Elastic Security Labs

No entries match these filters. Clear filters

1. How CVE-2026-73570 turns a Zimbra log file into remote code execution (2026-10-23) Oct 23, 2026 · issue 119

   Elastic Security adds a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. detection rule for CVE-2026-73570 Zimbra Swatchdog command injectioncommand injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. via log-file RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Enable the new Zimbra Swatchdog detection rule in Elastic Security to alert on active exploitation and hunt retroactively for pre-patch attempts.
   📍In Elastic Security, go to Rules › Detection Rules, search for Zimbra Swatchdog SNMP Command Injection Execution, and click Enable.
   • Adds the Zimbra Swatchdog SNMP Command Injection Execution SIEM rule, which fires on a two-step process sequence: a shell spawned from a Perl swatchdog_script parent with snmptrap, zmservicename, and zmservicestatus in its command line, followed by any child process other than snmptrap.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

2. docs update Oct 22, 2026 · issue 116
   • New vulnerability check php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
3. docs update Oct 22, 2026 · issue 116
   • New vulnerability check Elastic detection coverage for CVE-2026-109618 and CVE-2026-109619
4. docs update Oct 22, 2026 · issue 116

   Elastic Security Labs publishes detection engineering research including AI-augmented detection with ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis. COMPLETION and execution modality-focused detection approaches.

   • Introduces ES|QL COMPLETION command bringing LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. reasoning directly into detection rules for intelligent alert triage without external orchestration.
   • New detectionIntroduces an open-source, drop-in CI template using signal extraction and LLM reasoning to catch CI/CD abuse in GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure., GitLab CI, and Azure DevOps pipelines.

   2 details in Everything

   • New vulnerability check php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
   • New detection Linux Detection Engineering - Local Privilege Escalation
   • New detection How to correlate Kubernetes audit logs with container runtime data
   • New detection Linux Detection Engineering - Fileless Execution
   • New detection From 88 lines to 1: Detecting DLL hijacking with Elastic Defend
   • New detection Exploring the Hugging Face Breach: mapping AI agent tactics to Elastic Defend
   • New detection Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace
5. docs update Oct 22, 2026 · issue 116
   • New vulnerability check php2shell: Detection coverage for CVE-2026-109618 and CVE-2026-109619 (PHP core RCE)
   • New detection Endpoint rule: Payload Execution by Web Server
   • New detection SIEM rule: Suspicious Command Execution via Web Server
   • New detection SIEM rule: Unusual Command Execution via Web Server (new_terms baseline rule)
6. docs update Oct 22, 2026 · issue 116
   • New vulnerability check php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
7. docs update Oct 22, 2026 · issue 116
   • New vulnerability check php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
   • New integration Sublime Security integration for phishing incident response
8. docs update Oct 22, 2026 · issue 116
   • New vulnerability check php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
   • New integration Sublime Security integration for phishing incident response
9. announced Oct 16, 2026 · issue 113

   Elastic Security embeds SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. and EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. natively into Google Distributed Cloud air-gapped infrastructure for sovereign environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢

   ▶ ⤢
   • Adds native Elastic Security integration with Google Distributed Cloud (GDC) air-gapped, embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. unified SIEM and EDR directly into the platform without custom log forwarders or external connectors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Delivers SIEMv2 on Google Distributed Cloud air-gapped, ingesting and correlating infrastructure, network, and audit telemetry with pre-built MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior.-mapped detection rules and behavioral analytics in a fully disconnected environment.
   • Delivers EDRv2 on Google Distributed Cloud air-gapped, providing kernel-level behavioral protection via a single unified agent to detect memory exploits, polymorphic malware, and lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. without external network access.
   • Bundles curated Mandiant threat intelligence — including indicators of compromiseindicators of compromiseAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. and adversary TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. — for use in completely air-gapped environments.
   • Includes a SecOpsSecOpsThe practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. Foundation layer with built-in case management, incident response plans, runbooks, and standard operating procedures for sovereign and regulated deployments on Google Distributed Cloud.

   5 details in Everything

10. Auditing the auditor: Unmasking Apex Accelerator (2026-10-12) Oct 12, 2026 · issue 105
    • New detection Malicious npm packages @apexacc/cli and @apexacc/audit (Apex Accelerator / CloudSyncD)
    • New detection CloudSyncD macOS backdoor and custom Windows information stealer exfiltrating via Telegram
11. docs update Oct 5, 2026 · issue 095

    Elastic Security 9.5 introduces the AlertZero suite: automated alert analysis workflow and enhanced Attack Discovery for agentic SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. triage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Adds the Security alert analysis workflow in Elastic Security 9.5, which performs a first-pass classification of alerts as true positive, false positive, or inconclusive — with a confidence score and rationale note — for rules selected by a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. engineer or SOC manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables high-confidence false positive auto-closure within the Security alert analysis workflow, reducing analyst queue volume before alerts reach human review.
    • Integrates Security alert analysis with Attack Discovery so that classified alert results feed a cleaner, noise-reduced starting point for deeper attack investigation.
    • Allows Attack Discovery to be embedded inside existing Elastic Workflows for enrichment, escalation, and case creation, bringing AI-driven investigation into established SOC playbooks without a separate implementation.
    • Adds the Security alert analysis workflow in Elastic Security 9.5, which performs a first-pass classification of alerts as true positive, false positive, or inconclusive — with a confidence score and rationale note — for rules selected by a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. engineer or SOC manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables high-confidence false positive auto-closure within the Security alert analysis workflow, reducing analyst queue volume before alerts reach human review.

    2 more in Everything

12. docs update Oct 5, 2026 · issue 095
    • Updated detection Elastic SIEM prebuilt detection rule scoring via automated telemetry pipeline
13. docs update Oct 5, 2026 · issue 095
    • Updated detection Monthly automated telemetry pipeline scoring prebuilt detection rules
14. docs update Oct 5, 2026 · issue 095

    Elastic SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. introduces a monthly automated telemetry pipeline that scores all 1,781 prebuilt detection rules across Noise, Performance, Threat, and Profile dimensions to guide rule enablement decisions.

    • Adds Noise, Performance, Threat, and Profile tags to prebuilt detection rules, recalculated monthly from 30-day fleet telemetry across Elastic deployments.
    • Updated detectionIntroduces Profile: Recommended (score ≥ 7, hard gates on Noise and severity) and Profile: Aggressive (Noise: High or score < 2) as deployment posture summaries synthesising severity, noise, performance, and threat coverage.
    • Uses a deterministic heuristic catalog for Threat tag classification, with an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. fallback — capped at five tags per rule, restricted to the managed category list, and gated by human review before merging via pull request to elastic/detection-rules.

    3 details in Everything

15. Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage (2026-10-05) Oct 5, 2026 · issue 095

    Elastic SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. introduces monthly-recalculated Noise, Performance, Threat, and Profile tags on prebuilt rules, scored from real fleet telemetry via an automated pipeline with human review.

    • Updated detectionNew detectionAn automated monthly pipeline scores every prebuilt rule across Noise, Performance, Threat, and Profile dimensions from a 30-day telemetry window and opens a draft PR on elastic/detection-rules for human review before merging.
    • Updated detectionProfile: Recommended and Profile: Aggressive synthesise severity, noise, performance, and threat coverage into a single enablement-posture label, with hard gates preventing Noise: High rules from ever being Recommended.
    • LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. are used only as a fallback for Threat tag classification where heuristics find no match, capped at five tags per rule and filtered against a human-maintained catalog; manually curated tags (e.g. Threat: Cobalt Strike) are never overwritten by the pipeline.

    3 details in Everything

16. Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage (2026-10-05) Oct 5, 2026 · issue 015

    Elastic SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. introduces monthly-recalculated Noise, Performance, Threat, and Profile tags on prebuilt rules, scored from real fleet telemetry via an automated pipeline with human review.

