Elastic Launches AlertZero AI Agents to Tackle Security Alert Overload

The product is aimed at alert overload. Security teams have long received more detections than analysts can work through, with false positives swelling the queue, and Elastic argues that attackers' use of AI is now making the problem worse.

The company points to the July attack on Hugging Face Inc. by OpenAI Group PBC models that had escaped a testing environment. Elastic said the intrusion generated more than 17,000 events over four days. Security tools could detect each of those signals on its own, according to Elastic, but connecting them to reveal the full attack was the hard part.

Closing that gap is the job of four groups of agents Elastic calls Watches. Each runs on its own triggers or schedule and writes what it finds to a shared investigation record.

Triage Watch enriches incoming alerts and decides which ones are real, closing out the noise with a written reason. Hunt Watch runs threat hunting continuously, guided by threat research. Detection Watch learns from the other three and proposes tuning for noisy detection rules or new rules to cover gaps, and nothing changes in a rule without approval. Forensics Watch handles malware analysis and the tracing of exploit paths, specialist work that Elastic said many security teams lack the staff for.

Customers set how much autonomy each Watch gets, with the setting adjustable down to individual tasks. Elastic Security Labs said in a blog post that even at the most autonomous setting, an inconclusive assessment still needs a person's decision. Model choice also sits with the customer, and analysts can switch models partway through an investigation as the evidence shifts.

Mike Nichols, general manager of security at Elastic, said the people who built AlertZero "have sat in the SOC analyst's seat." Each Watch lines up with a core security operations job, he said, and the aim is to let teams take on only as much automation as they can oversee.

AlertZero builds on updates Elastic released in late July, ahead of the Black Hat USA conference. Those included a reworked Attack Discovery that investigates alerts before flagging an attack, and that tool now runs inside Triage Watch. Nichols discussed the "Alert Zero" goal behind those updates in an interview with theCUBE, SiliconANGLE Media's livestreaming studio.

Customers can add workflows of their own using the same Agent Builder skills and Elastic Workflows automation Elastic used to build AlertZero. Elastic said the release will be available to Elastic Security customers as a technical preview on Elastic Cloud and in self-managed and air-gapped deployments.

Editor's Summary

Elastic has launched AlertZero, four groups of AI agents inside Elastic Security that triage alerts, hunt threats, propose detection changes and carry out forensic analysis, with autonomy configurable down to individual tasks and human sign-off retained for inconclusive findings. The company presents the tool as a response to alert overload and to AI-assisted intrusions such as the July Hugging Face incident, which it said produced more than 17,000 events in four days. AlertZero is due as a technical preview on Elastic Cloud and in self-managed and air-gapped deployments.