Threat Research

From Alert Fatigue to Agentic Response: How Workflows and Agent Builder Close the Loop — Elastic Security Labs

Elastic.co
From Alert Fatigue to Agentic Response: How Workflows and Agent Builder Close the Loop — Elastic Security Labs

Elastic introduces Agent Builder and Elastic Workflows to create an autonomous SOC by combining probabilistic agents (the “Brain”) with deterministic automation (the “Hands”) to scale triage and response. The integration automates alert enrichment, triage, human-in-the-loop investigations, and safe containment actions for incidents such as BlackCat/ALPHV. #BlackCat #Elastic

Keypoints

  • Security operations face exponential data growth and expanding attack surfaces while team capacity remains linear, making manual alert chasing unsustainable.
  • Elastic positions the SOC as an operational nervous system with Senses (data), a Brain (Agent Builder AI), and Hands (Elastic Workflows) to coordinate detection and response.
  • Agent Builder provides probabilistic, reasoning-based agents that plan and adapt; Elastic Workflows provide deterministic, auditable automation for repeatable actions.
  • Combining Agents and Workflows enables Workflows to call Agents for complex analysis and Agents to invoke Workflows as safe tools for executing actions.
  • Automated triage use case: correlates alerts into an Attack Chain, enriches entities, invokes a Triage Agent, and produces a Tier 2-ready case, reducing mean-time-to-triage from ~30 minutes to under 2 minutes.
  • Human-in-the-loop and containment use cases: agents can orchestrate operational tasks (PagerDuty, Slack) and present planned actions (e.g., host isolation via Elastic Defend) before deterministic workflows execute them for safety and auditability.

MITRE Techniques

Indicators of Compromise

  • [Host ] Example host used in scenarios and decision points – host123
  • [Malware/Threat Actor ] Malware/threat actor referenced as a use case – BlackCat/ALPHV
  • [File hash ] File hashes are cited as entities enriched and looked up against threat intel, but no specific hashes were disclosed – none provided
  • [Threat intelligence source ] Enrichment sources used for IOC lookup and correlation – VirusTotal, and other threat intel sources
  • [Case / Collaboration artifact ] Automation creates case and channel artifacts for incidents – Case (AI-generated investigation), Slack channel #incident-982

Read more: https://www.elastic.co/security-labs/from-alert-fatigue-to-agentic-response