Elastic's Attack Discovery Now Investigates Alerts Before It Flags Them

Elastic's Attack Discovery Now Investigates Alerts Before It Flags Them

Security
Elastic Security 9.5 bundles three pieces of automation together and hands the alert-closing decision to an agent for the first time.
By Shashi Bellamkonda · August 3, 2026
3 AI capabilities Elastic is shipping together in Elastic Security 9.5 to move SOC teams toward what it calls Alert Zero.
Key Takeaway
Attack Discovery no longer waits for an analyst to ask it to look. It now hunts raw events, checks entity risk, and drafts detection rules on its own, with auto-close and rule creation gated behind settings a SOC manager controls, not the model.

Nine-oh-five on a Monday is when the second wave of alerts lands, right as an analyst finishes closing out the first. Elastic's own security team uses that scene to frame the problem Attack Discovery was rebuilt to solve, and on July 31, 2026, the company shipped the fix inside Elastic Security 9.5 (Elgut, 2026).

Attack Discovery Stops Waiting to Be Asked

For two years, Attack Discovery did one job: pull related alerts into a single view so an analyst did not have to piece the story together by hand. In 9.5, it does the piecing itself. The tool hunts raw events beyond the alerts that triggered it, checks entity risk scores for the users and hosts involved, and pulls in evidence from other data sources before it will call anything a validated attack (Elgut, 2026).

Elastic frames the payoff in blunt terms. "Security teams are not losing because they lack tools," said Mike Nichols, Elastic's general manager for security, arguing the real cost sits in alerts that should not have qualified as alerts at all (Elastic, 2026). When Attack Discovery's investigation turns up a gap in existing detection coverage, it drafts a new rule in Elasticsearch Query Language and routes it to an analyst. Nothing gets added to production without a human clicking approve.

Auto-Close Is a Setting, Not a Default

A companion feature, Security alert analysis, runs ahead of Attack Discovery and filters likely false positives before they ever reach investigation. A SIEM engineer or SOC manager picks which detection rules feed the workflow, sets a confidence threshold, and decides whether the system can close an alert on its own or only tag it for review. Auto-close ships off. Elastic's guidance to customers is to start with tags and notes, compare the model's calls against how a human analyst would have handled the same queue, and only flip auto-close on once the pattern holds (Elgut, 2026).

That sequencing matters more than the feature list.

This Is Elastic's Third Run at the Same Problem in Fourteen Months

Elastic acquired Keep Alerting in May 2025 for alert deduplication and workflow-as-code remediation, then acquired Deductive AI in July 2026 for the same investigate-the-root-cause pattern applied to production engineering incidents rather than security alerts (Azarmi, 2026). Attack Discovery's 9.5 rebuild is the third version of that same idea, this time built natively rather than bought. Elastic is assembling the same capability, autonomous investigation before a human sees the queue, in parallel across two different domains at once. Whether that consolidates into one investigation engine or stays as three separate products wearing the same pitch is still an open question the roadmap has not answered.

The Endpoint Side Got Faster Too

Elastic Defend now generates and deploys YARA rules against vulnerable-driver exploits automatically, the technique attackers use to reach the kernel through signed drivers with known flaws. Elastic points to network propagation under a minute as the reason the response has to be automatic rather than reviewed (Elastic, 2026). Windows on ARM devices, including Surface laptops, get the same endpoint coverage as the rest of a fleet, at no additional per-device cost. Elastic Workflows, the automation layer stitching all of this together, adds plain-language workflow generation, version history with one-click rollback, and human-in-the-loop approval routing into tools like Slack.

Key Takeaway
Elastic built the governance gate into the product: confidence thresholds, staged autonomy, and required approval on new detection rules. Whether a given SOC actually uses those gates, or races to flip auto-close for the sake of a shorter queue, is a decision Elastic handed to the customer.

Elastic has not published production numbers on how much a real SOC's queue shrinks once these pieces run together. What exists so far is the vendor's own framing of the problem and the mechanics of the fix, not a customer's before-and-after alert count.

CIO/CTO Viability Question
Before your SOC manager enables auto-close on a single rule, get a written answer to one question: which alert categories qualify as high-confidence false positives, and who reviews the log when the model's definition of "high confidence" drifts six months in.

Azarmi, Baha. "Elastic and Deductive AI Join Forces to Accelerate Agentic Incident Investigation for Engineering Teams." Elastic Blog, 22 July 2026, elastic.co.

Elastic. "Elastic Advances the Agentic SOC, Bringing Security Teams Closer to Alert Zero." Elastic, 31 July 2026, elastic.co.

Elgut, David. "Alert Zero: AI-Driven Alert Triage and Attack Investigation for the Agentic SOC." Elastic Security Labs, 31 July 2026, elastic.co.
Disclaimer: This blog reflects my personal views only. Content does not represent the views of my employer, Info-Tech Research Group. AI tools may have been used for brevity, structure, or research support. Please independently verify any information before relying on it.