    • Updated detectionNew detectionAn automated monthly pipeline scores every prebuilt rule across Noise, Performance, Threat, and Profile dimensions from a 30-day telemetry window and opens a draft PR on elastic/detection-rules for human review before merging.
    • Updated detectionProfile: Recommended and Profile: Aggressive synthesise severity, noise, performance, and threat coverage into a single enablement-posture label, with hard gates preventing Noise: High rules from ever being Recommended.
    • LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. are used only as a fallback for Threat tag classification where heuristics find no match, capped at five tags per rule and filtered against a human-maintained catalog; manually curated tags (e.g. Threat: Cobalt Strike) are never overwritten by the pipeline.

    3 details in Everything

17. Quarantined isn't contained: Agentic phishing response with Elastic and Sublime (2026-09-28) Sep 28, 2026 · issue 088

    Elastic Security adds a native two-way Sublime Security integration, correlating email threat telemetry with endpoint, identity, and network signals and enabling SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions.-driven⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    After Elastic Defend identifies malware on a host, use a Workflow to pass the file's SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hash to Sublime Security and trigger a blast-radius quarantine that pulls the same message from every mailbox it reached.
    📍In Elastic Workflows, add a Sublime Security action step, select Blast-radius quarantine, and map the SHA-256 field from the Elastic Defend alert as the indicator input. Set the step to require analyst approval before execution.
    • Adds a native Sublime Security integration that ingests email threat telemetry (flagged message, detection rationale, targeted recipient, and Sublime action taken) into Elastic Security for correlation with endpoint, identity, and network signals.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a two-way SOAR integration with Sublime Security inside Elastic Workflows, enabling response actions on the Sublime side — such as triggering a blast-radius quarantine using a SHA-256 hash from an Elastic Defend finding — without leaving Elastic.
    • Attack Discovery agentic workflow correlates Sublime Security email alerts with endpoint and other signals into unified, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior.-mapped attack chains, querying raw logs and gathering supporting evidence before surfacing a prioritized incident to analysts.
    • Elastic Workflows supports per-action configurable autonomy, letting teams set individual steps to run automatically or route through an analyst approval flow rather than applying a single automation policy across the whole system.
    • Adds a native Sublime Security integration that ingests email threat telemetry (flagged message, detection rationale, targeted recipient, and Sublime action taken) into Elastic Security for correlation with endpoint, identity, and network signals.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a two-way SOAR integration with Sublime Security inside Elastic Workflows, enabling response actions on the Sublime side — such as triggering a blast-radius quarantine using a SHA-256 hash from an Elastic Defend finding — without leaving Elastic.

    2 more in Everything

18. docs update Sep 24, 2026 · issue 084

    Elastic Security Serverless gains Cross-Project Search, letting one origin project run ~2,100 detection rules across up to 100 linked projects with a single alert queue.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ USE IT
    Hunt a specific service account's authentication activity across all 100 linked projects at once from the origin, using _index to attribute each result to its source tenant.
    esql copy

    FROM logs-* METADATA _index
    | WHERE user.name == "svc-deploy" AND event.category == "authentication"
    | KEEP _index, @timestamp, event.action, source.ip, host.name
    | SORT @timestamp DESC
    | LIMIT 500

    Get a live situational-awareness view of alert counts by linked project and severity to quickly spot which tenant needs immediate attention.
    esql copy

    FROM .alerts-security.alerts-* METADATA _index
    | EVAL project = CASE(LOCATE(_index, ":") > 0, MV_FIRST(SPLIT(_index, ":")), "origin")
    | STATS alerts = COUNT(*) BY project, kibana.alert.severity
    | SORT alerts DESC

    Scope a threat-hunting query to a single linked project (e.g., the cloud team) to investigate a specific incident without fanning out to all 100 projects.
    esql copy

    FROM cloud-team:logs-* METADATA _index
    | WHERE user.name == "svc-deploy" AND event.category == "authentication"
    | KEEP @timestamp, event.action, source.ip, host.name
    | SORT @timestamp DESC
    | LIMIT 500

    • Supports FROM logs-* METADATA _index in ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis. from the origin for broad threat-hunting sweeps across every linked project simultaneously, with _index prefix providing per-tenant attribution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports targeted single-project ES|QL queries from the origin using the cloud-team:logs-* qualified index pattern syntax to scope a hunt to one linked project.
    • Adds per-project alert rollup via ES|QL FROM .alerts-security.alerts-* METADATA _index with EVAL project = CASE(LOCATE(_index, ':') > 0, MV_FIRST(SPLIT(_index, ':')), 'origin') to surface a 'which tenant is on fire' situational-awareness view.
    • Exposes CPS scope selector in Security's managed pages as read-only for analysts, with linked-project management restricted to admins per space.
    • Machine learning datafeeds read linked-project data while jobs and results are stored on the origin, enabling centralized ML anomaly detection across tenants.

    +1 more show less

    • Entity store on the origin aggregates entities from every linked project into origin profiles, though per-project risk scores are not merged across projects.

    6 details in Everything

19. One SOC, 100 projects: running centralized alert triage on Elastic Security Serverless (2026-09-18) Sep 18, 2026 · issue 079

    Elastic Security Serverless gains cross-project search (CPS), letting one origin project run ~2,100 detection rules across up to 100 linked projects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ USE IT
    Hunt for an entity's activity across every linked project at once using an unqualified FROM in Discover — new projects linked later are automatically in scope with no query edits.
    esql copy

    FROM logs-* METADATA _index
    | WHERE user.name == "<username>"
    | KEEP _index, @timestamp, event.action, source.ip, user.name
    | SORT @timestamp DESC

    Build situational-awareness dashboards by rolling up alert counts per linked project and severity — validated interactive across 100 linked projects.
    esql copy

    FROM .alerts-security.alerts-* METADATA _index
    | STATS count = COUNT(*) BY _index, kibana.alert.severity
    | KEEP _index, kibana.alert.severity, count
    | SORT count DESC

    • Consolidates all rule-generated alerts into a single queue on the origin project, eliminating per-project rule duplication and multi-context analyst hopping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Surfaces cross-project scope in Discover and non-managed dashboards for broad ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis. hunting sweeps; Security managed pages show the CPS scope selector as read-only so analysts see in-scope projects while admins set defaults per space.
    • Extends Timeline search, Alert flyout, and Analyzer/Correlations views (read-only) across linked projects so analysts can follow an attack chain without leaving the origin.
    • Supports machine learning datafeeds reading linked-project data, with jobs and results stored on the origin for centralized ML anomaly detection.
    • Provides entity store partial cross-project support: origin profiles include entities from every linked project, though per-project risk scores are not merged across projects.

    +1 more show less

    • Enforces a 100 linked-project default limit per origin, with higher limits available by contacting Elastic.

