How Elastic’s Agent Skills Build and Test an NVD Integration
Summary
Elastic’s Integration Skills automate research, scaffolding, CEL development, pipelines, tests, and review. A NIST NVD example built snapshot and change-event streams, while the article stresses human review of assumptions and test coverage.
Key points
- Specialist agents handle API research, CEL development, ingest pipelines, system tests, and review, coordinated by an orchestration agent.
- A NIST NVD example produced two data streams: current snapshots of changed CVE records and a log of individual change events.
- A one-week backfill collected 7,408 CVE snapshots and 12,339 change events in a few minutes without an API key.
- In a one-day collection window, 78% of collected records were updates to CVEs published before the window; some updates affect security-relevant fields such as CVSS, CWE, and KEV status.
- The article describes preserving multiple CVSS assessments while selecting one for ECS mapping, and using NVD action names to distinguish event actions.
- Passing tests do not establish that API interpretation, defaults, documentation, or collected data are correct; the author recommends reviewing implementation artifacts and inspecting collected data.
- Suggested refinements include a latest-state transform, additional error-path tests, a real logo, and a dashboard.
Article Details
- Topic
- Elastic Integration Skills automate research, development, testing, and review of an Elastic integration that collects NVD vulnerability snapshots and change events, while leaving design decisions and validation to the user.
Vendors
Products
Elastic AgentSystem tests exercise the end-to-end flow; that is, the package is set up with test configuration and run in a real Elastic Agent, some events are collected, and they're indexed in Elasticsearch.ElasticsearchElasticsearch has native integrations to industry leading Gen AI tools and providers. Check out our webinars on going Beyond RAG Basics, or building prod-ready apps Elastic Vector Database.