https://cybersecuritytracker.ai/?stack=1Stories and vulnerabilities involving Elastic.Sun, 26 Jul 2026 22:32:51 GMThttps://elastic.co/security-labs/agentic-soc-token-budget-architecturecst-3189Elastic InfoSec compares two architectural approaches for agentic security operations centers: a single agent with a library of skills versus a fleet of specialized agents orchestrated through deterministic workflows. Testing on 36,822 real production investigations shows the specialized agent approach costs $0.69 per alert triage versus $3.42 for the single-agent method, a 5.7x difference at scale. The choice between architectures depends on investigation patterns, team maturity, and whether analysts need flexible on-demand skill loading or deterministic methodologies.Fri, 24 Jul 2026 00:00:00 GMThttps://elastic.co/security-labs/esql-completion-curl-wget-detection-triagecst-3130Elastic Security deployed a detection rule for curl and wget file transfers that uses ES|QL COMPLETION, an LLM-powered triage feature, to filter out legitimate cloud activity before alerts reach analysts. Running the rule on Elastic's production fleet for seven days, the system reduced noise by using deterministic filtering and LLM reasoning to distinguish between expected automation, CI/CD jobs, and potential attacker activity. The approach maintains security visibility for file transfer detection in cloud environments while eliminating false positives that would otherwise overwhelm security teams.Thu, 23 Jul 2026 00:00:00 GMThttps://elastic.co/security-labs/wp2shell-wordpress-rce-detection-elastic-defendcst-3046On July 17, 2026, Searchlight Cyber disclosed wp2shell, a pre-authentication remote code execution chain affecting WordPress Core versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1 through a route confusion flaw in the REST batch endpoint. Proof-of-concept tools circulated within hours, with attackers either escalating through SQL injection to upload malicious plugins or dropping webshells directly to disk, resulting in command execution via the web process. Defenders observe PHP and web server runtimes spawning shells, plugin directories appearing under wp-content/plugins/, and consistent post-exploitation discovery activity across vulnerable hosts.Thu, 23 Jul 2026 00:00:00 GMThttps://isc.sans.edu/diary/rss/33156cst-2542DShield SIEM received an update in September 2025 that added TTY log collection and Suricata integration to its monitoring capabilities. The system now uses ELK stack version 8.19.15 and includes additional dashboards that allow security practitioners to review command activity on DShield sensors, with logs parsed and uploaded daily and cross-linked across visualizations.Wed, 15 Jul 2026 01:38:43 GMThttps://elastic.co/security-labs/alert-triage-agentic-soc-elastic-workflowscst-611Elastic's InfoSec team built an automated security operations center using native Elastic tools that triages security alerts in under 3 minutes instead of the traditional 30-minute manual process. The system uses deterministic ES|QL queries to close obvious false positives at no cost, then routes genuinely ambiguous cases to specialized AI agents across endpoint, cloud, and SaaS domains, with a final review agent documenting conclusions in Kibana cases. The approach prioritizes query-based investigation over AI inference for well-understood patterns, reducing both cost and token consumption while allowing analysts to focus on alerts requiring human judgment.Thu, 02 Jul 2026 00:00:00 GMThttps://elastic.co/security-labs/security-advisory-automation-rag-elastic-agent-buildercst-612Elastic developed a generative AI agent using Elastic Agent Builder that automatically drafts complete CVE security advisories from vulnerability reports in minutes, eliminating manual work. The agent uses retrieval-augmented generation (RAG) against indexed MITRE CWE and CAPEC catalogues in Elasticsearch to ensure accurate classifications and prevent AI hallucinations. The solution has already been deployed in production and generates standardized advisory text with CWE classification, CAPEC methodology, CVSS scoring, and mitigation guidance.Tue, 23 Jun 2026 00:00:00 GMThttps://elastic.co/security-labs/elastic-security-mcp-appcst-618Elastic released a Model Context Protocol (MCP) app that integrates security operations directly into AI tools like Claude, VS Code, and Cursor, enabling security operations center analysts to perform triage, threat hunting, case management, and detection rule tuning without leaving the chat interface. The app provides six interactive dashboards that map to core security workflows and sync all actions back to Elasticsearch and Kibana, allowing analysts to maintain full context and workflow continuity across platforms.Tue, 12 May 2026 00:00:00 GMThttps://elastic.co/security-labs/elastic-workflows-ga-9-4cst-622Elastic has released Workflows as generally available in version 9.4, providing native automation capabilities built directly into the Elastic platform for security, observability, and search use cases. The automation layer executes based on alerts or schedules, querying Elasticsearch, enriching data with threat intelligence, creating cases, and calling external APIs without requiring separate platforms or data movement. Version 9.4 adds 25 case management automation steps, human-in-the-loop primitives, natural language workflow authoring via AI, and expanded flow-control features for production-ready security automation.Tue, 05 May 2026 00:00:00 GMThttps://elastic.co/security-labs/skills-elastic-security-9-4cst-628Elastic Security 9.4 introduces an AI agent architecture that uses specialized skills to handle different security operations workflows, including detection rule writing, alert triage, and threat hunting. Rather than using a single monolithic prompt, the system activates task-specific skills with tailored instructions, tools, and domain context only when needed, allowing analysts to manage multiple investigations through one conversation interface.Mon, 04 May 2026 00:00:00 GMThttps://elastic.co/security-labs/entity-analytics-agent-buildercst-627Elastic has introduced Conversational Entity Analytics, an AI agent skill within Agent Builder that allows threat hunters to investigate users, hosts, and services through natural language questions rather than navigating multiple screens and dashboards. The feature delivers entity risk scores, profiles, and analytics inline within a chat interface, keeping investigation context in one place while maintaining connection to the underlying Entity Analytics data in Kibana.Mon, 04 May 2026 00:00:00 GMThttps://elastic.co/security-labs/ai-esql-detection-rule-creationcst-626Elastic Security has added AI-powered detection rule creation that allows analysts to describe threats in plain English and automatically generates validated Elasticsearch Query Language (ES|QL) rules with MITRE ATT&CK mappings and severity recommendations. The capability is built directly into the rule creation workflow, eliminating the need to learn query syntax or leave the platform. This addresses the growing gap between attack speed and detection engineering capacity by reducing the friction required to write and deploy new detection rules.Mon, 04 May 2026 00:00:00 GMThttps://elastic.co/security-labs/dfir-osquery-elastic-securitycst-629Elastic Security integrates Osquery to enable modern Digital Forensics and Incident Response (DFIR) workflows that shift from post-incident disk imaging to real-time, query-driven investigation across live endpoints. The platform eliminates context-switching by allowing investigators to move from alert detection through forensic analysis without leaving the Elastic interface. Osquery exposes OS artifacts as queryable tables, enabling rapid hypothesis testing and investigation pivots across ephemeral infrastructure at scale.Fri, 01 May 2026 00:00:00 GMT