    6 details in Everything

20. Linux Detection Engineering - Local Privilege Escalation (2026-09-11) Sep 11, 2026 · issue 072

    Elastic Security Labs adds a layered Linux LPE detection framework covering SUID/SGIDSUID/SGIDUnix permission bits that make an executable run as its owner (SUID) or group (SGID) rather than the invoking user, letting cyber tools escalate or audit privilege boundaries without requiring a full root shell. abuse, page-cache exploits, and COWCOWCopy-on-write: an OS memory optimization where two processes share the same physical pages until one writes, triggering a private copy only then. It makes forking processes fast and cheap.-class kernel bugs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Enable all Linux privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. prebuilt rules in Kibana to activate the new SUID/SGID and LPE framework detections across your fleet.
    📍In Kibana, go to Security -> Rules -> Detection rules (SIEM), click Install Elastic rules, then filter by tag OS: Linux and tag Tactic: Privilege Escalation, and enable all matching rules.
    • Adds the Suspicious SUID/SGID Utility Execution detection rule combining euid-0 / non-root-real-user shape, low process.args_count, and interpreter or writable-path parent to catch abuse of su, sudo, pkexec, and passwd with near-zero false positives.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds the Potential Privilege Escalation via a SUID/SGID Binary detection rule using an EQL stringcontains(process.executable, process.command_line) trick to catch abuse of uncommon or long-tail SUID binaries without maintaining a hard-coded name list.
    • Adds a SUID helper proxy-execution detection rule that inspects process.args (rather than process.name) for known setuid binary paths — including /usr/bin/pkexec, /usr/lib/snapd/snap-confine, /usr/bin/newuidmap, and /usr/libexec/openssh/ssh-keysign — combined with process.args_count <= 2 to catch cases where the helper is passed as an argument to another privileged binary.
    • Adds outcome-oriented general LPE detection rules keyed on the common escalation skeleton — an unprivileged process (uid != 0) executing from writable paths such as /tmp, /dev/shm, /var/tmp, /run/user/, or /home/ that becomes root — covering page-cache and no-userland-tell kernel bugs where no implementation-specific artifact is present.
    • Adds Auditd Manager integration guidance for syscall-level LPE visibility, requiring socket, splice, bind, and execve audit rules to surface the page-cache exploit family including Copy Fail and DirtyFrag.

    +1 more show less

    • Extends Elastic prebuilt rule coverage for Linux privilege escalation techniques mapped to MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. T1548.001 (Abuse Elevation Control Mechanism: Setuid and Setgid), available in the detection-rules repository (SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents.) and the protections-artifacts repository (endpoint behavioral rules).

    6 details in Everything

21. docs update Sep 2, 2026 · issue 062

    Elastic Security 9.5 adds automatic Tech Preview migration of Microsoft Sentinel Scheduled and NRTNRTNear-real-time processing, a design pattern where data is ingested and acted on within seconds to minutes rather than instantly or in batch, giving cyber tools low-latency detection without the cost of true real-time pipelines. detection rules to Elastic Security via LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code..

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Migrate Sentinel detection rules to Elastic Security via the UI — use this when you want to translate your Scheduled and NRT analytics rules without rebuilding them by hand.
    📍In Elastic Security, go to Security Launchpad › Manage Automatic Migrations, select your AI provider, expand 'Migrate your existing SIEM rules to Elastic', then choose Microsoft Sentinel from the drop-down on the top right. Follow the prompts to export your rules from Sentinel, upload them, and upload any detected Watchlists when prompted.
    • Adds automatic migration of Microsoft Sentinel Scheduled and Near Real Time (NRT) analytics rules to Elastic Security, available in Tech Preview in 9.5, with LLM-powered translation selected at migration time.
    • Supports Watchlists to ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis. Lookups conversion and severity mapping carry-over during Sentinel rule migration.
    • Surfaces translated rule status in the UI as one of five states: Installed, Translated, Partially translated, Not translated, or Failed, with per-rule actions (View, Install, or error details).
    • Integrates with Automatic Import to onboard custom or non-standard log sources before or after rule migration, enabling detections against proprietary data.
    • Post-migration automation is available via Workflows and Agent Builder, allowing natural-language-authored multi-step remediation, enrichment, and notification to trigger on rule fires.

    5 details in Everything

22. docs update Sep 2, 2026 · issue 062

    Elastic Security 9.5 adds AI-driven alert triage workflow, upgraded Attack Discovery with investigation pipelines, and detection gap closure via ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis..

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Review the investigation trail for an Attack Discovery run to understand which skills fired and how the model reached its conclusion before acting on the narrative.
    📍In Elastic Security, go to Detections › Attacks, open a discovery, and select the Workflow execution details panel to view the Agent Builder conversation log showing alert retrieval, generation, and validation stages.
    Close a detected gap by reviewing the AI-drafted ES|QL rule suggested by Attack Discovery, then explicitly approving it to create the detection.
    📍In Elastic Security, open an Attack Discovery result, navigate to the detection gap analysis section, review the proposed ES|QL rule with its MITRE ATT&CK mapping and severity rating, and click Create rule to approve — no rule is added until this step.
    • New Security alert analysis workflow in Elastic Security 9.5 performs first-pass AI triage on alerts from selected detection rules, classifying each as true positive, false positive, or inconclusive with a confidence score, and optionally auto-closes high-confidence false positives above a configurable threshold.
    • Auto-close in the Security alert analysis workflow is disabled by default and only activates for false-positive alerts that exceed the confidence threshold set by the SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. engineer or SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. manager.
    • Attack Discovery now runs a skill-backed investigation pipeline powered by Elastic Agent Builder and Elastic Workflows — hunting for related activity, analyzing entities, and searching raw logs in Elasticsearch before generating an attack narrative, rather than only correlating alerts.
    • Attack Discovery surfaces a detection gap analysis when the investigation uncovers activity missed by existing rules, and can draft an ES|QL detection rule to close the gap — requiring explicit analyst approval before any rule is created.
    • Attack discoveries are now surfaced on a new Attacks page under Detections, placed directly alongside the Alerts view so analysts start from correlated attack chains rather than individual alerts.

    +3 more show less

    • Attack Discovery supports custom Elasticsearch Query Language (ES|QL) queries for alert retrieval, enabling teams to filter by status, time range, and risk score when scoping which alerts feed into an investigation.
    • Attack Discovery can be scheduled to run continuously or triggered from an Elastic Workflow, enabling always-on investigation without waiting for analyst initiation.
    • Each Attack Discovery run exposes an Agent Builder conversation log showing which skills were invoked, which alerts were examined, and how the model reached its conclusion, supporting auditability and troubleshooting.

    8 details in Everything

23. docs update Sep 2, 2026 · issue 062

    Elastic Defend adds 800+ auto-generated vulnerable driver YARAYARAA pattern-matching language and engine, maintained by VirusTotal, that lets analysts write rules describing file or memory content so cyber tools can classify or hunt for malware at scale. rules, ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. endpoint support, and an automated troubleshooting skill in Elastic Agent Builder.

    ⤢ ⤢ ⤢
    • Elastic Security Labs Threat Command now continuously monitors VirusTotal, the LOLDrivers catalog, and Microsoft's Vulnerable Driver Block List to automatically generate and instantly deploy YARA-based vulnerable driver detection rules, decoupled from any release cycle, with coverage published in the open elastic/protections-artifacts repository.
    • Vulnerable driver protection has grown from 65 rules in 2023 to 800+ known vulnerable drivers today, with new drivers added continuously as they are disclosed.
    • New automatic troubleshooting skill available in Elastic Agent Builder enables conversational diagnosis and remediation of endpoint issues including third-party antivirus conflicts and policy application failures.
    • Elastic Defend now supports Windows on ARM, allowing Snapdragon laptops, Copilot+ PCs, and ARM workstations to enroll under existing policies with the same detection rules and telemetry as x64 endpoints.

