Advisories
Elastic Releases v0.1.0 Agent Skills to Auto‑Provision Security Projects and Sample Data
Elastic has launched the first public version of its Agent Skills, letting AI coding agents create Elastic Security projects and inject realistic, ECS‑compliant sample data. Security teams can now spin up a fully populated environment from the IDE and validate detection rules against four MITRE ATT&CK‑mapped attack scenarios.
What happened
Elastic has released the first public version (v0.1.0) of its Agent Skills for AI coding agents, enabling automated provisioning of Elastic Security projects and injection of realistic, ECS‑compliant sample data.
Impact
- Security teams can spin up a fully populated Elastic Security environment from within their IDE.
- Sample data covers four attack scenarios—Windows ransomware, credential harvesting, AWS privilege escalation, and Okta MFA deactivation—each mapped to MITRE ATT&CK techniques.
- Open‑source skills can be extended or customized for internal tooling.
What to do
- Use an AI coding agent (e.g., Cursor, Claude Code, GitHub Copilot) and invoke the
create-projectskill to provision an Elastic Cloud Serverless Security project. - Run the
generate-security-sample-dataskill to populate the project with synthetic alerts and process trees. - Review the generated alerts in Kibana, validate detection rules, and adjust as needed.
- Consult the documentation for security considerations, especially credential handling and API permissions.
Security considerations
Ensure that the AI agent’s API key is stored securely and that the Elastic Cloud Serverless project is scoped to the minimal required permissions. Review the sample data for any sensitive fields before using in production.
Related articles
GitLab 16.9.8 Patch Release: Bug Fixes, No Security Updates
On May 9 2024 GitLab released 16.9.8 for Community and Enterprise Editions. The update addresses regressions and bugs but contains no security fixes. Defenders should apply the patch, review the auto‑reconfigure behavior, and use /etc/gitlab/skip‑auto‑reconfigure to avoid downtime in multi‑node setups.
Read briefing
CrowdStrike Introduces On‑Device AI Data Classification in Falcon Data Security
CrowdStrike has added on‑device AI‑powered data classification to Falcon Data Security, leveraging Intel‑based dedicated AI hardware. The feature classifies sensitive data in real time without sending payloads to the cloud. Security teams should update to the latest Falcon agent, enable the new classification policy, and monitor classification logs for anomalies.
Read briefing
Elastic Launches Bounty Program for SIEM/EDR Rule Validation
Elastic has expanded its public bounty program to invite researchers to test and improve its SIEM and EDR detection rules on Windows endpoints. The initiative targets security teams using Elastic Security, encouraging them to review rule efficacy and report gaps. Defenders should monitor the HackerOne portal, review rule documentation, and incorporate findings into their detection strategy.
Read briefing
Elastic InfoSec Slashes SOC Costs 5× with Specialized Agent Workflow
Elastic InfoSec ran a head‑to‑head test of two agentic SOC models across 36,822 real alerts. A single, multi‑skill agent cost $3.42 per investigation, while a fleet of domain‑specific agents trimmed the bill to just $0.69—a 5.7× savings. At 100 alerts a day that translates to an $8,000 monthly cut. The post explains the two architectures, why the specialized workflow wins, and when each model is the right fit for your security ops budget.
Read briefing