---
title: Elastic Agent Builder built-in agents reference
description: Reference of the pre-configured AI agents available in Elastic Agent Builder, including their specialized capabilities and assigned tools.
url: https://www.elastic.co/elastic/docs-builder/docs/3263/explore-analyze/ai-features/agent-builder/builtin-agents-reference
products:
  - Elastic Cloud Serverless
  - Elastic Observability
  - Elastic Security
  - Elasticsearch
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available since 9.3, Preview in 9.2
---

# Elastic Agent Builder built-in agents reference
Built-in agents are pre-configured by Elastic with instructions and tools to handle common use cases.

## Elastic AI Agent

The **Elastic AI Agent** is the default general-purpose agent. It is designed to help with a wide range of tasks, from writing ES|QL queries to exploring your data indices.
The Elastic AI Agent is a standard persisted agent that is space-aware. A separate instance is created automatically in each [Kibana space](https://www.elastic.co/elastic/docs-builder/docs/3263/deploy-manage/manage-spaces) when first accessed, and each instance can be customized independently: change its instructions, assign [skills](https://www.elastic.co/elastic/docs-builder/docs/3263/explore-analyze/ai-features/agent-builder/builtin-skills-reference) and [tools](https://www.elastic.co/elastic/docs-builder/docs/3263/explore-analyze/ai-features/agent-builder/tools/builtin-tools-reference), or clone it as a starting point for a new agent.
<note>
  In 9.2  and 9.3, the Elastic AI Agent cannot be modified or deleted. To customize it, clone it and [create a custom agent](/elastic/docs-builder/docs/3263/explore-analyze/ai-features/agent-builder/custom-agents#create-a-new-agent).
</note>


## Built-in agents in previous versions

<important>
  In Elastic Stack 9.3, Elastic Agent Builder included two specialized built-in agents for observability and security use cases. Both were removed in 9.4 in favor of equivalent capabilities exposed as skills on the [Elastic AI Agent](#elastic-ai-agent).
</important>


### Observability Agent

<applies-to>
  - Serverless Observability projects: Removed
  - Elastic Stack: Removed in 9.4
  - Elastic Stack: Preview in 9.3
</applies-to>

A specialized agent for logs, metrics, and traces. It is designed to assist with infrastructure monitoring and application performance troubleshooting.
**Assigned tools:**
- All [**Observability tools**](/elastic/docs-builder/docs/3263/explore-analyze/ai-features/agent-builder/tools/builtin-tools-reference#observability-tools)
- A subset of [**Platform core tools**](/elastic/docs-builder/docs/3263/explore-analyze/ai-features/agent-builder/tools/builtin-tools-reference#platform-core-tools)


### Threat Hunting Agent

<applies-to>
  - Serverless Security projects: Removed
  - Elastic Stack: Removed in 9.4
  - Elastic Stack: Preview in 9.3
</applies-to>

A specialized agent for security alert analysis tasks, including alert investigation and Elastic Security documentation. It helps analysts triage alerts and understand complex security events. For more information and example use-cases, refer to [Agent Builder for Elastic Security](https://www.elastic.co/elastic/docs-builder/docs/3263/solutions/security/ai/agent-builder/agent-builder).
**Assigned tools:**
- All [**Security tools**](/elastic/docs-builder/docs/3263/explore-analyze/ai-features/agent-builder/tools/builtin-tools-reference#security-tools)
- A subset of [**Platform core tools**](/elastic/docs-builder/docs/3263/explore-analyze/ai-features/agent-builder/tools/builtin-tools-reference#platform-core-tools)

The standalone **Threat Hunting Agent** is removed in 9.4. Threat hunting workflows now use the [Elastic AI Agent](#elastic-ai-agent) with the [`threat-hunting`](/elastic/docs-builder/docs/3263/explore-analyze/ai-features/agent-builder/builtin-skills-reference#agent-builder-threat-hunting-skill) skill enabled, which provides the same capabilities without switching between separate built-in agents. For Security-specific context, refer to [Elastic AI Agent, skills, and tools in Elastic Security](https://www.elastic.co/elastic/docs-builder/docs/3263/solutions/security/ai/agent-builder/skills-model).
**Migration path:** Enable the [`threat-hunting`](/elastic/docs-builder/docs/3263/explore-analyze/ai-features/agent-builder/builtin-skills-reference#agent-builder-threat-hunting-skill) skill on the Elastic AI Agent in place of that standalone agent. The skill ships with the same tool set and query templates previously bundled into the agent, plus platform core tools for generating and running ES|QL queries. For use cases and example prompts, refer to [Security use cases for Elastic Agent Builder](/elastic/docs-builder/docs/3263/solutions/security/ai/agent-builder/skills-use-cases#threat-hunting).

## Related pages

- [Agents](https://www.elastic.co/elastic/docs-builder/docs/3263/explore-analyze/ai-features/agent-builder/agent-builder-agents)
- [Create a custom agent](/elastic/docs-builder/docs/3263/explore-analyze/ai-features/agent-builder/custom-agents#create-a-new-agent)
- [Built-in tools reference](https://www.elastic.co/elastic/docs-builder/docs/3263/explore-analyze/ai-features/agent-builder/tools/builtin-tools-reference)