--- title: Elastic AI Agent, skills, and tools in Elastic Security description: Understand how the Elastic AI Agent, Security skills, and tools work together in Elastic Agent Builder for Elastic Security. url: https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/solutions/security/ai/agent-builder/skills-model products: - Elastic Cloud Serverless - Elastic Security applies_to: - Serverless Security projects: Generally available - Elastic Stack: Planned --- # Elastic AI Agent, skills, and tools in Elastic Security Starting in version 9.4, Elastic Security centers on a single default [Elastic AI Agent](/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/builtin-agents-reference#elastic-ai-agent) that you extend with modular *skills*. Each skill packages domain-specific instructions, a curated set of [tools](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/tools), and context for a SOC workflow so you don't switch between separate agents for hunting, triage, or response. ## How the pieces fit together | Layer | What it is | In Elastic Security | |-------|----------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Agent | The AI you chat with. It reasons, follows instructions, and uses tools. | The default is the [Elastic AI Agent](/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/builtin-agents-reference#elastic-ai-agent). | | Skill | Specialized instructions, tools, and context for one domain. | Security skills you can enable, such as threat hunting or alert triage. | | Tool | A specific action the agent can run, such as querying data, opening a case, or running a workflow. | [Built-in tools](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/tools/builtin-tools-reference) shared across skills — the same tool can appear in more than one skill. | You talk to the agent in natural language. The agent picks tools based on your request, the skills you turned on, and its instructions. You don't invoke tools directly. ## Where to manage skills Refer to [Skills in Elastic Agent Builder](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/skills) and [Agents](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/agent-builder-agents) for how to assign skills to an agent in the Kibana UI or via the Skills APIs. ## Relationship to the standalone Threat Hunting Agent In Elastic Stack 9.3 and earlier Elastic Agent Builder documentation, Elastic Security documented a separate Threat Hunting Agent built-in agent. That standalone agent is deprecated starting in 9.4. Threat hunting workflows now use the Elastic AI Agent with the Threat Hunting skill enabled. For migration guidance, refer to the [Threat Hunting Agent](/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/builtin-agents-reference#threat-hunting-agent) section in the built-in agents reference. ## Frequently asked questions ### How is this different from Elastic AI Assistant? [Elastic AI Assistant](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/solutions/security/ai/ai-assistant) is the legacy in-product assistant embedded across Elastic Security workflows. Elastic Agent Builder is the platform for configurable agents, tools, and skills. Skills and tools in Elastic Agent Builder replace the older split between broad capabilities and one-off workflows. For how skills relate to tools and prompts, refer to [Skills in Elastic Agent Builder](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/skills). ### Can I use more than one skill in a conversation? You can enable multiple skills for the agent. The agent decides which skill context and tools apply based on your request. ### Can I create custom Security skills? Yes. For supported deployment tiers and how to author your own skill, refer to [Skills in Elastic Agent Builder](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/skills) and the [Skill creation guidelines](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/skill-creation-guidelines). ## Related pages - [Agent Builder for Elastic Security](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/solutions/security/ai/agent-builder/agent-builder) - [Security skills use cases](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/solutions/security/ai/agent-builder/skills-use-cases) - [Skills in Elastic Agent Builder](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/skills) - [Built-in skills reference](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/builtin-skills-reference) - [Skill creation guidelines](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/skill-creation-guidelines) - [Built-in agents reference](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/builtin-agents-reference) - [Tools in Elastic Agent Builder](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/ai-features/agent-builder/tools)