Security AI Accelerator

Overview

A fixed-price, time-boxed professional services engagement delivering a foundational Elastic Security AI implementation. Elastic consultants configure the customer's Elastic environment, deploy ML models, onboard up to two data sources, enable and validate a confirmed set of AI capabilities, and deliver a Knowledge Transfer Workshop and AI Configuration Summary Document. The specific AI capabilities delivered are confirmed during Phase 1 (Day 1) and locked by end of Phase 2 (Day 2). This engagement covers one Elastic deployment only. Any additional deployments, data sources beyond two, or AI capabilities beyond the confirmed Day 2 set are expressly out of scope unless agreed in a mutually executed change order.

Scope

• Phase 1 (Day 1): Project kickoff; AI capability scoping and readiness assessment; cluster version validation; ML node verification; LLM provider and data source confirmation; AI Capability Selection Shortlist
• Phase 2 (Day 2): Capability selection finalised and scope locked; solution design; RBAC design for up to 3 roles; inference endpoint plan; LLM connector design; RAG and AI Agent Builder design (if in scope); Solution Design Document
• Phase 3 (Day 3): Elastic Cloud deployment validation; ML model deployment (ELSER v2, E5 multilingual as applicable); inference endpoint creation and validation; Fleet Server deployment; up to 2 OOTB Elastic Agent data source integrations onboarded and validated
• Phase 4 (Days 4–9): LLM connector configuration; completion inference endpoint; AI feature enablement (AI Assistant Security, Attack Discovery, RAG Knowledge Base, Elastic Playground, AI Agent Builder — confirmed subset only); up to 3 RBAC roles; GenAI audit logging; AI Operations monitoring dashboard; end-to-end validation and performance tuning; AI Configuration Summary Document
• Phase 5 (Day 10): Knowledge Transfer Workshop covering all deployed capabilities; documentation handover

AI capabilities available for selection: LLM/GenAI Connector (1 provider), AI Assistant (Security), Attack Discovery, RAG Knowledge Base, Elastic Playground, AI Agent Builder (v9.3+). Not all capabilities are deployed in every engagement — the confirmed subset is locked by end of Day 2 and does not change thereafter.

Out of scope

This engagement does not include:

• More than 2 OOTB data source integrations
• More than 1 LLM provider or connector
• More than 3 RBAC roles
• AI capabilities not confirmed in scope by end of Day 2
• Production hardening, high availability configuration, or disaster recovery implementation
• Custom ingest pipeline development beyond what is required for confirmed in-scope AI capabilities
• Custom detection rule development or SIEM content migration
• Multi-cluster deployments or additional Elastic environments
• Post-engagement support, ongoing managed services, or model retraining
• Elastic cluster upgrades required to meet minimum version requirements (upgrade must be completed before Day 1)
• LLM provider provisioning — Customer is responsible for selecting, provisioning, and credentialing the LLM provider before Day 4

Any work outside the scope above requires a mutually executed change order and may result in additional fees, revised assumptions, and schedule changes.

Engagement timeline

• Scheduled to commence approximately 6–8 weeks after purchase, subject to resource availability and Customer readiness
• Delivered by an Elastic Consultant or a certified partner resource under Elastic oversight
• Unless otherwise agreed in writing, the services will be delivered remotely
• Delivery is expected to occur over contiguous business days or contiguous calendar weeks, as scheduled by Elastic
• If delivery is delayed, interrupted, or rescheduled due to Customer availability, access issues, environment readiness, or other Customer dependencies, Elastic may reassign resources, adjust the schedule, or require an Order Form (change order)
• Time scheduled for the engagement that cannot be used due to Customer delay, unavailability, failure to meet dependencies, or inability to provide required access will count against the total consulting days

Fixed-price conditions and assumptions

• Customer has an active Elastic Cloud subscription or accessible self-managed cluster at a version compatible with the selected AI capabilities before Day 1 (AI Assistant 8.8+; Attack Discovery 8.15+; AI Agent Builder 9.3+)
• Customer has provisioned an LLM provider and has API credentials available before Day 4
• Customer provides data source targets and collection credentials before Day 3
• Customer designates a technical resource available to collaborate for approximately 3–4 hours per day throughout the engagement
• ML nodes are provisioned and sized for planned model deployments before Day 3
• Knowledge sources for RAG (if in scope) are identified and accessible before Day 5
• AI capabilities are confirmed and locked by end of Day 2 — no scope additions after Day 2
• Engagement covers 1 Elastic deployment; additional deployments require a change order

If any of the above assumptions are not met, Elastic may adjust the schedule, limit the services performed to fit the fixed-price scope, count impacted time against the engagement, or require a change order.

Deliverables

• AI Capability Selection Shortlist (Day 1) and confirmed capability list locked (Day 2)
• AI Readiness Assessment (cluster version, ML node status, version gaps, remediation actions)
• One (1) Solution Design Document (capability selection, RBAC design, ML sizing, inference endpoint inventory, ingestion plan)
• One (1) Operational Elastic Cloud deployment with ML foundation deployed and validated
• Up to two (2) OOTB data source integrations streaming live with ECS compliance confirmed
• One (1) LLM connector configured and validated
• Confirmed AI capabilities enabled, configured, and end-to-end validated
• Up to three (3) RBAC roles scoped to selected AI features
• GenAI audit logging enabled
• One (1) AI Operations monitoring dashboard live in Kibana
• One (1) AI Configuration Summary Document
• One (1) Knowledge Transfer Workshop covering all deployed capabilities
• Expansion roadmap discussion notes (capabilities evaluated but deferred)

Completion

The engagement will be considered complete upon delivery of the Knowledge Transfer Workshop, and the AI Configuration Summary Document. The engagement may also be deemed complete if Customer delays, is unavailable, fails to meet required prerequisites, or is otherwise unable to participate after Elastic has made commercially reasonable efforts to deliver within the agreed engagement window.

General terms

Capitalized terms used but not defined in this package description have the meanings given to them in the Order Form, the applicable Service Description, or the Elastic Services Agreement.

No formal Customer signoff and no milestone or deliverable acceptance process applies to this fixed-price Services Package. Each Service is deemed accepted upon Completion.

"Completion" means, with respect to a Service, the point at which Elastic has performed the activities within the scope of this Services Package, including (where applicable) delivery of any written report, materials, or knowledge transfer session described in this package's scope, or the expiry of the time-boxed engagement period for this package, whichever occurs first. Completion does not require Customer signoff or acceptance of any deliverable.

Customer is solely responsible for the backup, maintenance, and security of its environment, systems, and data. Elastic is not responsible for any configuration changes, data loss, downtime, or other impact to Customer's environment arising from or in connection with the Service.

This engagement delivers a configured net-new, self-managed Elastic document search solution, including search use case analysis, data modeling and ingestion, advanced example query implementation, advanced RBAC configuration, infrastructure provisioning, and a final report, within the defined fixed-price scope. Elastic does not guarantee any specific performance, cost, operational, or business outcome beyond the deliverables defined above. Customer remains solely responsible for ongoing operations, configuration changes made outside the engagement scope, and all post-engagement activities related to its environment.

References in this package to validation, testing, acceptance tests or acceptance test harnesses, golden queries, launch readiness, or go-live describe activities performed, demonstrated, or delivered by Elastic and do not create any Customer acceptance, signoff, testing, or payment condition. Completion occurs as defined in this package regardless of any such activity, and no portion of the fees is withheld or deferred pending any test result, validation, or go-live event.