Elastic AlertZero deploys AI agents against security alert overload

Elastic has launched AlertZero, a set of specialized AI agents built into Elastic Security to tackle alert overload in security operations centers. Four agent groups called Watches handle triage, threat hunting, detection tuning, and forensic analysis, each writing findings to a shared investigation record. Customers control how much autonomy each Watch receives, down to individual tasks. Even at maximum autonomy, inconclusive assessments require human sign-off. Customers can also choose and switch AI models mid-investigation. AlertZero is available as a technical preview on Elastic Cloud and in self-managed and air-gapped deployments.