﻿---
title: AI for security
description: Learn how Elastic Security uses AI to automate alert triage, accelerate threat investigation, and augment SOC analyst workflows with Attack Discovery, AI Assistant, and Agent Builder.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/solutions/security/ai
products:
  - Elastic Cloud Serverless
  - Elastic Security
applies_to:
  - Serverless Security projects: Generally available
  - Elastic Stack: Generally available
---

# AI for security
Elastic Security provides AI-powered tools that help security analysts automate alert triage, accelerate threat investigation, and streamline SOC operations. These tools use large language models (LLMs) to analyze your security data, identify attacks, generate queries, and assist with incident response—reducing mean time to respond and helping your team manage growing alert volumes.

## How security AI tools connect to the Elastic AI platform

Elastic Security's AI capabilities build on Elastic's platform-level AI capabilities, which include foundational infrastructure like [LLM connectors and Elastic Managed LLMs](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/explore-analyze/ai-features/llm-guides/llm-connectors) and [Elastic Agent Builder](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/explore-analyze/ai-features/elastic-agent-builder), while Elastic Security extends this infrastructure with security-specific tools and workflows.
For a complete view of AI capabilities across the Elastic platform, including features for Observability and Elasticsearch, refer to [AI-powered features](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/explore-analyze/ai-features). To manage which AI features and connectors are available in your environment, refer to [Manage access to AI features](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/explore-analyze/ai-features/manage-access-to-ai-assistant).

## Core AI tools

The following tools provide interactive, LLM-driven capabilities for security analysts. Each requires at least one working [LLM connector](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/explore-analyze/ai-features/llm-guides/llm-connectors).

### Attack Discovery

[Attack Discovery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/solutions/security/ai/attack-discovery) uses LLMs to automatically analyze alerts in your environment and surface potential attacks. Rather than requiring you to review alerts individually, Attack Discovery identifies relationships among multiple alerts, maps activity to the MITRE ATT&CK matrix, and suggests which threat actors might be responsible. You can schedule Attack Discovery to run automatically and send notifications through connectors such as Slack, Microsoft Teams, PagerDuty, or email.

### AI chat

Elastic Security offers two AI chat experiences: [Elastic AI Assistant for Security](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/solutions/security/ai/ai-assistant), and [Elastic Agent Builder](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/solutions/security/ai/agent-builder/agent-builder). They have similar high level capabilities.
They both provide LLM-powered chat interface that helps you with alert investigation, incident response, and ES|QL query generation throughout Elastic Security, and provide contextual insights that explain errors and suggest remediation steps.
However, there are also several imporant differences in their capabilities. To learn more and select which to use, refer to [Compare Agent Builder and AI Assistant](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/explore-analyze/ai-features/ai-chat-experiences/ai-agent-or-ai-assistant).

## Elastic AI SOC Engine

<applies-to>
  - Serverless Security projects: Preview
</applies-to>

[Elastic AI SOC Engine (EASE)](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/solutions/security/ai/ease/ease-intro) is an Elastic Security Serverless project type that provides AI-powered tools to augment your existing SIEM and EDR/XDR platforms. EASE combines Attack Discovery, AI Assistant, and agentless data ingestion in a serverless deployment that you can start using in minutes. It's designed for teams that want to get value from AI-driven security operations quickly, without managing infrastructure. EASE also offers a [Value report](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/solutions/security/ai/ease/ease-value-report) that summarizes key security metrics and helps you measure the impact of your AI-powered SOC.

## AI-powered workflow tools

In addition to the interactive AI tools described in this section, Elastic Security provides several AI-powered tools that automate specific workflows:
- [Automatic Import](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/solutions/security/get-started/automatic-import): Uses AI to ingest data from sources that don't have prebuilt Elastic integrations, by creating custom integrations with ECS mappings.
- [Automatic Migration](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/solutions/security/get-started/automatic-migration): Uses AI to translate rules and dashboards from third-party SIEMs into Elastic Security's native format, accelerating SIEM migration.
- [Automatic Troubleshooting](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/solutions/security/manage-elastic-defend/automatic-troubleshooting): Uses AI to identify issues that could prevent Elastic Defend from working as intended, including policy response failures and third-party antivirus conflicts.


## Choose the right LLM

Most security AI features require at least one working LLM connector. You can use Elastic Managed LLMs, which are available by default with a supported license, or [connect to third-party providers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/explore-analyze/ai-features/llm-guides/llm-connectors) such as OpenAI, Amazon Bedrock, Azure OpenAI, or Google Vertex AI. To compare how different models perform across security AI use cases, refer to the [LLM performance matrix](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/solutions/security/ai/large-language-model-performance-matrix).

## AI use case guides

The following guides walk you through example workflows that demonstrate how AI Assistant and Attack Discovery work individually and together:
- [Triage alerts](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/solutions/security/ai/triage-alerts): Use AI Assistant to analyze and triage alerts, including generating investigation reports.
- [Identify, investigate, and document threats](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/solutions/security/ai/identify-investigate-document-threats): Use Attack Discovery and AI Assistant together to find, investigate, and document potential threats.
- [Generate, customize, and learn about ES|QL queries](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/solutions/security/ai/generate-customize-learn-about-esorql-queries): Use AI Assistant to write and understand ES|QL queries.
- [Use AI Assistant's Knowledge Base to improve response quality](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5609/solutions/security/ai/usecase-knowledge-base-walkthrough): Add custom knowledge to AI Assistant to improve the quality and relevance of its responses.