AlertZero gives Elastic Security customers a team of agents that continuously triage, hunt, and investigate, automating the SOC lifecycle so teams can keep pace with a new generation of high-volume, high-velocity threats. Elastic announces AlertZero team specialized AI agents for security operations lifecycle.
AlertZero gives Elastic Security customers a team of agents that continuously triage, hunt, and investigate, automating the SOC lifecycle so teams can keep pace with a new generation of high-volume, high-velocity threats.
Security teams face the same persistent bottleneck: alert volume has outpaced the analysts available to work through it, and false positives add to a queue that was already too large to clear. As attackers' use of AI evolves, new problems keep compounding this issue. In a recent high-profile attack, an autonomous AI agent generated more than 17,000 events across a production environment in only four days, moving from a dataset-pipeline exploit to credential theft and lateral movement. The individual signals were detectable, but understanding the attack required connecting them.
That is exactly what AlertZero was built for. It continuously correlates and investigates activity while helping teams reduce false positives that clog the alert queue, with the flexibility to adapt as threats evolve.
AlertZero organizes that work around Watches: specialized named groups of agents with defined responsibilities that run on triggers and schedules. Each Watch focuses on a specific area of security operations and carries its findings into a shared investigation record:
Triage Watch pares down the alert queue through enrichment, decides true or false, closes the noise with a reason, and escalates the real alerts.
Hunt Watch handles the legwork by continuously threat hunting, driven by what runs in it and what the threat research says.
Detection Watch learns from the other Watches: proposes tuning for noisy rules and new rules for gaps. It will not change a rule without approval.
Forensics Watch provides specialist depth for forensics, malware analysis, and exploit paths when work requires skills a typical SOC may not have on staff.
Security investigations rarely stay inside one data source or one model. Analysts may need to change models as an investigation develops, based on the task and the evidence they are working with — a flexibility many AI security tools can't offer. AlertZero is designed to provide that flexibility. It runs on Elastic's full data foundation, including structured and unstructured data, logs, and metrics, and works with whatever model an organization chooses across Elastic Cloud, self-managed, or air-gapped deployments.
"What makes AlertZero different is that our team who built it have sat in the SOC analyst's seat," said Mike Nichols, general manager, Security, Elastic. "We focused on building a platform that gives teams enough visibility and control to deploy agentic automation at the scale and scope they can handle effectively. Every Watch in AlertZero aligns directly with key SOC responsibilities, and the level of autonomy is customizable for each Watch. Security teams get help where they need it most, with the model and deployment that are most effective for their needs."
Customers can extend AlertZero using the same Agent Builder skills and Elastic Workflows that Elastic used to build it, adding workflows specific to their environment without leaving the platform.
Availability
AlertZero will be available to Elastic Security customers as a Technical Preview in Elastic Cloud, self-managed, and air-gapped environments. It builds on existing Elastic Security capabilities, including Attack Discovery, ES|QL, Agent Builder, and Elastic Workflows.
About Elastic
Elastic integrates deep expertise search technology AI help everyone transform all data into answers actions outcomes Elasticsearch foundation search observability security solutions used thousands companies including 75% Fortune 100.
