Elastic Security 9.5 Adds AI-Powered Alert Triage and Attack Investigation
Summary
Elastic Security 9.5 adds alert classification with optional confidence-based auto-close, Attack Discovery investigations that correlate alerts and search logs, and workflow integrations. Analysts can inspect agent reasoning, use local models, and approve detection-rule
Key points
- Security alert analysis classifies alerts as true positive, false positive, or inconclusive, with optional auto-close for false positives above a configured confidence threshold.
- Attack Discovery correlates alerts, searches related activity and raw logs, and generates attack narratives with supporting evidence.
- The new Attacks page places Attack Discovery results alongside alerts for investigation and management.
- Attack Discovery can identify detection gaps and draft an ES|QL rule, but an analyst must review and approve the rule before it is created.
- Elastic Workflows can integrate triage and investigation into existing SOC playbooks, with custom retrieval or validation workflows available.
- Teams can use custom or local AI models and inspect agent conversations and workflow runs; higher-risk actions can require human approval.
Article Details
- Event Type
- Elastic Security 9.5 product release introducing AI-driven alert triage, attack investigation, and workflow automation capabilities.
- Impact
- The release adds alert classification, correlation and investigation of related alerts, and integration with existing SOC workflows. Teams can use custom or local models and require analyst approval for higher-risk actions; the article reports no specific security incident or victim impact.
Vendors
Products
Attack DiscoveryThe update centers on Security alert analysis, Attack Discovery, and Elastic Workflows, with support for custom models, inspectable agent reasoning, and approved detection-gap remediation.Elastic Agent BuilderAttack Discovery runs through a skill-backed pipeline powered by Elastic Agent Builder and Elastic Workflows.Elastic Security 9.5Elastic Security 9.5 introduces Alert Zero tools that help SOC teams reduce alert fatigue by automating triage, correlating related alerts, and embedding investigations into existing workflows while keeping analysts inElastic WorkflowsThe update centers on Security alert analysis, Attack Discovery, and Elastic Workflows, with support for custom models, inspectable agent reasoning, and approved detection-gap remediation.Elasticsearch[T1005 ] Data from Local System – Used when the workflow searches raw logs in Elasticsearch to gather supporting evidence for the attack narrative (‘search raw logs in the Elasticsearch platform’).