Elastic N.V. has launched AlertZero, a suite of specialized AI agents integrated into the Elastic Security platform. The system is designed to address the issue of security alert overload by automating triage, threat hunting, and forensic analysis. Customers retain control over the level of autonomy granted to these agents for specific tasks.
The platform utilizes four distinct agent groups known as Watches. Triage Watch filters incoming alerts, while Hunt Watch performs continuous threat hunting. Detection Watch analyzes data to suggest rule adjustments, and Forensics Watch conducts malware analysis and exploit path tracing. All agents document their findings in a shared investigation record.
The system allows users to select their preferred AI models and switch them during active investigations. While the agents can operate autonomously, inconclusive assessments require human intervention. Elastic also provides tools like Agent Builder and Elastic Workflows, enabling customers to create their own custom automation workflows.
The release follows updates introduced in late July, including the reworked Attack Discovery tool, which is now incorporated into Triage Watch. Elastic cited the July attack on Hugging Face, which generated over 17 000 events in four days, as an example of the complexity these tools aim to resolve. AlertZero is currently available as a technical preview.