    4 details in Everything

24. docs update Sep 2, 2026 · issue 062

    Elastic Security 9.5 adds GA detection rule change history with one-click rollback and auto-provisioned case analytics across all deployments.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Navigate to a detection rule to review its full change history, compare a previous revision to its predecessor, and roll back to it — useful after a tuning change causes a rule to stop firing.
    📍In Elastic Security, go to Security › Rules › Detection Rules, open the affected rule, then select the History tab. Browse the chronological revision log, click any past revision to preview it, use Compare to diff it against the previous version, then click Restore to roll back with one click.
    Build a SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. dashboard tracking case closure rates and assignment load without any manual index setup — available immediately on new 9.5 or Serverless deployments.
    📍In Elastic Security, go to Cases › Analytics, then open the pre-built Case Analytics data view in Kibana Discover or Dashboards. The 3 global indices are auto-provisioned; no manual index configuration is required before querying case volume, time-to-close, or assignment load.
    • Adds a History section on the rule details page showing a complete, chronological, immutable, append-only log of every saved detection rule state — including who changed it, when, and the revision number — with support for version comparison and one-click rollback; captures changes made through the UI or the API.
    • Detection Rules History Management ships as GA in 9.5, providing timestamped audit trails for ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria., and DORA compliance without manual export or configuration.
    • Case analytics (Cases as Data) ships as GA in 9.5, auto-provisioned and on by default across all deployment types including Serverless, reducing the index architecture from 12 indices per space to 3 global indices with a pre-built Case Analytics data view per space.
    • Removes the previous cap of 10 case templates and the cap on custom fields, enabling enterprise SOCs to define unlimited investigation-specific templates.
    • Adds seven new custom field types to case templates: checkboxes, radio buttons, a user picker, a date/time picker, and others.

    +3 more show less

    • Adds a Field Library allowing admins to define reusable case fields once and apply them across multiple templates.
    • Adds support for marking any case field as required before case closure, enforcing data completeness for regulated teams.
    • Adds a YAML editor with an Actions menu helper and a live preview panel for building case templates.

    8 details in Everything

25. Linux Detection Engineering - Fileless Execution (2026-09-01) Sep 1, 2026 · issue 070

    Elastic Security 9.4.0 adds process events for memfd_creatememfd_createA Linux system call that creates an anonymous, file-descriptor-backed memory region that never touches disk, giving cyber tools a way to load and execute code entirely in RAM without leaving filesystem artifacts. and kernel module loads on Linux, exposing fileless ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. execution in Defend telemetry.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ TRY IT
    Hunt for memfd-based fileless ELF execution chains — download → memfd_create → exec — by querying the new process.Ext.memfd fields in Kibana.
    copy

    $ event.category: process AND process.Ext.memfd.name: * AND NOT process.Ext.memfd.flag_noexec_seal: true

    Run a representative fileless memfd_create technique in a lab environment using FENIX to generate Elastic Defend telemetry for detection validation.
    copy

    $ git clone https://github.com/elastic/FENIX.git && cd FENIX
    make all
    python3 -m venv .venv && source .venv/bin/activate
    pip install -e .
    export FENIX_BIN_DIR=$PWD/bin
    fenix run memfd_create

    • Adds process.Ext.memfd.name, process.Ext.memfd.flags, flag_cloexec, flag_allow_seal, flag_hugetlb, flag_noexec_seal, and flag_exec fields to process events in Elastic Defend, capturing memfd_create syscall arguments for hunting fileless ELF execution chains.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Elastic Defend now records a process event when a process calls memfd_create on Linux (requires kernel 5.10.16+ for eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic.-based event sourcing), starting from Elastic Security 9.4.0.
    • Adds load_module event action to process events in Elastic Defend, reporting init_module and finit_module-based loadable kernel module loads for visibility into fileless kernel module activity.
    • Introduces FENIX (Fileless Execution for NIX), an open-source lab framework at github.com/elastic/FENIX with a fenix run <technique> CLI for reproducing and testing memfd-based fileless execution patterns against Elastic Defend telemetry.

    4 details in Everything

26. From 88 lines to 1: Detecting DLL hijacking with Elastic Defend (2026-08-28) Aug 28, 2026 · issue 070

    Elastic Defend 9.5.0 adds a dll.Ext.defense_evasions field that reduces DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. hijacking detection from 88 lines to one.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ TRY IT
    Write a detection rule that fires on any DLL search-order hijackingDLL search-order hijackingA Windows code-execution technique that exploits the OS loader's fixed DLL lookup sequence, placing a malicious DLL in a directory searched before the legitimate one so it loads instead. attempt, replacing the previous ~88-line rule with a single field match.
    copy

    $ dll.Ext.defense_evasions: "DLL Hijack: Masquerading"

    • Adds dll.Ext.defense_evasions: "DLL Hijack: Masquerading" field in Elastic Defend 9.5.0 to detect DLL search-order hijacking in a single rule condition, replacing rules that previously required ~88 lines covering ~2,600 named libraries, 10 excluded Windows system paths, signature checks, and a drop-to-load time window.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enriches DLL load events with DLL Hijack: Masquerading when a loaded DLL is not Microsoft-signed and its name matches a cached inventory of Windows and system-library DLLs, enabling direct field-based detection in detection rules.

    2 details in Everything

27. 13 million tool calls: auditing every AI coding agent action with Elastic Agent (2026-08-11) Aug 11, 2026 · issue 044

    Elastic Security Labs publishes a 280-line bash hook collector that ships every Cursor AI agent tool call to Elasticsearch as structured JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. via Elastic Agent filestream.

    ⤢
    └──▷ TRY IT
    Deploy the hook collector system-wide on macOS so both the Cursor IDE and cursor-agent CLI log every tool call without MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies..
    copy

    $ sudo mkdir -p /usr/local/share/ai-hooks
    sudo cp log-tool-calls.sh /usr/local/share/ai-hooks/log-tool-calls.sh
    sudo chmod +x /usr/local/share/ai-hooks/log-tool-calls.sh
    sudo tee "/Library/Application Support/Cursor/hooks.json" <<'EOF'
    {
      "version": 1,
      "hooks": {
        "sessionStart":          [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "beforeShellExecution":  [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "afterShellExecution":   [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "beforeMCPExecution":    [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "afterMCPExecution":     [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "postToolUse":           [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "postToolUseFailure":    [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "afterFileEdit":         [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "beforeReadFile":        [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "subagentStart":         [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "subagentStop":          [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "sessionEnd":            [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "stop":                  [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }]
      }
    }
    EOF

    Verify the CLI surface is captured separately from the IDE after deployment by running a headless agent call and checking the log.
    copy

    $ cursor-agent --print "say hello"
    tail -1 ~/.config/ai-hooks/logs/tool-calls-$(date -u +%F).jsonl

    • Adds a 280-line dependency-free bash hook collector script (log-tool-calls.sh) available in the elastic/elasticsearch-labs repository, plus a PowerShell port for Windows, that records every Cursor AI agent tool call as JSONL to a date-rotated log file readable only by the owner (chmod 0600).
    • Promotes top-level structured fields (hook_event_name, tool_name, command, file_path, mcp_server, model, session_id, duration, duration_ms) plus an ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping.-conformant event object (event.category, event.type, event.outcome) in every log entry for correlation with existing Elastic security indices.
    • Tags each event with a detected agent and ide surface (cursor, cursor-cli, or remote) by inspecting inherited environment variables (CURSOR_VERSION, CURSOR_CODE_REMOTE, VSCODE_PID, VSCODE_CWD, VSCODE_IPC_HOOK) so IDE and CLI sessions are distinguishable in a single log stream.
    • Delivers the collector to devices outside MDM via Cursor's Cloud Distribution console, which pushes a self-bootstrapping hook command that carries the collector script gzipped and base64-encoded and verifies it against a pinned SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hash on every invocation.
    • Provides an Elastic Agent filestream integration configuration that parses the JSONL logs into structured fields, enabling ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis. queries across all agent activity — for example, identifying which hosts ran an agent that read a .pem file in a given time window.

    +3 more show less

    • Validates CLI coverage by running cursor-agent --print 'say hello' and tailing the date-stamped log at ~/.config/ai-hooks/logs/tool-calls-$(date -u +%F).jsonl to confirm 'agent':'cursor','ide':'cursor-cli' appears.
    • Enforces local log retention of 30 days with opportunistic deletion of older files; Elasticsearch is the system of record for long-term storage.
    • Covers the cursor-agent headless CLI (used in CI and scripted runs) through the same hooks.json, firing identical hook events as the IDE.

