Embedding models detect malicious AI agent sessions
Elastic stored Claude and Cursor sessions as vectors and used semantic search to flag one in seven suspicious sessions for triage.
1
Stories per day · 30 days
4 RSS
Relatedai-agents1ai-security1cribl1datadog1dshield1embedding-models1honeypot1http-headers1kibana1log-management1microsoft1sonicwall1splunk1threat-hunting1
23 stories, newest first · one card per story
Stories tagged #elastic
Security log management tools ranked for 2026
Splunk leads for analytics depth while Elastic offers open resource-based pricing in 2026 log management tools.
1
SANS diary uses Kibana to hunt odd HTTP charsets in honeypot logs
A DShield honeypot logged about 960,000 events in three weeks, and Accept-Charset GBK stood out on SonicWall login probes.
Elastic security advisory (AV26-1021)
Canada's Cyber Centre warns Elasticsearch and Kibana users to install Elastic updates ESA-2026-185 and ESA-2026-187.
Making Threat Intelligence Work for SOC Teams: ANY.RUN & Elastic Webinar Insights
ANY.RUN and Elastic recapped a webinar on using threat intelligence feeds inside Elastic Security workflows.
Elastic Patches 14 Security Flaws, Including One Enabling Cross-Tenant Data Interception
Elastic patched 14 flaws, including a Kibana bypass that can intercept another tenant's data.
8
Introducing AlertZero: Inbox zero for your alert queue
Elastic previews AlertZero, an agentic Elastic Security layer that triages alerts and proposes analyst-approved SOC actions.
SOCRadar Alarms in Elastic | Investigate Threats Faster
SOCRadar says analysts can investigate its alarms inside Elastic and Kibana instead of a separate console.
Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage
Elastic now grades more than 2,100 prebuilt SIEM rules monthly on noise, speed, and threat coverage.
Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage
Elastic explains how it scores 1,781 SIEM detection rules for noise, speed, and threat coverage.
No MDM for Linux? A 68-line Elastic workflow keeps every endpoint's config current
Elastic InfoSec uses a 68-line workflow to keep Linux endpoint and AI-agent config current without MDM.
1
Quarantined isn't contained: Agentic phishing response with Elastic and Sublime
Elastic and Sublime Security correlate quarantined phishing email with endpoint alerts for agentic response.
2
Cloud Threat Emulation on Autopilot: Context is Everything
Elastic outlines a plan-first cloud threat-emulation lifecycle so detections rest on realistic identity, telemetry, and cleanup.
One SOC, 100 projects: running centralized alert triage on Elastic Security Serverless
Elastic validates centralized SOC alert triage using cross-project search across 100 linked Elastic Security Serverless projects with ~2,100 detection rules.
2
KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension
Elastic tracks KREMLIN banking malware that used fake Brazilian bank JavaScript lures to deploy malicious Chrome and Edge extensions on 1,515 systems.
1
Massive Redis Cryptojacking Campaign Hijacks Thousands of Linux Servers
RedisRaider cryptojacking campaign compromises thousands of exposed, unauthenticated Linux Redis servers using cron persistence to deploy XMRig Monero miners.
6
Why 2026 is the Year to Upgrade to an Agentic AI SOC
Elastic Security Labs argues 2026 is the production inflection point for agentic AI in security operations centers.
8
Data access: the hidden cost of security vendor lock-in
Elastic compares SIEM data egress cost, latency, and fidelity across CrowdStrike, Microsoft, Google, and Splunk, arguing vendors engineer lock-in.
2
How to correlate Kubernetes audit logs with container runtime data
Elastic Security Labs shows how to join Kubernetes audit logs with Defend for Containers runtime data to investigate service account abuse and container escapes.
7
REVSTEALER ramps up: analysis of up-and-coming infostealer
Elastic Security Labs analyzes REVSTEALER, an emerging infostealer harvesting browser credentials, cryptocurrency wallets, and gaming accounts.
2
Linux Detection Engineering - Fileless Execution
Elastic Security Labs reproduces five Linux fileless execution patterns, including memfd_create staging and in-memory kernel module loads, and maps each to Elastic Defend rules.
From 88 lines to 1: Detecting DLL hijacking with Elastic Defend
Elastic condenses 88 lines of detection logic into one Elastic Defend 9.5.0 rule catching the DLL hijacking used by a ClickFix campaign.
1
Inside Elastic's agentic SOC: How we took AI alert triage from 60% to 92% accuracy
Elastic's InfoSec team raised AI alert-triage accuracy from 60% to 92% using three self-correcting agents integrated into Slack triage.