Source: Elastic Security Labs (Aaron Jewitt) — 2026-07-02
Summary
Elastic's internal InfoSec team documented how they built a set of specialized AI agents on Elastic Workflows and Agent Builder to automate security-alert triage, cutting median investigation time from roughly 30 minutes to under 3. Deterministic ES|QL queries close obvious false positives at zero token cost before any LLM call happens, and a "Final Review" agent writes verdicts directly into Kibana Cases.
Key Takeaways
- The pipeline deliberately separates deterministic, cheap filtering (ES|QL queries) from LLM-based reasoning, only spending tokens on genuinely ambiguous alerts.
- A dedicated "Final Review" agent is the single writer of verdicts into Kibana Cases, giving the system one accountable decision point rather than diffuse agent outputs.
- Reported result: alert investigation time dropped from ~30 minutes to under 3 minutes on their own production SOC traffic.
- A concrete, self-reported production case study of multiagent orchestration in a security-operations context, not a vendor demo.