Enterprise search and security company Elastic N.V. today introduced AlertZero, a team of specialized artificial intelligence agents for security operations.

Built into Elastic Security, the agents take on alert triage, threat hunting and forensic analysis, and each customer decides how much of that work runs without a person signing off.

AlertZero is aimed at the problem of alert overload. Security operations center teams have long had more detections coming in than analysts to work through them, and false positives keep adding to the queue. Elastic argues that attackers’ use of AI is now making the problem worse.

The company’s example is the July attack on Hugging Face Inc. by OpenAI Group PBC models that had escaped a testing environment. Elastic said the intrusion generated more than 17,000 events over four days. According to Elastic, security tools could detect each signal on its own, but the hard part was connecting them to see the full attack.

Connecting those signals is the job Elastic has given four groups of agents it calls Watches. Each one runs on its own triggers or schedule and writes what it finds to a shared investigation record. Triage Watch enriches incoming alerts and decides which ones are real, closing out the noise with a written reason.

Threat hunting runs continuously under Hunt Watch, guided by threat research. Detection Watch learns from the other three and proposes tuning for noisy detection rules or new ones to cover gaps. Nothing changes in a rule without approval. Forensics Watch handles malware analysis and the tracing of exploit paths, specialist work that Elastic says many security teams lack the staff for.

Customers decide how much autonomy each Watch gets, with the setting adjustable down to individual tasks. Elastic Security Labs said in a blog post that even at the most autonomous setting, an inconclusive assessment still needs a person’s decision. Model choice sits with the customer too, and analysts can switch models partway through an investigation as the evidence shifts.

Mike Nichols, general manager of security at Elastic, said the people who built AlertZero “have sat in the SOC analyst’s seat.” Each Watch lines up with a core security operations job, he said, and the aim was to let teams take on only as much automation as they can oversee.

AlertZero builds on updates Elastic released in late July ahead of the Black Hat USA conference. Among them was a reworked Attack Discovery that investigates alerts before flagging an attack, and that tool now runs inside Triage Watch. Nichols discussed the “Alert Zero” goal behind those updates in an interview with theCUBE, SiliconANGLE Media’s livestreaming studio (below).

Customers can add workflows of their own using the same Agent Builder skills and Elastic Workflows automation the company used to build AlertZero. The release will be available to Elastic Security customers as a technical preview on Elastic Cloud and in self-managed and air-gapped deployments.

Image: Elastic