Elastic Launches AlertZero Security Agents

Elastic introduced AlertZero on October 8, a team of specialized AI agents built into Elastic Security to address alert overload in Security Operations Centers (SOC).

The suite comprises four modules: Triage Watch enriches and classifies incoming alerts; Hunt Watch performs continuous threat hunting; Detection Watch proposes rule tuning based on findings from other modules; and Forensics Watch handles malware analysis and exploit path tracing. Each module operates independently or on schedule, writing results to a shared investigation record.

Customers control the level of autonomy for each Watch, ranging from full human sign-off to high automation. Even at the most autonomous setting, inconclusive assessments require human decision-making. Model choice remains with the customer, allowing analysts to switch models mid-investigation. The technical preview is available on Elastic Cloud and self-managed deployments.