Elastic N.V. has introduced AlertZero, a suite of specialized artificial intelligence agents designed to assist security operations teams. These AI agents are integrated into Elastic Security and are capable of handling tasks such as alert triage, threat hunting, and forensic analysis, with customers able to determine the level of autonomous operation for each task. This new offering aims to address the persistent challenge of alert overload faced by security operations centers, a problem exacerbated by the increasing use of AI by malicious actors, as first reported by Silicon Angle.
AlertZero is designed to combat alert fatigue by automating key security operations tasks. The system comprises four groups of AI agents, known as Watches, that work collaboratively. Triage Watch processes incoming alerts, enriching them with data and filtering out false positives with documented reasons. Hunt Watch performs continuous threat hunting based on threat intelligence. Detection Watch analyzes existing detections, suggesting improvements or new rules to cover identified gaps, though rule changes require human approval. Forensics Watch handles complex tasks like malware analysis and exploit path tracing, which are often understaffed in many security teams. Customers have granular control over the autonomy of each Watch, with the ability to adjust settings for individual tasks. Even with maximum automation, inconclusive findings still require human intervention.
Elastic Security Labs highlighted that the choice of AI models rests with the customer, who can also switch models during an investigation if new evidence emerges. This initiative builds upon recent updates to Elastic Security, including a reworked Attack Discovery tool now integrated into Triage Watch, and is available as a technical preview.
