Elastic's internal security operations center (SOC) significantly improved AI alert triage accuracy from 60% to 92% by enhancing the context provided to their AI agents rather than changing models. By integrating data such as per-rule investigation guides, user risk metrics from Workday, and a 30-day history of previous case outcomes, the team transformed AI-generated summaries from unreliable "slop" into high-confidence tools. This approach enables analysts to trust AI verdicts and close cases more efficiently.
The technical implementation leverages an agentic pipeline built with Elastic Workflows and Agent Builder, utilizing three specialized agents: a Pattern Finder, an L1 Investigator, and a Summarizer. This modular architecture prioritizes faster ES|QL queries for predictable data lookups and reserves LLM processing for complex reasoning. A built-in feedback loop further ensures that agents learn from human-corrected verdicts, continuously tuning the system's performance within the production environment.
Top comments (0)