Elastic Workflows is generally available in 9.4, bringing production-ready security automation with deeper case management integration, human-in-the-loop support, natural language authoring, and more.

Case automation at scale

Human checkpoints in automated Workflows

Building Workflows from natural language

Composable Workflows

Where analysts already work

More control, more flexibility

Reliability and production controls

Licensing and pricing

Getting started

Elastic Workflows is GA in 9.4. Learn how it brings production-ready security automation with case management integration, natural language, and more.

Elastic Workflows GA: Security automation built into your SIEM

Elastic Workflows GA: automation where your security data already lives

A practical guide to building intelligent, automated security playbooks with Elastic Workflows.

The daily loop

Quick orientation

Building a security playbook

Start with the trigger

Check threat intel

Gather context with ES|QL

Branch on findings

Create a case

Notify the team

The complete workflow

Adding AI to the playbook

Classify: let AI drive the branching

Summarize: write case descriptions that adapt

Agent: investigate what the playbook can't

Putting it together

Workflows as agent tools

Open by design

What's here and what's next

Get started

Security Automation with Elastic Workflows: From Alert to Response

Author

Tinsae Erkailo

Articles

Elastic Workflows GA: automation where your security data already lives

Security Automation with Elastic Workflows: From Alert to Response