Elastic Security (Product): news timeline & CVEs

Making Threat Intelligence Work for SOC Teams: ANY.RUN & Elastic Webinar Insights

ANY.RUN and Elastic recapped a webinar on using threat intelligence feeds inside Elastic Security workflows.

ANY.RUN published a recap of a joint webinar with Elastic on using threat intelligence in SOC workflows. CTO Dmitry Marinov and Elastic architect Tammy Torbert described feeding validated indicators from ANY.RUN into Elastic Security for alert correlation and triage. The post also promotes sandbox pivots, YARA search, and threat reports, citing use by more than 16,000 organizations and 700,000 professionals. It is a product marketing recap and does not disclose a new incident or vulnerability.

ANY.RUN07:46 UTC · 15h agoIndustry 4 sources

Introducing AlertZero: Inbox zero for your alert queue

Elastic previews AlertZero, an agentic Elastic Security layer that triages alerts and proposes analyst-approved SOC actions.

Elastic previewed AlertZero, an agentic layer for Elastic Security meant to drive SOC alert queues toward inbox zero. Specialized Watches for Triage, Hunt, Detection, and Forensics correlate and enrich alerts, propose evidence-backed actions, and help tune detections, with every consequential action requiring analyst approval. It supports proprietary and open-source models on Elastic Cloud, self-managed, or air-gapped deployments, building on Elastic AI Assistant, Attack Discovery, Agent Builder, and Workflows. A demo walks through an impossible-travel login for cfo@corp and a proposed endpoint isolation.

Elastic Security Labs00:00 UTC · 22h agoTools

Quarantined isn't contained: Agentic phishing response with Elastic and Sublime

Elastic and Sublime Security correlate quarantined phishing email with endpoint alerts for agentic response.

Elastic Security Labs describes a native integration that sends Sublime Security email threat telemetry into Elastic Security so quarantine events can be correlated with endpoint, identity, and network alerts. In the illustrated flow, Attack Discovery groups related alerts, Elastic Workflows opens a case and notifies an analyst in Slack, and an approved action can use a malware SHA-256 from Elastic Defend to trigger a broader quarantine in Sublime. The post argues siloed email and endpoint tools miss multi-stage phishing, including campaigns automated with large language models. It references a cyber evaluation in which OpenAI models reached Hugging Face production systems, but describes no new confirmed incident.

Elastic Security LabsSep 28, 00:00 UTC · 10d agoTools

How a team of entity maintainers monitors, connects and scores entities in Elastic Security

Elastic Security explains how background 'maintainer' jobs build user, host and service entities from raw logs and drive identity resolution and risk scoring.

Elastic Security Labs describes the internal background jobs, called maintainers, that each own one piece of every user, host and service record in Elastic Security. The maintainers construct entities from raw logs, resolve identities across sources and compute risk scores, and the write-up explains how the team keeps this entity machinery consistent.

Elastic Security LabsAug 24, 00:00 UTC · Aug 24, 2026Tools

Elastic Security

Timeline4 articles

Appears with

Making Threat Intelligence Work for SOC Teams: ANY.RUN & Elastic Webinar Insights

Introducing AlertZero: Inbox zero for your alert queue

Quarantined isn't contained: Agentic phishing response with Elastic and Sublime

How a team of entity maintainers monitors, connects and scores entities in Elastic Security