---
title: Elastic Agent Builder built-in agents reference
description: Reference of the pre-configured AI agents available in Elastic Agent Builder, including their specialized capabilities and assigned tools.
url: https://www.elastic.co/elastic/docs-builder/docs/3202/explore-analyze/ai-features/agent-builder/builtin-agents-reference
products:
  - Elastic Cloud Serverless
  - Elastic Observability
  - Elastic Security
  - Elasticsearch
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available since 9.3, Preview in 9.2
---

# Elastic Agent Builder built-in agents reference
Built-in agents are pre-configured by Elastic with specific instructions and tools to handle common use cases.
<applies-switch>
  <applies-item title="{ stack: ga 9.4+, serverless: ga }" applies-to="Elastic Cloud Serverless: Generally available, Elastic Stack: Planned">
    The **Elastic AI Agent** is now a standard persisted default agent that is space-aware and modifiable. Refer to [Elastic AI Agent](#elastic-ai-agent) for details.
  </applies-item>

  <applies-item title="{ stack: preview =9.2, ga 9.3 }" applies-to="Elastic Stack: Preview in 9.2">
    You cannot modify or delete built-in agents. To customize one, you can clone it and [create a custom agent](/elastic/docs-builder/docs/3202/explore-analyze/ai-features/agent-builder/custom-agents#create-a-new-agent).
  </applies-item>
</applies-switch>


## Availability

The availability of specific agents depends on your solution view or serverless project type.
<applies-switch>
  <applies-item title="{ stack: ga 9.4+, serverless: ga }" applies-to="Elastic Cloud Serverless: Generally available, Elastic Stack: Planned">
    Built-in agents are space-agnostic: they are available across all [Kibana spaces](https://www.elastic.co/elastic/docs-builder/docs/3202/deploy-manage/manage-spaces). The default [Elastic AI Agent](#elastic-ai-agent) is an exception: it is created automatically per space and is only available in the space where it was created.
  </applies-item>

  <applies-item title="{ stack: preview =9.2, ga 9.3 }" applies-to="Elastic Stack: Preview in 9.2">
    Built-in agents are space-agnostic: they are available across all [Kibana spaces](https://www.elastic.co/elastic/docs-builder/docs/3202/deploy-manage/manage-spaces).
  </applies-item>
</applies-switch>

<note applies-to="Elastic Stack: Generally available in 9.3, Elastic Stack: Preview in 9.2">
  Elastic Observability and Elastic Security users must opt-in to use Elastic Agent Builder. To learn more, refer to [Compare Agent Builder and AI Assistant > Switch between chat experiences](/elastic/docs-builder/docs/3202/explore-analyze/ai-features/ai-chat-experiences/ai-agent-or-ai-assistant#switch-between-chat-experiences).
</note>


## Elastic AI Agent

<applies-to>
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available since 9.3
  - Elastic Stack: Preview in 9.2
</applies-to>

<applies-switch>
  <applies-item title="{ stack: ga 9.4+, serverless: ga }" applies-to="Elastic Cloud Serverless: Generally available, Elastic Stack: Planned">
    The **Elastic AI Agent** is the default general-purpose agent for Elasticsearch. Unlike the other built-in agents, it is a standard persisted agent that is automatically created in each [Kibana space](https://www.elastic.co/elastic/docs-builder/docs/3202/deploy-manage/manage-spaces) when first accessed.Because the default agent is space-aware, you can customize it independently for each space. You can change its instructions, adjust which tools it has access to, or clone it as a starting point for a new agent.**Default assigned tools:**
    - All [**Platform core tools**](/elastic/docs-builder/docs/3202/explore-analyze/ai-features/agent-builder/tools/builtin-tools-reference#platform-core-tools)
  </applies-item>

  <applies-item title="{ stack: preview =9.2, ga 9.3 }" applies-to="Elastic Stack: Preview in 9.2">
    The **Elastic AI Agent** is the default general-purpose agent for Elasticsearch. It is designed to help with a wide range of tasks, from writing ES|QL queries to exploring your data indices.**Assigned tools:**
    - All [**Platform core tools**](/elastic/docs-builder/docs/3202/explore-analyze/ai-features/agent-builder/tools/builtin-tools-reference#platform-core-tools)
  </applies-item>
</applies-switch>

<dropdown title="Previous versions">
  ## Observability Agent

  <applies-to>
    - Serverless Observability projects: Removed
    - Elastic Stack: Planned for removal
    - Elastic Stack: Preview in 9.3
  </applies-to>
  A specialized agent for logs, metrics, and traces. It is designed to assist with infrastructure monitoring and application performance troubleshooting.**Assigned tools:**
  - All [**Observability tools**](/elastic/docs-builder/docs/3202/explore-analyze/ai-features/agent-builder/tools/builtin-tools-reference#observability-tools)
  - A subset of [**Platform core tools**](/elastic/docs-builder/docs/3202/explore-analyze/ai-features/agent-builder/tools/builtin-tools-reference#platform-core-tools)


  ## Threat Hunting Agent

  <applies-to>
    - Serverless Security projects: Removed
    - Elastic Stack: Planned for removal
    - Elastic Stack: Preview in 9.3
  </applies-to>
  A specialized agent for security alert analysis tasks, including alert investigation and Elastic Security documentation. It helps analysts triage alerts and understand complex security events. For more information and example use-cases, refer to [Agent Builder for Elastic Security](https://www.elastic.co/elastic/docs-builder/docs/3202/solutions/security/ai/agent-builder/agent-builder).**Assigned tools:**
  - All [**Security tools**](/elastic/docs-builder/docs/3202/explore-analyze/ai-features/agent-builder/tools/builtin-tools-reference#security-tools)
  - A subset of [**Platform core tools**](/elastic/docs-builder/docs/3202/explore-analyze/ai-features/agent-builder/tools/builtin-tools-reference#platform-core-tools)
  The standalone **Threat Hunting Agent** is removed in 9.4. Threat hunting workflows now use the [Elastic AI Agent](#elastic-ai-agent) with the [`threat-hunting`](/elastic/docs-builder/docs/3202/explore-analyze/ai-features/agent-builder/builtin-skills-reference#agent-builder-threat-hunting-skill) skill enabled, which provides the same capabilities without switching between separate built-in agents. For Security-specific context, refer to [Elastic AI Agent, skills, and tools in Elastic Security](https://www.elastic.co/elastic/docs-builder/docs/3202/solutions/security/ai/agent-builder/skills-model).**Migration path:** Enable the [`threat-hunting`](/elastic/docs-builder/docs/3202/explore-analyze/ai-features/agent-builder/builtin-skills-reference#agent-builder-threat-hunting-skill) skill on the Elastic AI Agent in place of that standalone agent. The skill ships with the same tool set and query templates previously bundled into the agent, plus platform core tools for generating and running ES|QL queries. For use cases and example prompts, refer to [Security use cases for Elastic Agent Builder](/elastic/docs-builder/docs/3202/solutions/security/ai/agent-builder/skills-use-cases#threat-hunting).
</dropdown>


## Related pages

- [Agents](https://www.elastic.co/elastic/docs-builder/docs/3202/explore-analyze/ai-features/agent-builder/agent-builder-agents)
- [Create a custom agent](/elastic/docs-builder/docs/3202/explore-analyze/ai-features/agent-builder/custom-agents#create-a-new-agent)
- [Built-in tools reference](https://www.elastic.co/elastic/docs-builder/docs/3202/explore-analyze/ai-features/agent-builder/tools/builtin-tools-reference)