Cybersecurity
Elastic Introduces Agent Builder & Workflows to Automate SOC Triage
Elastic Stack now includes Agent Builder and Elastic Workflows, allowing security teams to automate alert triage and response. The combination separates deterministic actions from AI‑driven analysis, reducing analyst toil while maintaining auditability.
What Happened
Elastic released Agent Builder and Elastic Workflows as part of the Elastic Stack to give SOC teams a way to automate triage and response without writing custom scripts.
Impact on Operations
These tools separate deterministic workflow execution from probabilistic AI reasoning. Workflows handle repeatable actions like ticket creation, host isolation, and notification. Agents can analyze alerts, run queries, and decide on next steps, then hand off to a workflow for execution.
How to Deploy
- Enable Elastic Workflows in the Kibana console.
- Build an Agent in Agent Builder that listens for alert events and runs queries against the data layer.
- Configure the agent to call a workflow via the Workflows API when it identifies a high‑confidence threat.
- Set up audit logs and monitoring for workflow runs to maintain compliance.
Practical Steps for Defenders
1. Map your existing playbooks to workflow steps.
2. Create agent templates for common alert types (e.g., ransomware, lateral movement).
3. Test the end‑to‑end loop in a staging environment before production.
4. Use the built‑in analytics to review agent decisions and refine thresholds.
Related articles
CrowdStrike Unveils Agentic SOC: AI-Driven Detection and Response for Modern Threats
CrowdStrike has released the next generation of its Security Operations Center, the Agentic SOC, which leverages on‑device AI and advanced threat intelligence to automate detection, triage, and response. The update introduces Claude integration, real‑time data classification, and enhanced cloud and browser security capabilities. Defenders should evaluate the new Falcon features and enable AI‑powered workflows to reduce alert fatigue and accelerate incident handling.
Read briefing
CrowdStrike & Anthropic Partner to Strengthen AI‑Driven Defense for Critical Infrastructure
CrowdStrike and Anthropic have joined forces to embed Anthropic’s Claude model into the Falcon platform, giving critical infrastructure operators AI‑enhanced continuous authorization and threat detection. The move expands Falcon’s endpoint coverage to OT devices and introduces Agentic SOC capabilities for faster triage. Defenders should update deployments, enable the new AI features, and revise playbooks to leverage real‑time risk scoring.
Read briefing
Elastic Security Accelerates Chrysalis Backdoor Detection with Attack Discovery, Workflows, and Agent Builder
Elastic Security’s Attack Discovery automatically correlates alerts into a single narrative, triggering workflows that use Agent Builder to verify malware, create cases, and notify on‑call staff—all within minutes. This approach cuts analyst response time from hours to minutes for Chrysalis and similar APT attacks.
Read briefing
CrowdStrike Unveils Agentic SOC: AI‑Driven Threat Detection and Response
CrowdStrike has launched the next generation of its Agentic SOC, embedding AI reasoning and on‑device classification into Falcon. The update equips SecOps teams with automated triage, real‑time data labeling, and Claude‑powered audit insights. Defenders should upgrade to Falcon 10.5, enable the Agentic SOC bundle, and review new AI‑driven playbooks.
Read briefing