Turn Elastic SIEM alerts into GitHub issues for detection-as-code
Build a workflow triggered by Elastic SIEM alerts (webhook or polling). For each alert, create a GitHub issue capturing the rule, severity, entities, and a link back to the alert. Deduplicate against existing open issues for the same rule/entity, label by severity, and handle API errors with retries. Optionally reference the issue in detection-as-code pull requests. Output the created issue URL per alert.
What this prompt builds
Create a GitHub issue for each Elastic SIEM alert to triage and drive rule tuning.
The problem
SIEM alerts and detection-engineering work live in separate systems, so triage decisions and rule tuning aren't linked to a trackable artifact. Detection improvements get lost.
Solution and impact
This workflow opens a GitHub issue for each Elastic SIEM alert, giving every detection a trackable home that fits a detection-as-code workflow. Triage and rule-tuning become version-controlled and auditable.