Elastic's InfoSec team runs three agents that read the detection rule's investigation guide and the closure reasons on 30 days of past cases. Analysts now clear most alerts with a single click in Slack.

Customer Zero: Running Agent Builder in our own SOC

When your AI SOC analyst is wrong 40% of the time

Leading with the data

What context AI alert triage actually needs

When should you use an AI agent instead of a query?

Investigation guide lookup: Per-rule triage instructions

The user details lookup: Finding high-risk users

Past cases by rule name: What verdict did the analyst choose?

The AI feedback loop: How agents learn from wrong verdicts

How the agentic SOC pipeline runs in Elastic Workflows

Pattern agent: Finding patterns across closed cases

L1 Investigation Agent: Gathering evidence and reaching a verdict

Summarizer Agent: Writing the case comment that analysts read

Frequently asked questions

What to build after L1 triage automation

Inside the agentic SOC Elastic's InfoSec team runs in production: the three-agent pipeline, the analyst feedback loop, and the one-button close in Slack.

Agentic SOC alert triage: 60% to 92% AI accuracy

Inside Elastic's agentic SOC: How we took AI alert triage from 60% to 92% accuracy

Author

Maggie Musquez

Articles

Inside Elastic's agentic SOC: How we took AI alert triage from 60% to 92% accuracy