Elastic improved AI verdict correctness in its SOC from 60% to 92% by enriching agent context with investigation guides, Workday user risk data, and 30 days of past case outcomes for the same detection rule. The post explains how the Agent Brainstorm workflow in Elastic Workflows and Agent Builder uses Pattern Finder, L1 Investigation, and Summarizer agents to generate faster, more trustworthy triage results. #Elastic #AgentBuilder #Workday #Kibana #ESQL
Keypoints
- Elastic’s internal SOC serves as “Customer Zero” and runs the newest Elastic Security and Agent Builder versions in production.
- AI verdict correctness increased from 60% to 92% after adding richer context before agent decisions.
- The main context sources are the detection rule’s investigation guide, Workday user details, and the last 30 days of closed cases for the same rule.
- The agentic pipeline is built in Elastic Workflows and Agent Builder, with one parent workflow orchestrating 12 child workflows and three agents.
- The Pattern Finder Agent analyzes historical case patterns, the L1 Investigation Agent gathers evidence and issues a verdict, and the Summarizer formats the final case comment.
- The system uses feedback from analyst closure reasons and “AI Incorrect?” fields to correct future verdicts and tune prompts.
- After the changes, analysts could trust the AI summary enough to close cases in one step, with Slack and Kibana case updates integrated into the workflow.
MITRE Techniques
- [T1592 ] Gather Victim Host Information – The workflow enriches alert context with host-related and user-related details before triage, including investigation guide, user details, and current event data (‘details about the current event’, ‘host.name’, ‘source_ip, host_name’).
- [T1598 ] Phishing for Information – The article describes using external lookups and enriched context to reason about a user and environment, though no phishing is executed; this is best aligned with information gathering behavior (‘We look up user details in Workday using the user.email field from the alert’).
- [T1082 ] System Information Discovery – The agents collect asset and account context such as user, host, cost center, and job title to determine whether the alert pattern makes sense (‘user_job_title’, ‘cost_center’, ‘HOST: ‘).
- [T1213 ] Data from Information Repositories – The workflow queries prior cases, rule investigation guides, and Workday records to pull stored information for decision-making (‘Past cases by rule name’, ‘we look up user details in Workday’, ‘grab the investigation guide attached to the detection rule’).
- [T1078 ] Valid Accounts – The article discusses identifying high-risk employees and using user identity details from Workday to assess whether activity fits the user type (‘Users who have joined the company in the last 90 days’, ‘Users who are leaving the company in the next 90 days’).
Indicators of Compromise
- [Version] SOC/workflow environment – Elastic Security 9.5.1, Agent Builder
- [Field/Rule Identifiers] alert/rule lookups and case history – kibana.alert.rule.uuid, user.email, user.name, host.name
- [API Endpoints] investigation guide retrieval – /api/alerting/rule/, Slack and Kibana case comment POSTs
- [Query Language] investigation/lookups – ES|QL, Kibana API
- [Time Window] historical case context – last 30 days of past cases, ±5 min correlated-alert pivots
- [Workflow/Agent Names] internal automation components – Agent Brainstorm, Pattern Finder, L1 Investigation, Summarizer
Read more: https://www.elastic.co/security-labs/blog/alert-triage-agentic-soc-self-correcting-agents