Open Security impact: Elastic AI Assistant

Over the past couple of years, we’ve been discussing the benefits of an open and transparent approach to security — the idea that providing public access to details of our detection and prevention capabilities, code, documentation, and more, will bolster the security capabilities we’re able to provide to our customers. In this blog, we’ll be looking at some of the most recent ways our Open Security initiative has impacted our Elastic Security community, specifically with regard to the ever present topic of generative AI and large language models (LLM), such as those provided by OpenAI and Microsoft.

Analyzing the never ending flood of suspicious events can be taxing to the most experienced analysts, and new hires often lack the security experience and institutional knowledge of business environments necessary to quickly triage and respond to threats. Elastic AI Assistant helps new and experienced analysts triage events faster, using information found in our public detection repository, context from alert rules, risk ratings, and MITRE ATT&CK® Tactic and Technique information. Summarizations can even include investigation suggestions based on the specific context of the alert. 

In the screenshot below, Elastic AI Assistant has summarized the “Suspicious DGA DNS Request” alert and provided initial investigation suggestions to analyze the potential implications of this alert.

Well, no, but it can help: 

• Write detection rules 
• Simplify SIEM migrations with fast and accurate rule conversions from other query languages 
• Provide workflow suggestions for things like custom dashboards or ingest pipelines
• Provide suggestions for which Agents to use for ingesting specific sources 

Customizable quick prompts enable our users to save and reuse the prompts that provide the most effective responses. In the example below, the Elastic AI Assistant has built an Event Query Language (EQL) rule from a general use case of detecting “data exfiltration attempts on linux systems.”

Half the battle with generative AI is making sure it’s been trained on the right data. Our commitment to Open Security has made it as easy as possible for our clients to leverage the power of generative AI with the Elastic AI Assistant in their day-to-day operations, boosting the capabilities of novice and experienced users alike. 

Open Security means more to us than just a public GitHub repo. The combination of a common taxonomy to normalize events and alerts, public availability of all things Elastic Security, and the power of generative AI makes new levels of optimization and efficiency possible. Whether its accelerating architecture and migration to shorten ROI time frames, arming every analyst with the context to accelerate triage and reduce MTTR, or enabling novice and expert users alike to simplify daily operations; Open Security is a key component for modernizing your security operations with Elastic.

The release and timing of any features or functionality described in this post remain at Elastic's sole discretion. Any features or functionality not currently available may not be delivered on time or at all.

In this blog post, we may have used or referred to third party generative AI tools, which are owned and operated by their respective owners. Elastic does not have any control over the third party tools and we have no responsibility or liability for their content, operation or use, nor for any loss or damage that may arise from your use of such tools. Please exercise caution when using AI tools with personal, sensitive or confidential information. Any data you submit may be used for AI training or other purposes. There is no guarantee that information you provide will be kept secure or confidential. You should familiarize yourself with the privacy practices and terms of use of any generative AI tools prior to use. 

Elastic, Elasticsearch, ESRE, Elasticsearch Relevance Engine and associated marks are trademarks, logos or registered trademarks of Elasticsearch N.V. in the United States and other countries. All other company and product names are trademarks, logos or registered trademarks of their respective owners.