`datasetQuality`	541.1KB	541.4KB	+288.0B
`streamsApp`	2.1MB	2.1MB	+275.0B
total			+626.0B

History

💛 Build #450312 was flaky ad3e2bf
💛 Build #450236 was flaky 47adb29
💔 Build #449397 failed 817a07c

mykolaharmash force-pushed the sig-events-management-agent-skill branch from 2c414f8 to 8b47bb4 Compare May 27, 2026 14:19

mykolaharmash requested a review from Copilot May 28, 2026 08:31

mykolaharmash marked this pull request as ready for review May 28, 2026 08:31

mykolaharmash requested review from a team as code owners May 28, 2026 08:31

Copilot AI reviewed May 28, 2026

View reviewed changes

[Sig Events] Add significant events management skill and tools

817a07c

mykolaharmash force-pushed the sig-events-management-agent-skill branch from 5e4fd7f to 817a07c Compare May 28, 2026 08:40

crespocarlos reviewed May 28, 2026

View reviewed changes

mykolaharmash mentioned this pull request May 28, 2026

[Sig Events] Add Sig Events Agent tools and skill #266575

Closed

mykolaharmash added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Feature:SigEvents Significant events feature, related to streams and rules/alerts (RnA) labels May 28, 2026

crespocarlos mentioned this pull request May 28, 2026

[SigEvents][Discovery] Add sig-events discovery workflows #271791

Open

mykolaharmash added 2 commits May 29, 2026 13:09

review

65502fb

Merge remote-tracking branch 'upstream/main' into sig-events-manageme…

5ea41d0

…nt-agent-skill

mykolaharmash requested a review from crespocarlos May 29, 2026 11:11

Make recommended_action optional

47adb29

github-advanced-security AI found potential problems May 29, 2026

View reviewed changes

schema limits

ad3e2bf

crespocarlos reviewed Jun 1, 2026

View reviewed changes

mykolaharmash added 4 commits June 1, 2026 11:34

fixup! schema limits

e389ecf

Merge remote-tracking branch 'upstream/main' into sig-events-manageme…

dc6de9d

…nt-agent-skill

Rename verdict into status in tools and APIs

e001d97

Merge remote-tracking branch 'upstream/main' into sig-events-manageme…

6832977

…nt-agent-skill

mykolaharmash requested a review from crespocarlos June 1, 2026 09:55

crespocarlos approved these changes Jun 1, 2026

View reviewed changes

		- `impact`:
		- Always set to exactly one of: `critical`, `high`, `medium`, `low`.

		@@ -0,0 +1,167 @@
		You manage Significant Events (SigEvents) for Streams.

Conversation

mykolaharmash commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented May 27, 2026

Review failed

Uh oh!

github-actions Bot commented May 27, 2026

Uh oh!

github-actions Bot commented May 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

crespocarlos left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

crespocarlos May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mykolaharmash May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mykolaharmash May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mykolaharmash May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

crespocarlos commented May 28, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

crespocarlos left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

mykolaharmash commented May 27, 2026 •

edited

Loading

crespocarlos May 28, 2026 •

edited

Loading

mykolaharmash May 29, 2026 •

edited

Loading

mykolaharmash May 29, 2026 •

edited

Loading

mykolaharmash May 29, 2026 •

edited

Loading