Elastic (NYSE: ESTC) has introduced AlertZero, a set of AI agents built into Elastic Security that automates portions of the security operations center (SOC) workflow, including alert triage, threat hunting, investigation, detection tuning, and forensic analysis.

AlertZero is organized around units called Watches, each covering a defined area of security operations. Triage Watch filters and escalates alerts, Hunt Watch conducts continuous threat hunting, Detection Watch proposes rule adjustments without making changes without approval, and Forensics Watch handles malware analysis and exploit path examination.

The product is entering Technical Preview and will be available to Elastic Security customers across Elastic Cloud, self-managed, and air-gapped deployments. It is compatible with multiple AI models and runs on Elastic's data foundation, which includes structured and unstructured data, logs, and metrics.

Analysts retain control over which actions are automated and which require human review, according to the company's press release statement.

"What makes AlertZero different is that our team who built it have sat in the SOC analyst's seat," said Mike Nichols, general manager of Security at Elastic. "We focused on building a platform that gives teams enough visibility and control to deploy agentic automation at the scale and scope they can handle effectively."

AlertZero builds on existing Elastic Security capabilities, including Attack Discovery, ES|QL, Agent Builder, and Elastic Workflows. Customers can extend the system using the same tools Elastic used to build it.