maintain-integration

When to use vs create-integration

Use this skill when the package already exists:

• reviewing quality, ECS compliance, or correctness of an existing package
• fixing specific issues: pipeline errors, field mappings, ECS categorization, CEL programs, manifests
• running a full quality improvement pass (review → fix → re-validate loop)
• making minor adjustments to existing data streams

Use create-integration instead when:

• creating a new integration package from scratch
• adding a new data stream to an existing package (create-integration → references/add-datastream-workflow.md)

Modes

Review only (read-only, no edits)

→ Read references/review-workflow.md fully before starting.