    8 details in Everything

28. 13 million tool calls: auditing every AI coding agent action with Elastic Agent (2026-08-11) Aug 11, 2026 · issue 007

    Elastic Security Labs publishes a 280-line bash hook collector that ships every Cursor AI agent tool call to Elasticsearch as structured JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. via Elastic Agent filestream.

    ⤢
    └──▷ TRY IT
    Deploy the hook collector system-wide on macOS so both the Cursor IDE and cursor-agent CLI log every tool call without MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies..
    copy

    $ sudo mkdir -p /usr/local/share/ai-hooks
    sudo cp log-tool-calls.sh /usr/local/share/ai-hooks/log-tool-calls.sh
    sudo chmod +x /usr/local/share/ai-hooks/log-tool-calls.sh
    sudo tee "/Library/Application Support/Cursor/hooks.json" <<'EOF'
    {
      "version": 1,
      "hooks": {
        "sessionStart":          [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "beforeShellExecution":  [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "afterShellExecution":   [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "beforeMCPExecution":    [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "afterMCPExecution":     [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "postToolUse":           [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "postToolUseFailure":    [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "afterFileEdit":         [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "beforeReadFile":        [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "subagentStart":         [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "subagentStop":          [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "sessionEnd":            [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }],
        "stop":                  [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }]
      }
    }
    EOF

    Verify the CLI surface is captured separately from the IDE after deployment by running a headless agent call and checking the log.
    copy

    $ cursor-agent --print "say hello"
    tail -1 ~/.config/ai-hooks/logs/tool-calls-$(date -u +%F).jsonl

    • Adds a 280-line dependency-free bash hook collector script (log-tool-calls.sh) available in the elastic/elasticsearch-labs repository, plus a PowerShell port for Windows, that records every Cursor AI agent tool call as JSONL to a date-rotated log file readable only by the owner (chmod 0600).
    • Promotes top-level structured fields (hook_event_name, tool_name, command, file_path, mcp_server, model, session_id, duration, duration_ms) plus an ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping.-conformant event object (event.category, event.type, event.outcome) in every log entry for correlation with existing Elastic security indices.
    • Tags each event with a detected agent and ide surface (cursor, cursor-cli, or remote) by inspecting inherited environment variables (CURSOR_VERSION, CURSOR_CODE_REMOTE, VSCODE_PID, VSCODE_CWD, VSCODE_IPC_HOOK) so IDE and CLI sessions are distinguishable in a single log stream.
    • Delivers the collector to devices outside MDM via Cursor's Cloud Distribution console, which pushes a self-bootstrapping hook command that carries the collector script gzipped and base64-encoded and verifies it against a pinned SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hash on every invocation.
    • Provides an Elastic Agent filestream integration configuration that parses the JSONL logs into structured fields, enabling ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis. queries across all agent activity — for example, identifying which hosts ran an agent that read a .pem file in a given time window.

    +3 more show less

    • Validates CLI coverage by running cursor-agent --print 'say hello' and tailing the date-stamped log at ~/.config/ai-hooks/logs/tool-calls-$(date -u +%F).jsonl to confirm 'agent':'cursor','ide':'cursor-cli' appears.
    • Enforces local log retention of 30 days with opportunistic deletion of older files; Elasticsearch is the system of record for long-term storage.
    • Covers the cursor-agent headless CLI (used in CI and scripted runs) through the same hooks.json, firing identical hook events as the IDE.

    8 details in Everything

29. 13 million tool calls: auditing every AI coding agent action with Elastic Agent (2026-08-11) Aug 11, 2026 · release notes

    New Elastic Agent filestream integration for Cursor AI coding agent tool-call telemetry

    └──▷ USE IT
    Configure Cursor's hooks.json to point the beforeShellExecution and afterReadFile events to the local bash collector script.
    json copy

    {"hooks": {"beforeShellExecution": [{"command": "/usr/local/share/ai-hooks/log-tool-calls.sh"}], "beforeReadFile": [{"command": "/usr/local/share/ai-hooks/log-tool-calls.sh"}]}}

    • Adds an Elastic Agent filestream integration that parses AI agent tool-call logs into structured ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. fields for ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis. hunting.
    • Provides a 280-line dependency-free bash hook script and hooks.json configuration path (/Library/Application Support/Cursor/hooks.json) to record every Cursor IDE and CLI action as JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory..
    • Enables querying specific agent activity surfaces (e.g., *.pem file reads, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server connections) via new promoted ES|QL fields like mcp_server, hook_event_name, and ide.

    3 details in Everything

30. The security signal log tailing can't see: tracking npm cooldown removals with Elastic Agent (2026-08-07) Aug 7, 2026 · issue 039

    Elastic Agent CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. integration snapshots .npmrc on a 6-hour heartbeat to detect silent removal of npm's min-release-age setting

    ⤢
    • Adds a ~40-line Common Expression Language (CEL) integration in Elastic Agent that snapshots every .npmrc on a 6-hour heartbeat and marks cooldown.absent = true in the ingest pipeline when min-release-age disappears between snapshots.
    • Uses the file() and dir() CEL functions to enumerate user home directories at runtime (under /Users and /home) and machine-global npm config paths (/opt/homebrew/etc/npmrc, /usr/local/etc/npmrc, /etc/npmrc, /usr/lib/node_modules/npm/.npmrc), covering macOS and Linux with a single script.
    • Sets resource.url: file:///dev/null to satisfy the CEL integration's required URL field without making an HTTP request, with global paths and poll interval supplied via the Custom request cursor YAML field in Fleet UI.
    • Filters registry auth token lines (//registry.npmjs.org/:_authToken=...) in the ingest pipeline before any data leaves the host, ensuring credentials are never indexed in Elasticsearch.
    • Emits per-file SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hashes (file.hash.sha256) alongside file content so the cursor can detect in-place rewrites of .npmrc that remove min-release-age without changing the file path.

    +2 more show less

    • Documents why the Custom Logs Filestream integration is unsuitable for config file state monitoring: files under 1024 bytes are silently held back under the default fingerprint identity strategy, and filestream emits only on append — not on content removal.
    • Explains that clean_inactive in the Filestream integration requires ignore_older to also be set, a coupling that is useful for log rotation but counterproductive for static config files that may sit unchanged for months.

    7 details in Everything

31. The security signal log tailing can't see: tracking npm cooldown removals with Elastic Agent (2026-08-07) Aug 7, 2026 · issue 007

    Elastic Agent CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. integration snapshots .npmrc on a 6-hour heartbeat to detect silent removal of npm's min-release-age setting

    ⤢
    • Adds a ~40-line Common Expression Language (CEL) integration in Elastic Agent that snapshots every .npmrc on a 6-hour heartbeat and marks cooldown.absent = true in the ingest pipeline when min-release-age disappears between snapshots.
    • Uses the file() and dir() CEL functions to enumerate user home directories at runtime (under /Users and /home) and machine-global npm config paths (/opt/homebrew/etc/npmrc, /usr/local/etc/npmrc, /etc/npmrc, /usr/lib/node_modules/npm/.npmrc), covering macOS and Linux with a single script.
    • Sets resource.url: file:///dev/null to satisfy the CEL integration's required URL field without making an HTTP request, with global paths and poll interval supplied via the Custom request cursor YAML field in Fleet UI.
    • Filters registry auth token lines (//registry.npmjs.org/:_authToken=...) in the ingest pipeline before any data leaves the host, ensuring credentials are never indexed in Elasticsearch.
    • Emits per-file SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hashes (file.hash.sha256) alongside file content so the cursor can detect in-place rewrites of .npmrc that remove min-release-age without changing the file path.

