Elastic's InfoSec team built AI agents on Elastic Workflows that investigate every alert and assemble the case before an analyst ever opens it.

Alert triage with Workflows and ES|QL: closing alerts without AI

ES|QL enrichment: building the shared alert context every agent reads

The Initial Triage agent: automated alert triage in under a minute

Verdict: True Positive | Assessment: suspicious | Confidence: high

Opening a Kibana case and dispatching the Specialized agents

MacOS Forensics agent: an example investigation

The Final Review agent: the final alert triage checkpoint

Verdict: True Positive | Assessment: malicious | Confidence: high

What the analyst sees after automated alert triage

How to build an alert triage pipeline in your environment

Alert triage in under 3 minutes: the bottom line

Find out how Elastic's InfoSec team automates alert triage with Elastic Workflows and AI agents, cutting investigations from 30 minutes to under 3.

Alert fatigue comes from analysts spending time on alerts that turn out to be false positives. The most direct fix is automating the investigation steps that don't require human judgment: enrichment queries, infrastructure checks, and initial triage. When false positives close automatically and analysts only see alerts with a full investigation already assembled, the cognitive load drops significantly. This is the core design goal of the agentic SOC pattern.

How do you reduce alert fatigue in a SOC without hiring more analysts?

When using the Elastic Inference Service, inference requests are routed to trusted third-party model providers that operate with zero data retention and do not use inputs to train models. Per-model status is documented on the [EIS supported-models page](https://www.elastic.co/de/docs/explore-analyze/elastic-inference/eis-supported-models). For organizations with stricter requirements, the same pipeline can run against a model hosted on your own infrastructure, keeping all data and inference within your own network.

Is it safe to send security alert data to an AI system for triage?

A single broad agent has to decide at runtime what to investigate for each alert type, which adds cost and produces inconsistent investigation depth across different domains. Specialized agents with a fixed methodology produce consistent results at predictable token cost. A macOS forensics agent, for example, always follows the same process tree and ancestry trace steps. A broad agent is the right tool for analyst-led interactive investigation. For automated pipelines running hundreds of times a day, specialization produces better results.

Why use multiple specialized AI agents for alert triage instead of one general-purpose agent?

An experienced analyst investigating a complex alert manually typically spends 30 minutes or more gathering context before making a verdict. The automated pipeline described here completes the same investigation in a few minutes, including enrichment across more than 20 data sources, Initial Triage, Specialized agent forensic investigation per domain, and a Final Review synthesis report. High-confidence false positives close automatically at around 50,000 tokens with no analyst involvement.

How much faster is automated alert triage compared to manual investigation?

Yes. The pipeline can be configured to use a model hosted on your own infrastructure, keeping all data and inference within your own network. This is suitable for airgapped environments or organizations with strict data residency requirements. The Elastic Inference Service supports both cloud-hosted and self-managed model endpoints.

Can I run automated alert triage without sending data to a cloud AI service?

AI triage is only as good as the enrichment data it receives. Tag-based triage routing depends on detection engineers keeping rule tags current. A rule without the correct triage tag will skip some checks. Threshold alerts require a dedicated enrichment path because they lack the raw event fields that standard enrichment queries rely on. The system can also miss edge cases that a human analyst would catch through contextual judgment, so every automated closure should leave an auditable trail.

What are the main limitations of AI-based alert triage?

Every automated closure leaves a tagged audit trail: a reason code (Closed: Infra IP, Closed: New Employee, or the Initial Triage / Final Review verdict) and a timeline note on the alert. Analysts can review any closed alert and its reasoning at any time. The three-tier architecture adds multiple checkpoints: the Initial Triage agent only closes high-confidence false positives, and the Final Review agent only closes cases after reviewing all Specialized agent findings, which reduces the chance of a true positive being auto-closed. All tags are searchable and can be used to generate metrics and alerting.

What happens when the automated triage pipeline closes an alert incorrectly?

Alert triage in under 3 minutes with Elastic's agentic SOC

Inside Elastic InfoSec's agentic SOC: cutting alert triage from 30 minutes to under 3

This article details the internal Elastic Infosec team's process to optimize our endpoint data collection using Event Filtering and Advanced Policy Settings in Elastic Defend.

The environment: Worldwide Distributed Workforce

Step 1: Identifying the Noise

Step 2: Precise Event Filtering

Filter example 1: Elasticsearch file noise

Filter example 2: Linux Logfile modifications

Step 3: Optimizing Performance at the Source

Event Aggregation

Results

Conclusion

How Elastic Infosec Optimizes Defend for Cost and Performance

Learn how to automate detection rule tuning requests in Elastic Security. This guide shows how to add custom fields to Cases, create a rule to detect tuning needs, and use a webhook to create a frictionless feedback loop between analysts and detection engineers.

Author

Aaron Jewitt

Articles

Inside Elastic InfoSec's agentic SOC: cutting alert triage from 30 minutes to under 3

How Elastic Infosec Optimizes Defend for Cost and Performance

Automating detection tuning requests with Kibana cases