Loading

AI-augmented workflows

Workflows and Elastic Agent Builder are complementary. Workflows give you deterministic, auditable, event-driven automation: the steps always run in the same order and produce the same kind of result. Elastic Agent Builder agents give you reasoning: the ability to interpret unstructured context, classify signals, and generate natural-language summaries. Combining the two lets you build automation that's both reliable and intelligent.

The integration runs in both directions: a workflow can call an agent as a step, and an agent can trigger a workflow as a tool.

  • Call an agent from a workflow. Use the ai.agent step to invoke any agent built in Elastic Agent Builder. The agent sees the workflow's data through template variables, performs its reasoning, and returns a response that subsequent steps can act on. Refer to Call Elastic Agent Builder agents from Elastic Workflows for the full ai.agent reference and examples.
  • Trigger a workflow from an agent. Create a workflow tool in Elastic Agent Builder and assign it to an agent. The agent can then invoke the workflow from a conversation, extracting the needed inputs from the user's message and surfacing the workflow's output in chat.
  • Classify and route with AI. Pair ai.classify with switch to send each alert, ticket, or signal down a different branch based on a model's categorization.
  • Summarize evidence before action. Use ai.summarize to turn gathered evidence into a concise summary for a case description, notification body, or reviewer prompt.
  • Gate AI decisions on human review. Pair AI classification with human-in-the-loop to show the model's output to an analyst before the workflow takes action.
  • Send structured prompts to an LLM. Use the ai.prompt step with any configured AI connector to run classification, extraction, or summarization without going through an agent.
  • Compose reusable AI building blocks. Extract repeated AI step sequences into a child workflow that parent workflows invoke with workflow.execute.
  • Use agent-from-workflow when the workflow already knows what it's doing and needs AI only to reason over a specific data set. For example, summarizing an alert, classifying severity, or extracting fields from unstructured text.
  • Use workflow-from-agent when the user (or another agent) is in a conversation and wants to trigger a deterministic procedure. For example, isolating a host, opening a case, or running a set of enrichment queries.