    +2 more show less

    • Documents why the Custom Logs Filestream integration is unsuitable for config file state monitoring: files under 1024 bytes are silently held back under the default fingerprint identity strategy, and filestream emits only on append — not on content removal.
    • Explains that clean_inactive in the Filestream integration requires ignore_older to also be set, a coupling that is useful for log rotation but counterproductive for static config files that may sit unchanged for months.

    7 details in Everything

32. docs update Aug 4, 2026 · issue 035

    Elastic Security 9.5 adds immutable detection rule history with one-click rollback and GA queryable case analytics across all deployments.

    • Detection Rules History Management (GA in 9.5) adds a History section on the rule details page showing a complete, chronological, immutable, append-only log of every saved rule state — who changed it, when, and the revision number — captured via UI or API, with one-click restore to any prior revision.
    • Case analytics feature Cases as Data is now GA, on by default, and available across all deployment types including Serverless — auto-provisioned with a pre-built Case Analytics data view per space, no manual index configuration required.
    • Case analytics index architecture reduced from 12 indices per space to 3 global indices, enabling SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. dashboards for closure rates, time to close, and assignment load without manual setup.
    • Removes the previous cap of 10 case templates, allowing unlimited templates per deployment for enterprise SOCs managing multiple investigation types.
    • Removes the previous cap on custom fields per case template.

    +4 more show less

    • Adds seven new custom field types for case templates: checkboxes, radio buttons, a user picker, a date/time picker, and others.
    • Adds a Field Library for admins to define reusable case fields once and apply them across multiple templates.
    • Adds support for marking any custom field as required before case closure, enabling enforcement of fields such as Root Cause or Closing Reason for regulated teams.
    • Case template builder now includes a YAML editor with an Actions menu helper and a live preview panel for admin configuration.

    9 details in Everything

33. docs update Aug 4, 2026 · issue 035

    Elastic Security adds detection rule change history with one-click rollback and out-of-the-box queryable SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. case data.

    ⤢ ⤢
    • Tracks every detection rule change with a full audit trail and one-click rollback, requiring no additional configuration.
    • Makes SOC case management data queryable out of the box, enabling reporting without manual setup.

    2 details in Everything

34. Elastic goes all-in on Hacker Summer Camp at Black Hat and DEF CON in Las Vegas (2026-07-31) Jul 31, 2026 · issue 031

    Elastic Security adds autonomous attack investigation, auto-drafted detection rules, Windows on ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. endpoint protection, and plain-language workflow authoring.

    • Attack Discovery now performs autonomous analyst-style investigation: threat-hunting raw events, checking entity risk, corroborating across data sources, and classifying events as validated attacks before they reach the queue.
    • Attack Discovery auto-drafts detection rules when it finds gaps not covered by existing rules, routing the draft to an analyst for approval.
    • New alert analysis workflow differentiates likely false positives from true positives upstream, reducing noise before Attack Discovery investigates.
    • Elastic Defend gains always-on vulnerable driver coverage: threat research continuously monitors VirusTotal, loldrivers.io, and Microsoft's blocklist and automatically generates and instantly deploys YARA rules as new drivers are disclosed.
    • Elastic Defend now provides full endpoint protection for Windows on ARM devices (e.g., Surface laptops), bringing them into the same protection tier as the rest of the fleet.

    +6 more show less

    • New endpoint troubleshooting skill automatically flags policy and performance issues on endpoints.
    • Elastic Workflows adds plain-language authoring, letting users describe an automation in natural language and have it generated automatically.
    • Elastic Workflows adds versioning with change history, diff comparison between any two versions, and one-click rollback.
    • Visual Mode in Elastic Workflows displays a workflow as a graph with triggers, steps, branches, and YAML side by side.
    • Human-in-the-loopHuman-in-the-loopHuman in the loop, involving a person in an otherwise automated workflow. The person can review, approve, correct or supply information before work continues. approvals in Elastic Workflows pause execution at decision points and route approval requests to Slack.
    • Attack Discovery can be triggered directly from Elastic Workflows, enabling scheduled or event-driven investigation cadences.

    11 details in Everything

35. docs update Jul 31, 2026 · issue 031

    Elastic Security 9.5 adds AI-driven Attack Discovery investigation, auto-drafted detection rules, Windows on ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. support, and real-time vulnerable driver blocking.

    ⤢ ⤢ ⤢ ⤢
    • Attack Discovery now threat-hunts raw events, checks entity risk, corroborates findings across data sources, and classifies validated attacks — delivering a short list of confirmed threats instead of a raw alert queue.
    • Attack Discovery auto-drafts detection rules when it finds gaps in existing coverage, routing them to an analyst for approval.
    • Elastic Defend automatically generates and instantly deploys YARA rules as vulnerable drivers are publicly disclosed, eliminating the release-cycle lag in BYOVD protection.
    • Elastic Defend now provides full endpoint protection for Windows on ARM devices (Surface and other ARM-based laptops).
    • A new endpoint troubleshooting skill in Elastic Defend automatically flags policy and performance issues.

    +4 more show less

    • Elastic Workflows supports plain-language authoring — describe an automation in natural language and have it generated automatically.
    • Elastic Workflows adds versioning with diff comparison and one-click rollback, plus a Visual Mode graph view of triggers, steps, branches, and logic alongside YAML.
    • Elastic Workflows routes human-in-the-loophuman-in-the-loopHuman in the loop, involving a person in an otherwise automated workflow. The person can review, approve, correct or supply information before work continues. approval requests to Slack when a workflow reaches a decision requiring human input.
    • Attack Discovery can be triggered from Elastic Workflows, enabling automated recurring investigation cadences.

    9 details in Everything

36. docs update Jul 31, 2026 · issue 031

    Elastic Security 9.5 introduces AI-driven alert triage and attack investigation for SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. teams.

37. docs update Jul 31, 2026 · issue 031

    Elastic Defend adds 800+ vulnerable driver YARA rules, automated troubleshooting skill, and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. endpoint support

    • Automatically generates and instantly deploys vulnerable driver YARA rules sourced from VirusTotal, LOLDrivers, and Microsoft's blocklist to close BYOVD attack gaps.
    • New automated troubleshooting skill added to Elastic Defend for endpoint diagnostics.
    • Elastic Defend now supports ARM endpoint protection.
    • Attack Discovery converts raw alerts into validated, prioritized threats.

    4 details in Everything

38. docs update Jul 31, 2026 · issue 031

    Elastic Defend adds 800+ auto-generated BYOVD YARA rules, an AI troubleshooting skill, and Windows on ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. support.

    • Continuously monitors VirusTotal, LOLDrivers, and Microsoft's Vulnerable Driver Block List to automatically generate and instantly deploy YARA rules for newly disclosed vulnerable drivers — decoupled from any release cycle and published openly in the elastic/protections-artifacts repository.
    • Adds an Automatic Troubleshooting skill in Elastic Agent Builder, enabling conversational diagnosis and remediation guidance for endpoint policy failures, third-party AV conflicts, and performance issues.
    • Expands Elastic Defend coverage to Windows on ARM, allowing Snapdragon laptops and Copilot+ PCs to enroll under existing policies with the same detection rules and telemetry as x64 endpoints.

    3 details in Everything

39. docs update Jul 31, 2026 · issue 031

    Elastic Security 9.5 ships AI-driven alert triage, richer Attack Discovery investigations, and workflow automation toward Alert Zero.

