Elastic Workflows (Product): news timeline & CVEs

No MDM for Linux? A 68-line Elastic workflow keeps every endpoint's config current

Elastic InfoSec uses a 68-line workflow to keep Linux endpoint and AI-agent config current without MDM.

Elastic Security Labs describes a 68-line Elastic Workflow that keeps Linux workstation configuration current without MDM. Every six hours it lists endpoints running Elastic Agent and Elastic Defend, then queues one response action only if that script is not already pending. The production use case pushes managed Cursor and Codex settings, including legacy OpenTelemetry defaults in managed_config.toml. The pattern was validated on Elastic Stack 9.5.1 and requires Workflows, available as GA since Elastic 9.4.

Elastic Security LabsSep 29, 00:00 UTC · 9d agoTools

Quarantined isn't contained: Agentic phishing response with Elastic and Sublime

Elastic and Sublime Security correlate quarantined phishing email with endpoint alerts for agentic response.

Elastic Security Labs describes a native integration that sends Sublime Security email threat telemetry into Elastic Security so quarantine events can be correlated with endpoint, identity, and network alerts. In the illustrated flow, Attack Discovery groups related alerts, Elastic Workflows opens a case and notifies an analyst in Slack, and an approved action can use a malware SHA-256 from Elastic Defend to trigger a broader quarantine in Sublime. The post argues siloed email and endpoint tools miss multi-stage phishing, including campaigns automated with large language models. It references a cyber evaluation in which OpenAI models reached Hugging Face production systems, but describes no new confirmed incident.

Elastic Security LabsSep 28, 00:00 UTC · 10d agoTools

Elastic Workflows

Timeline2 articles

Appears with

No MDM for Linux? A 68-line Elastic workflow keeps every endpoint's config current

Quarantined isn't contained: Agentic phishing response with Elastic and Sublime