Nine-oh-five on a Monday is when the second wave of alerts lands, right as an analyst finishes closing out the first. Elastic's own security team uses that scene to frame the problem Attack Discovery was rebuilt to solve, and on July 31, 2026, the company shipped the fix inside Elastic Security 9.5 (Elgut, 2026).
Attack Discovery Stops Waiting to Be Asked
For two years, Attack Discovery did one job: pull related alerts into a single view so an analyst did not have to piece the story together by hand. In 9.5, it does the piecing itself. The tool hunts raw events beyond the alerts that triggered it, checks entity risk scores for the users and hosts involved, and pulls in evidence from other data sources before it will call anything a validated attack (Elgut, 2026).
Elastic frames the payoff in blunt terms. "Security teams are not losing because they lack tools," said Mike Nichols, Elastic's general manager for security, arguing the real cost sits in alerts that should not have qualified as alerts at all (Elastic, 2026). When Attack Discovery's investigation turns up a gap in existing detection coverage, it drafts a new rule in Elasticsearch Query Language and routes it to an analyst. Nothing gets added to production without a human clicking approve.
Auto-Close Is a Setting, Not a Default
A companion feature, Security alert analysis, runs ahead of Attack Discovery and filters likely false positives before they ever reach investigation. A SIEM engineer or SOC manager picks which detection rules feed the workflow, sets a confidence threshold, and decides whether the system can close an alert on its own or only tag it for review. Auto-close ships off. Elastic's guidance to customers is to start with tags and notes, compare the model's calls against how a human analyst would have handled the same queue, and only flip auto-close on once the pattern holds (Elgut, 2026).
That sequencing matters more than the feature list.
This Is Elastic's Third Run at the Same Problem in Fourteen Months
Elastic acquired Keep Alerting in May 2025 for alert deduplication and workflow-as-code remediation, then acquired Deductive AI in July 2026 for the same investigate-the-root-cause pattern applied to production engineering incidents rather than security alerts (Azarmi, 2026). Attack Discovery's 9.5 rebuild is the third version of that same idea, this time built natively rather than bought. Elastic is assembling the same capability, autonomous investigation before a human sees the queue, in parallel across two different domains at once. Whether that consolidates into one investigation engine or stays as three separate products wearing the same pitch is still an open question the roadmap has not answered.
The Endpoint Side Got Faster Too
Elastic Defend now generates and deploys YARA rules against vulnerable-driver exploits automatically, the technique attackers use to reach the kernel through signed drivers with known flaws. Elastic points to network propagation under a minute as the reason the response has to be automatic rather than reviewed (Elastic, 2026). Windows on ARM devices, including Surface laptops, get the same endpoint coverage as the rest of a fleet, at no additional per-device cost. Elastic Workflows, the automation layer stitching all of this together, adds plain-language workflow generation, version history with one-click rollback, and human-in-the-loop approval routing into tools like Slack.
Elastic has not published production numbers on how much a real SOC's queue shrinks once these pieces run together. What exists so far is the vendor's own framing of the problem and the mechanics of the fix, not a customer's before-and-after alert count.
Elastic. "Elastic Advances the Agentic SOC, Bringing Security Teams Closer to Alert Zero." Elastic, 31 July 2026, elastic.co.
Elgut, David. "Alert Zero: AI-Driven Alert Triage and Attack Investigation for the Agentic SOC." Elastic Security Labs, 31 July 2026, elastic.co.
