Loading

AI-augmented workflows

Workflows and Elastic Agent Builder are complementary. Workflows give you deterministic, auditable, event-driven automation: the steps always run in the same order and produce the same kind of result. Elastic Agent Builder agents give you reasoning: the ability to interpret unstructured context, classify signals, and generate natural-language summaries. Combining the two lets you build automation that's both reliable and intelligent.

The integration runs in both directions: a workflow can call an agent as a step, and an agent can trigger a workflow as a tool.

  • Call an agent from a workflow. Use the ai.agent step to invoke any agent built in Elastic Agent Builder. The agent sees the workflow's data through template variables, performs its reasoning, and returns a response that subsequent steps can act on. Refer to Call Elastic Agent Builder agents from Elastic Workflows for the full ai.agent reference and examples.
  • Trigger a workflow from an agent. Create a workflow tool in Elastic Agent Builder and assign it to an agent. The agent can then invoke the workflow from a conversation, extracting the needed inputs from the user's message and surfacing the workflow's output in chat.
  • Send structured prompts to an LLM. Use the ai.prompt step with any configured AI connector to run classification, extraction, or summarization without going through an agent.
  • Use agent-from-workflow when the workflow already knows what it's doing and needs AI only to reason over a specific data set. For example, summarizing an alert, classifying severity, or extracting fields from unstructured text.
  • Use workflow-from-agent when the user (or another agent) is in a conversation and wants to trigger a deterministic procedure. For example, isolating a host, opening a case, or running a set of enrichment queries.