Elastic changes the SIEM game with AI-driven security analytics

Traditional SIEMs have heavily relied on the human behind the screen for success. Alerting, dashboarding, threat hunting, and finding context among a deluge of signals are all very human-intensive. Search AI will upend this old model and replace the traditional SIEM with an AI-driven security analytics solution for the modern SOC. Imagine a system that sifts through all of your data, ignoring the noise and identifying what’s critical, discovering specific attacks, and crafting specific remediations. Powered by the Elastic Search AI Platform, Elastic Security is delivering on this evolution, replacing largely manual processes for configuration, investigation, and response. The Search AI platform uniquely combines search and retrieval augmented generation (RAG) to provide hyper-relevant results that matter.

Since the release of Elastic Security for SIEM in 2019, the solution has grown to include some of the industry’s most advanced analytics capabilities, including 100+ prebuilt ML-based anomaly detection jobs to detect previously unknown threats fast. Elastic introduced Elastic AI Assistant for Security last year to help SOC analysts with rule authoring, alert summarization, and workflow and integration recommendations. IDC recently highlighted how Elastic overcomes these limitations in an IDC Market Perspective on their impressions of AI Assistant.

Co-pilots like AI Assistant are fast becoming table-stakes for many types of security products. As such, these early efforts still depend on the ability of the analyst to use them effectively. It is now time to integrate AI guidance and automation into the core investigative workflows of the SOC. Today, we are ushering in a new AI feature, Elastic Attack Discovery (patent pending), powered by the Elastic Search AI Platform. Attack Discovery triages hundreds of alerts down to the few attacks that matter with a single button click and returns results in an intuitive interface, allowing security operations teams to quickly understand the presented attacks, take immediate follow-up actions, and more.

Elastic’s AI-driven security analytics is built on the Search AI platform, which includes RAG powered by the industry's foremost search technology. Large language models (LLMs) are only as accurate and current as the information they leverage: their underlying training data and the context provided with the prompt. As such, they require rich, up-to-date data to deliver accurate, tailored results — and efficiently gathering this confidential knowledge requires search. Search-based RAG delivers this context automatically and eliminates the need to build a bespoke LLM and constantly retrain it on ever-changing internal data.

Attack Discovery uniquely leverages the Search AI platform to sort and identify which alert details should be evaluated by the LLM. By querying the rich context contained within Elastic Security alerts with the hybrid search capabilities of elasticsearch, the solution retrieves the most relevant data to provide to the LLM and instructs it to identify and prioritize the few attacks accordingly. This includes data such as host and user risk scores, asset criticality scores, alert severities, descriptions, alert reasons, and more. 

“As a lean organization, we do not operate a traditional SOC team, so the ability to secure our assets faster using our existing team and generative AI is very exciting," said Kadir Burak Mavzer, Cloud Security team lead at Bolt. "We've already seen great results with Elastic AI Assistant and are looking forward to using Attack Discovery soon.”

“The attacks companies face are as constant as they are sophisticated, and with no lever to slow the deluge of signals, most security teams struggle to keep their heads above water,” said Santosh Krishan, general manager of Security at Elastic. “Nearly 20% of our security customers already use our AI Assistant to boost team efficiency. Similarly, Attack Discovery will power productivity and supplement practitioner knowledge to speed up threat detection, investigation, and response. It helps your people — and SOC — succeed.”

The release and timing of any features or functionality described in this post remain at Elastic's sole discretion. Any features or functionality not currently available may not be delivered on time or at all.

In this blog post, we may have used or referred to third party generative AI tools, which are owned and operated by their respective owners. Elastic does not have any control over the third party tools and we have no responsibility or liability for their content, operation or use, nor for any loss or damage that may arise from your use of such tools. Please exercise caution when using AI tools with personal, sensitive or confidential information. Any data you submit may be used for AI training or other purposes. There is no guarantee that information you provide will be kept secure or confidential. You should familiarize yourself with the privacy practices and terms of use of any generative AI tools prior to use. 

Elastic, elasticsearch, ESRE, elasticsearch Relevance Engine and associated marks are trademarks, logos or registered trademarks of elasticsearch N.V. in the United States and other countries. All other company and product names are trademarks, logos or registered trademarks of their respective owners.