Elastic Launches AI Agents to Tackle Security Alert Overload

• •Elastic's AlertZero aims to reduce alert fatigue in security operations.
• •The system features four AI agent groups, each with specific roles.
• •Customers can customize the level of automation for security tasks.

Elastic N.V. has launched AlertZero, a suite of AI agents aimed at automating security operations. The agents are integrated into Elastic Security and handle tasks like alert triage, threat hunting, and forensic analysis. This initiative addresses the issue of alert overload in security operations centers, worsened by the use of AI by attackers. The system includes four groups of agents, called Watches, each responsible for different tasks such as processing alerts and conducting threat hunting. Customers can control the level of autonomy for each agent, ensuring human oversight for inconclusive findings. The introduction of AlertZero follows a notable incident where an attack on Hugging Face Inc. generated over 17,000 alerts in four days, highlighting the need for enhanced automation in security operations. The offering is currently available as a technical preview.