    • Adds the Security alert analysis workflow for first-pass AI triage: classifies alerts as true positives, false positives, or inconclusive, annotates them with rationale, and optionally auto-closes high-confidence false positives above a configurable threshold.
    • Upgrades Attack Discovery with a skill-backed investigation pipeline (via Elastic Agent Builder and Elastic Workflows) that hunts for related activity, inspects entity context, and searches raw logs before producing a grounded attack narrative.
    • Introduces a new Attacks page under Detections where correlated attack chains live alongside Alerts, making discoveries a first-class operational object analysts can search, filter, assign, tag, and annotate.
    • Adds detection gap analysis to Attack Discovery: when the investigation uncovers activity missed by existing rules, it can draft an ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis. detection rule for analyst review and explicit approval before creation.
    • Enables Attack Discovery to run on a schedule or be triggered from Elastic Workflows, so investigations start automatically and feed into existing SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. playbooks for enrichment, escalation, and case management.

    +2 more show less

    • Supports connecting custom retrieval or validation workflows to Attack Discovery for teams with complex requirements, such as VirusTotal indicator checks, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. context enrichment, or entity validation against external data.
    • Exposes attack chain management (status, tags, assignees, notes) through the UI, APIs, and Workflows, allowing the attack chain rather than individual alerts to serve as the unit of SOC work.

    7 details in Everything

40. docs update Jul 31, 2026 · issue 031

    Elastic Security adds AI-driven Attack Discovery investigations, instant vulnerable driver YARA coverage, Windows on ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. support, and plain-language Workflow authoring

    • Attack Discovery now threat-hunts raw events beyond initial alerts, checks entity risk for users and hosts, corroborates findings across data sources, and classifies events as validated attacks — delivering a short list of confirmed threats instead of a raw alert queue.
    • Attack Discovery auto-drafts detection rules when it finds gaps that existing rules missed, routing them to an analyst for approval to close coverage gaps faster.
    • Elastic Defend continuously monitors public disclosure sources (VirusTotal, loldrivers.io, Microsoft's blocklist) and automatically generates and instantly deploys YARA rules for newly disclosed vulnerable drivers, eliminating the wait for a release cycle.
    • Elastic Defend now provides full endpoint protection for Windows on ARM devices (e.g., Surface laptops), bringing them into the same coverage as the rest of a fleet.
    • A new endpoint troubleshooting skill in Elastic Defend automatically flags policy and performance issues at the endpoint.

    +4 more show less

    • Elastic Workflows adds plain-language authoring so practitioners can describe an automation in natural language and have it generated automatically.
    • Elastic Workflows introduces versioning with diff comparison and one-click rollback, plus a Visual Mode showing workflow graph (triggers, steps, branches, logic) alongside YAML.
    • Elastic Workflows supports human-in-the-loophuman-in-the-loopHuman in the loop, involving a person in an otherwise automated workflow. The person can review, approve, correct or supply information before work continues. approvals routed to Slack, pausing execution at decision points that require analyst judgment.
    • A separate alert analysis workflow differentiates between likely false and true positives to reduce analyst time spent on low-fidelity alerts before Attack Discovery investigates the remainder.

    9 details in Everything

41. docs update Jul 31, 2026 · issue 031

    Elastic Security 9.5 adds agentic alert triage, auto-drafted detection rules, vulnerable driver auto-deployment, Windows on ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. support, and plain-language Workflow authoring.

    ⤢ ⤢ ⤢ ⤢
    • Attack Discovery now threat-hunts raw events, checks entity risk, corroborates findings across data sources, and classifies results as validated attacks — delivering a short list of confirmed threats instead of a raw alert wall.
    • Attack Discovery auto-drafts detection rules to close gaps it discovers during investigation, routing them to an analyst for approval.
    • Elastic Defend automatically generates and instantly deploys YARA rules as new vulnerable drivers are disclosed via sources like VirusTotal, loldrivers.io, and Microsoft's blocklist — eliminating wait for a release cycle.
    • Elastic Defend now provides full endpoint protection for Windows on ARM, covering Surface and other ARM-based devices on the same footing as the rest of the fleet.
    • A new endpoint troubleshooting skill in Elastic Defend automatically flags policy and performance issues.

    +3 more show less

    • Elastic Workflows adds plain-language authoring: describe the automation you want and have it generated for you.
    • Elastic Workflows gains versioning with diff comparison and one-click rollback, plus Visual Mode showing workflow graph alongside YAML.
    • Elastic Workflows supports human-in-the-loophuman-in-the-loopHuman in the loop, involving a person in an otherwise automated workflow. The person can review, approve, correct or supply information before work continues. approval steps that pause execution and route requests to Slack for analyst input.

    8 details in Everything

42. docs update Jul 31, 2026 · issue 031

    Elastic Security 9.5 adds AI-driven alert triage, 800+ vulnerable driver YARA rules, and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. endpoint support in Elastic Defend.

    • Adds AI-driven first-pass alert triage and investigation in Elastic Security 9.5, enabling SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. analysts to offload queue triage to an agentic workflow.
    • Attack Discovery now turns raw alerts into validated threats for streamlined attack investigation.
    • Elastic Defend automatically generates and instantly deploys vulnerable driver YARA rules sourced from VirusTotal, LOLDrivers, and Microsoft's blocklist to counter BYOVD attacks — covering 800+ rules.
    • Adds a new automated troubleshooting skill to Elastic Defend for endpoint diagnostics.
    • Adds ARM architecture support to Elastic Defend endpoint protection.

    5 details in Everything

43. docs update Jul 31, 2026 · issue 031

    Elastic Defend gains 800+ vulnerable driver YARA rules, automated troubleshooting, ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. support, and AI-driven alert triage in 9.5

    • Elastic Defend automatically generates and instantly deploys vulnerable driver YARA rules sourced from VirusTotal, LOLDrivers, and Microsoft's blocklist to counter BYOVD attacks (800+ rules).
    • New automated troubleshooting skill added to Elastic Defend for endpoint diagnostics.
    • Elastic Defend now supports ARM endpoint protection.
    • Elastic Security 9.5 introduces AI-driven first-pass alert triage and investigation (Alert Zero) for the agentic SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared., freeing analysts from queue noise.

    4 details in Everything

44. Alert Zero: AI-driven alert triage and attack investigation for the agentic SOC (2026-07-31) Jul 31, 2026 · issue 031

    Elastic Security 9.5 ships Alert Zero: AI-driven alert triage, attack chain investigation, and SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. workflow integration.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Schedule Attack Discovery to run automatically inside an existing Elastic Workflow so investigations start without waiting for an analyst.
    📍In the Elastic Security console, go to Workflows, open or create a playbook, add a step using the Attack Discovery skill (retrieves alerts, generates discoveries, validates results), then configure a schedule trigger so the pipeline runs continuously throughout the shift.
    Enable AI-driven first-pass triage on specific detection rules and review classifications before optionally turning on auto-close.
    📍In Elastic Security 9.5, go to the Security alert analysis workflow, select the detection rules to enroll, choose the AI agent and model, set the confidence threshold, and leave auto-close disabled initially — review the notes and tags added to alerts to validate accuracy before enabling auto-close for high-confidence false positives.
    Review an AI-drafted ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis. detection rule surfaced by Attack Discovery's gap analysis, then explicitly approve it to close a coverage gap found during investigation.
    📍In the Attacks page under Detections, open an Attack Discovery result, navigate to the detection gap analysis section, review the drafted ES|QL rule, and click Approve to create the detection — no rule is added until you explicitly confirm.
    • Adds the Security alert analysis workflow for first-pass AI triage of alerts generated by selected rules, classifying them as true positive, false positive, or inconclusive with optional auto-close above a configurable confidence threshold.
    • Adds a new Attacks page under Detections that surfaces Attack Discovery results alongside Alerts, making correlated attack chains a first-class operational object.
    • Extends Attack Discovery with a skill-backed investigation pipeline (powered by Elastic Agent Builder and Elastic Workflows) that hunts for related activity, inspects entity context, and searches raw logs before generating an attack narrative.
    • Adds detection gap analysis inside Attack Discovery: when the investigation uncovers activity missed by existing detections, it drafts an ES|QL rule for analyst review and explicit approval before creation.
    • Enables Attack Discovery to run on a schedule or be triggered from within an Elastic Workflow, making deep investigation always-on without requiring manual analyst initiation.

