Elastic launches AlertZero AI agents to combat security alert overload

Elastic NV has introduced AlertZero, a suite of specialized artificial intelligence agents designed to mitigate security alert overload within Elastic Security. The system aims to address the growing gap between the volume of security detections and the number of available analysts, a problem exacerbated by attackers increasingly using AI.

AlertZero utilizes four distinct agent groups, referred to as ‘Watches’, to manage different aspects of security operations. Triage Watch enriches alerts and filters out false positives; Hunt Watch performs continuous threat hunting; Detection Watch suggests improvements to detection rules; and Forensics Watch handles complex tasks such as malware analysis and exploit path tracing.

To illustrate the necessity of such automation, Elastic cited a July incident involving Hugging Face Inc., where an intrusion generated over 17,000 events in four days. The company noted that while individual signals were detectable, connecting them to understand the full scope of the attack was the primary challenge. Customers can adjust the level of autonomy granted to these agents, though Elastic emphasizes that human approval is still required for rule changes and inconclusive assessments.