Kibanav0.1.0

A SOC team uses the Kibana skill to list detection engine rules, review alerting rules, and manage security cases from chat. Analysts can quickly confirm, filter, and investigate alerts while assigning cases to the right responders. High-impact rule changes are gated by explicit confirmation before execution.

SREs monitor infrastructure by querying data views and alerting rules via chat to see firing alerts and available rule types. During incidents they verify connectors like Slack or PagerDuty are configured and confirm before deleting or modifying rules. This reduces context-switching between dashboards and chat.

IT operations manages Elastic Agent fleets by listing policies and checking agent health indicators through Kibana tools. When agents need reconfiguration, the skill confirms intended changes before applying policy updates that affect deployed endpoints. This keeps endpoint monitoring consistent across the organization.

A compliance team uses cases listing in Kibana to track security incidents requiring evidence and audit trails. They filter by severity and status, then coordinate with security teams through connected Slack or Email connectors. Deletion of cases or saved objects requires explicit confirmation to preserve audit integrity.

An MSSP monitors multiple client Kibana tenants via ClawLink hosted connections, querying data views and detection rules per client. Technicians manage alerts and cases centrally while write actions like deleting connectors or rules are confirmed per client. This scales security operations without storing client API keys locally.

ClawLink charges a monthly subscription per connected Kibana integration or per seat, bundling hosted OAuth credential management and proxy access. Revenue scales with the number of security and observability teams adopting the skill. Tiered plans can gate advanced tools like Fleet policy management or detection engine writes.

The platform monetizes by metering Kibana tool calls proxied through ClawLink, charging based on request volume or burst capacity. High-volume SOC and MSSP customers pay for throughput, rate limits, and priority routing. Free tiers allow read-only queries while write operations or bulk alert handling consume paid credits.

Large enterprises license ClawLink as part of an internal AI agent platform, with SSO, audit logging, and self-hosted or dedicated cloud deployment. The Kibana skill is one of many integrations available in the catalog. Revenue comes from annual platform contracts with support and compliance guarantees.