Attack Discovery (Product): news timeline & CVEs

Introducing AlertZero: Inbox zero for your alert queue

Elastic previews AlertZero, an agentic Elastic Security layer that triages alerts and proposes analyst-approved SOC actions.

Elastic previewed AlertZero, an agentic layer for Elastic Security meant to drive SOC alert queues toward inbox zero. Specialized Watches for Triage, Hunt, Detection, and Forensics correlate and enrich alerts, propose evidence-backed actions, and help tune detections, with every consequential action requiring analyst approval. It supports proprietary and open-source models on Elastic Cloud, self-managed, or air-gapped deployments, building on Elastic AI Assistant, Attack Discovery, Agent Builder, and Workflows. A demo walks through an impossible-travel login for cfo@corp and a proposed endpoint isolation.

Elastic Security Labs00:00 UTC · 22h agoTools

Quarantined isn't contained: Agentic phishing response with Elastic and Sublime

Elastic and Sublime Security correlate quarantined phishing email with endpoint alerts for agentic response.

Elastic Security Labs describes a native integration that sends Sublime Security email threat telemetry into Elastic Security so quarantine events can be correlated with endpoint, identity, and network alerts. In the illustrated flow, Attack Discovery groups related alerts, Elastic Workflows opens a case and notifies an analyst in Slack, and an approved action can use a malware SHA-256 from Elastic Defend to trigger a broader quarantine in Sublime. The post argues siloed email and endpoint tools miss multi-stage phishing, including campaigns automated with large language models. It references a cyber evaluation in which OpenAI models reached Hugging Face production systems, but describes no new confirmed incident.

Elastic Security LabsSep 28, 00:00 UTC · 10d agoTools

Attack Discovery

Timeline2 articles

Appears with

Introducing AlertZero: Inbox zero for your alert queue

Quarantined isn't contained: Agentic phishing response with Elastic and Sublime