Compliance work is overdue for a new approach

Compliance has traditionally lived in dashboards, spreadsheets, screenshots, audit packets, and point-in-time reviews. Security teams know the reality is more dynamic. The evidence auditors need is often buried across identity providers, endpoints, cloud platforms, network controls, vulnerability scanners, alerts, and custom application logs — all generating live operational telemetry that static tools struggle to keep up with.

Elastic Security is introducing a new pattern for compliance inside Elastic Agent Builder: agentic compliance skills that reason over security telemetry, run Elasticsearch Query Language (ES|QL)-backed checks, explain evidence, identify data gaps, and help teams move from posture review to response workflow.

The first implementation is a PCI DSS v4.0.1 compliance skill.

Rather than shipping a standalone compliance agent, Elastic uses Agent Builder's composable skill model. The PCI skill brings together purpose-built tools for scope discovery, compliance evaluation, field mapping for custom data, and ES|QL execution. The result is an interactive compliance experience where users ask questions, validate scope, inspect evidence, and understand what still requires manual audit verification.

This is not "push-button compliance"; it is a practical step toward continuous, evidence-driven compliance operations.

In compliance operations, dashboards remain useful. They give teams a fast read on posture, surface the biggest gaps, and create a shared starting point for compliance work. In practice, though, that starting point is rarely where the work ends. 

• An auditor wants to know which systems were in scope. 

• An analyst needs the underlying evidence for a failed control. 

• A platform engineer needs to understand why a source was marked as not assessable. 

• A compliance lead needs an executive summary that still carries the assessed time range, the fields that were checked, and the caveats that matter for audit defensibility. 

Static dashboards are strong at the first view; they are much weaker at those follow-up questions.

Agentic compliance changes how teams work through that gap. Instead of clicking through panels and manually stitching evidence together, people can ask questions in plain language like what PCI DSS posture looks like for authentication over the last 30 days; whether requirement 8.3.4 is failing and what supports that conclusion; which PCI-relevant sources have weak ECS coverage; or what an executive scorecard would show with red findings called out. 

The point is not to replace dashboards with a chat box. It is to make compliance answers explainable: what was evaluated, what evidence was found, where confidence is high or low, and what should happen next. That is the interaction model we are building toward — summary when you need orientation and evidence-grade depth when the next question arrives.

The skill runs compliance evaluations against one or more PCI DSS v4.0.1 requirements. Each check returns:

• Status: GREEN (compliant), RED (violation detected), AMBER (partial data), or NOT_ASSESSABLE (missing fields)

• Confidence: HIGH, MEDIUM, or LOW based on data quality and coverage

• Evidence: specific findings with affected entities, counts, and time ranges

• Recommendations: concrete remediation actions for noncompliant findings

Users can check a single requirement ("Check requirement 8.3.4") or run a full posture assessment across all requirements.

The skill produces an executive scorecard with an overall score, per-requirement breakdown, and visual red/amber/green summary.

Not every organization has perfectly normalized data. The skill includes a field mapper that inspects custom indices and suggests ECS equivalents. If authentication logs use username instead of user.name, the field mapper identifies the mapping so that compliance checks can be adapted.

One of the most important design choices is the use of structured scope claims. Every PCI tool response includes metadata recording the PCI DSS version, assessed indices, time range, evaluated requirements, checked fields, and a non-attestation disclaimer. This gives the agent a concrete provenance record to cite in its answers.

That provenance is essential for compliance conversations. A result is only meaningful if users know what data was included and what was not.

• A GREEN + HIGH confidence result means something different from GREEN + LOW confidence.

• A RED result with supporting evidence means something different from a requirement that is NOT_ASSESSABLE because fields are missing.

• An AMBER result may indicate partial telemetry, no matching events, or the need to widen the time range.

By surfacing scope and confidence alongside every result, Elastic helps users avoid two common compliance failure modes: false certainty and unactionable ambiguity.

For findings that need ownership and audit trail, using Workflows, the PCI Violation Case Creator runs a targeted PCI check (e.g., input requirements and default all), then opens a Kibana case only when the assessment output includes RED findings using an ‘if’ step on steps.run_check.output.message, not a second agent call. Cases are owned by securitySolution, tagged pci-compliance / violation, and include the full agent report in the description.

You can run it on demand or on a weekly schedule (Mondays 07:00 UTC in the example). See the linked YAML for the check prompt, case fields, and logging steps.

Together, these capabilities create a complete operational loop:

This shifts compliance from a periodic manual review to a continuous automated pipeline while preserving the transparency and inspectability that auditors require.

The release and timing of any features or functionality described in this post remain at Elastic's sole discretion. Any features or functionality not currently available may not be delivered on time or at all.

In this blog post, we may have used or referred to third party generative AI tools, which are owned and operated by their respective owners. Elastic does not have any control over the third party tools and we have no responsibility or liability for their content, operation or use, nor for any loss or damage that may arise from your use of such tools. Please exercise caution when using AI tools with personal, sensitive or confidential information. Any data you submit may be used for AI training or other purposes. There is no guarantee that information you provide will be kept secure or confidential. You should familiarize yourself with the privacy practices and terms of use of any generative AI tools prior to use. 

Elastic, Elasticsearch, and associated marks are trademarks, logos or registered trademarks of elasticsearch B.V. in the United States and other countries. All other company and product names are trademarks, logos or registered trademarks of their respective owners.