{"id":76,"date":"2026-10-12T12:18:19","date_gmt":"2026-10-12T10:18:19","guid":{"rendered":"https:\/\/mspbusiness.com\/en\/it-news\/elastic-introduces-alertzero-with-ai-agents-for-soc-processes\/"},"modified":"2026-10-24T22:14:39","modified_gmt":"2026-10-24T20:14:39","slug":"elastic-introduces-alertzero-with-ai-agents-for-soc-processes","status":"publish","type":"post","link":"https:\/\/mspbusiness.com\/en\/operations-and-organisation\/elastic-introduces-alertzero-with-ai-agents-for-soc-processes\/","title":{"rendered":"Elastic introduces AlertZero with AI agents for SOC processes"},"content":{"rendered":"

Elastic is releasing AlertZero as a Technical Preview within Elastic Security. It is a layer of AI agents that, according to the company, assesses alerts, hunts for threats, optimises detection rules and supports forensic investigation. Analysts decide for themselves how many tasks they leave to the agents. The solution works with any AI model, including in air-gapped environments.<\/strong><\/p>\n

AlertZero consists of a set of AI agents that, according to Elastic, learn from security teams’ existing ways of working and adapt to them. The company compares the intended outcome to inbox zero: instead of thousands of individual alerts, an analyst receives a clear list of recommended actions. Each alert is assessed on the basis of evidence, Elastic says. Analysts remain in control of which tasks are automated and where human review is still required.<\/p>\n

Elastic places the launch in the context of a growing number of alerts and false positives in SOCs. The company points to a recent attack in which an autonomous AI agent generated more than 17,000 security events in a production environment over four days. That attack began with the exploitation of a vulnerability in a data pipeline and continued with credential theft and lateral movement within the network. The individual signals were detectable, but had to be correlated to understand the attack. According to Elastic, AlertZero is designed to make and investigate such connections continuously.<\/p>\n

Four Watches with their own tasks<\/h3>\n

AlertZero organises the work through what it calls Watches: groups of AI agents with defined responsibilities that are activated by triggers and fixed schedules. Each Watch focuses on one area of security operations and records its findings in a shared case file.<\/p>\n

TriageWatch enriches alerts with additional context and determines whether they are genuine. False positives are closed with a justification, while relevant alerts are escalated. HuntWatch continuously searches for threats based on the systems and processes in the environment and insights from threat research.<\/p>\n

DetectionWatch uses the findings of the other Watches to suggest improvements to detection rules that generate too many alerts. This Watch also proposes new rules to close gaps in detection. According to Elastic, rules are never modified without approval. ForensicsWatch supports forensic investigation, malware analysis and the investigation of attack paths. Elastic says this gives teams access to expertise that is not present in every SOC.<\/p>\n

Choice of AI model and environment<\/h3>\n

AlertZero makes use of Elastic’s data infrastructure, including structured and unstructured data, logs and metrics. It works with any AI model an organisation chooses, regardless of whether the solution runs in Elastic Cloud, a self-managed environment or an air-gapped environment. Elastic says analysts should be able to switch models during an investigation, depending on the task and the available evidence.<\/p>\n

Mike Nichols, General Manager Security at Elastic, says the developers of AlertZero have themselves worked as SOC analysts. According to Nichols, the aim was a platform that gives security teams sufficient insight and control to deploy agentic automation at a scale they can manage themselves. He points out that each Watch maps to a core task within the SOC and that teams can configure, per Watch, how much autonomy the agents are given.<\/p>\n

Extensible and available as a preview<\/h3>\n

Customers can extend AlertZero with the same Agent Builder skills and Elastic Workflows that Elastic itself used during development. This allows you to add workflows tailored to your own environment without leaving the platform. AlertZero builds on existing Elastic Security features such as Attack Discovery, ES|QL, Agent Builder and Elastic Workflows.<\/p>\n

The Technical Preview will be available to Elastic Security customers in Elastic Cloud as well as in self-managed and air-gapped environments. The company has not yet given a date for general availability.<\/p>\n","protected":false},"excerpt":{"rendered":"

Elastic launches AlertZero, a layer of AI agents in Elastic Security for triage, threat hunting, detection rules and forensic investigation. Analysts decide how much autonomy the agents get.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"mspb_bron_id":1169121,"mspb_url_nl":"https:\/\/mspbusiness.com\/operatie-en-organisatie\/elastic-introduceert-alertzero-met-ai-agents-voor-soc-processen\/","mspb_url_de":"https:\/\/mspbusiness.com\/de\/betrieb-und-organisation\/elastic-stellt-alertzero-mit-ki-agents-fuer-soc-prozesse-vor\/","mspb_url_en":"","mspb_beeld_url":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/10\/hero-1791800287026.png","mspb_beeld_klein":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/10\/hero-1791800287026-400x225.png","mspb_auteur":"Redactie","mspb_beeld_alt":"","mspb_video":"","_yoast_wpseo_metadesc":"Elastic introduces AlertZero as a Technical Preview: AI agents in Elastic Security for alert triage, threat hunting and forensic investigation.","footnotes":""},"categories":[4],"tags":[],"layout":[6],"class_list":["post-76","post","type-post","status-publish","format-standard","hentry","category-operations-and-organisation","layout-news"],"_links":{"self":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/76","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/comments?post=76"}],"version-history":[{"count":1,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/76\/revisions"}],"predecessor-version":[{"id":77,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/76\/revisions\/77"}],"wp:attachment":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/media?parent=76"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/categories?post=76"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/tags?post=76"},{"taxonomy":"layout","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/layout?post=76"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}