Elastic introduces AlertZero, an agent-based layer within Elastic Security. Specialized AI agents handle triage, threat hunting, detection tuning, and forensic investigation. Analysts decide for themselves how much work to delegate. AlertZero works with any model, in any deployment.
Instead of sifting through thousands of raw alerts, analysts will soon be left with a short list of recommended actions. Each alert receives an evidence-backed response. The agents learn from the way a security team already works and adapt accordingly.
Elastic highlights a well-known bottleneck: the number of alerts is growing faster than the number of analysts available to process them. False positives only make the queue longer. Attackers who use AI don’t make things any easier.
Four watches, each with its own task
AlertZero organizes work around so-called Watches: designated groups of agents with fixed responsibilities that operate on triggers and schedules. It consolidates their findings into a shared investigation file. TriageWatch enriches alerts, assesses their validity, filters out noise with a justification, and escalates genuine alerts. Hunt Watch continuously hunts for threats. DetectionWatch learns from the other Watches and suggests adjustments to overly sensitive rules and new rules to address gaps, though the agent never modifies a rule without approval. ForensicsWatch provides in-depth expertise in forensic investigation, malware analysis, and exploit paths, knowledge that an average SOC doesn’t always have in-house.
“What makes AlertZero different is that our team who built it have sat in the SOC analyst’s seat,” says Mike Nichols, general manager of Security at Elastic. He says the level of autonomy can be configured for each Watch.
Free choice of models
The model flexibility is particularly noteworthy. Analysts can switch models during an investigation, depending on the task and the evidence. AlertZero runs on Elastic Cloud, in self-managed environments, and in air-gapped environments.
Customers can extend AlertZero with the same building blocks that Elastic itself used: Elastic Workflows and Agent Builder, the toolset that enables organizations to build their own AI agents on Elasticsearch. Furthermore, AlertZero builds on Attack Discovery and ES|QL.
AlertZero is available as a Technical Preview for Elastic Security customers.