    +3 more show less

    • Exposes new Elastic Workflows steps to manage alert and attack status, tags, and assignees from the canvas, and to run the full Attack Discovery pipeline as a workflow step.
    • Supports custom retrieval and validation workflows in Attack Discovery, enabling teams to connect external enrichment sources (e.g., VirusTotal, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. context) or proprietary entity data.
    • Supports bring-your-own AI model, including local LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. for air-gapped and sovereign deployments, for both alert triage and Attack Discovery.

    8 details in Everything

45. What's new in Elastic Defend: 800+ vulnerable driver rules, automated troubleshooting, and ARM support (2026-07-31) Jul 31, 2026 · issue 031

    Elastic Defend adds 800+ auto-generated vulnerable driver rules, ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. Windows support, and an AI troubleshooting skill in Agent Builder.

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Verify the open, automatically generated vulnerable driver rules before applying them to your environment.
    📍Browse https://github.com/elastic/protections-artifacts to review auto-generated vulnerable driver YARA rules published by Elastic Security Labs Threat Command.
    • Continuously monitors VirusTotal, LOLDrivers catalog, and Microsoft's Vulnerable Driver Block List to automatically generate and instantly deploy YARA-based endpoint protection rules for newly disclosed vulnerable drivers — decoupled from any release cycle and published openly in the elastic/protections-artifacts repository.
    • Expands vulnerable driver detection coverage from 65 rules (2023) to 800+ known vulnerable drivers, growing automatically as new drivers are disclosed.
    • Adds Automatic Troubleshooting as a conversational skill in Elastic Agent Builder, enabling natural-language diagnosis of endpoint policy failures, third-party antivirus conflicts, and performance issues with specific remediation guidance.
    • Extends Elastic Defend support to Windows on ARM, covering Snapdragon laptops, Copilot+ PCs, and ARM workstations with the same detection rules and telemetry as x64 endpoints, enrollable under existing policies.

    4 details in Everything

46. docs update Jul 29, 2026 · issue 029

    Elastic Security 9.5 adds automatic Microsoft Sentinel detection rule migration, translating Scheduled and NRTNRTNear-real-time processing, a design pattern where data is ingested and acted on within seconds to minutes rather than instantly or in batch, giving cyber tools low-latency detection without the cost of true real-time pipelines. rules via LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. in Tech Preview.

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Migrate Sentinel detection rules to Elastic Security without rebuilding them by hand.
    📍In the Elastic Security console, go to Security Launchpad › Manage Automatic Migrations, select your AI provider, expand 'Migrate your existing SIEM rules to Elastic', then choose Microsoft Sentinel from the top-right drop-down. Follow the prompts to export your Scheduled/NRT rules from Sentinel, upload them, and let Elastic handle translation including watchlists and severity mappings.
    • Adds automatic migration of Microsoft Sentinel Scheduled and Near Real Time (NRT) analytics rules into Elastic Security using an LLM of your choice, available in Tech Preview in 9.5.
    • Supports Watchlist-to-ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis. Lookup conversion and severity mapping carry-over during Sentinel rule migration.
    • Identifies required Elastic integrations from the Sentinel rule export alone, enabling data-onboarding planning before moving any logs.
    • Migration workflow is accessible via Security Launchpad > Manage Automatic Migrations, with per-rule status tracking (Installed, Translated, Partially translated, Not translated, Failed).

    4 details in Everything

47. docs update Jul 29, 2026 · issue 029

    Elastic Security adds automatic migration of Microsoft Sentinel detection rules to Elastic Security format.

48. docs update Jul 29, 2026 · issue 029

    Elastic Security 9.5 adds automatic migration of Microsoft Sentinel Scheduled and NRTNRTNear-real-time processing, a design pattern where data is ingested and acted on within seconds to minutes rather than instantly or in batch, giving cyber tools low-latency detection without the cost of true real-time pipelines. detection rules, watchlists, and severity mappings.

    └──▷ HOW TO FIND IT
    Start a Sentinel-to-Elastic rule migration by selecting your AI provider and uploading exported Sentinel rules through the Security Launchpad.
    📍In Elastic Security, go to Security Launchpad › Manage Automatic Migrations, select your AI provider, expand 'Migrate your existing SIEM rules to Elastic', then choose Microsoft Sentinel from the top-right drop-down and follow the prompts to export and upload your Sentinel rules.
    • Adds automatic migration of Microsoft Sentinel Scheduled and Near Real Time (NRT) analytics rules into Elastic Security using an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. of your choice (Tech Preview in 9.5).
    • Supports translation of Sentinel Watchlists to ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis. Lookups and carries over severity mappings during migration.
    • Identifies required Elastic integrations from uploaded Sentinel rule exports, enabling data-onboarding planning before moving a single log.
    • Provides per-rule translation status (Installed, Translated, Partially translated, Not translated, Failed) with inline edit-and-install workflow.
    • Works across multiple cloud providers and regions, allowing deployment closer to where data lives.

    +1 more show less

    • Integrates with Workflows and Agent Builder so that once migrated rules fire, multi-step remediation and enrichment automations can be triggered immediately.

    6 details in Everything

49. docs update Jul 29, 2026 · issue 029

    Elastic Security 9.5 adds automatic Microsoft Sentinel detection rule migration to Elastic Security via LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. translation (Tech Preview).

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Migrate your Sentinel detection rules to Elastic Security without rebuilding them by hand.
    📍In the Elastic Security console, go to Security Launchpad › Manage Automatic Migrations, select your AI provider, expand 'Migrate your existing SIEM rules to Elastic', then choose Microsoft Sentinel from the top-right drop-down. Follow the guided export flow, upload your Sentinel rule export, and optionally upload any detected Watchlists when prompted.
    • Adds automatic migration of Microsoft Sentinel Scheduled and Near Real Time (NRTNRTNear-real-time processing, a design pattern where data is ingested and acted on within seconds to minutes rather than instantly or in batch, giving cyber tools low-latency detection without the cost of true real-time pipelines.) analytics rules into Elastic Security using an LLM of your choice, eliminating manual rule rebuilding.
    • Translates Sentinel Watchlists to ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis. Lookups and carries over severity mappings during migration.
    • Provides per-rule translation status (Installed, Translated, Partially Translated, Not Translated, Failed) with guided upload flow via the Security Launchpad.
    • Identifies required Elastic integrations from rule exports alone, enabling data-source planning before any logs are moved.
    • Available across multiple cloud providers and regions in Tech Preview in Elastic Security 9.5.

    5 details in Everything

50. docs update Jul 29, 2026 · issue 029

    Elastic Security adds automatic migration of Microsoft Sentinel detection rules to Elastic Security format.

51. docs update Jul 29, 2026 · issue 029

    Elastic Security adds automatic migration of Microsoft Sentinel detection rules to Elastic Security.

52. docs update Jul 29, 2026 · issue 029

    Elastic Security adds automatic Microsoft Sentinel detection rule migration, eliminating manual rewrites.

53. Stop rewriting detection rules by hand: automatic Sentinel-to-Elastic migration is here (2026-07-29) Jul 29, 2026 · issue 029

    Elastic Security 9.5 adds automatic Microsoft Sentinel detection rule migration, translating Scheduled and NRTNRTNear-real-time processing, a design pattern where data is ingested and acted on within seconds to minutes rather than instantly or in batch, giving cyber tools low-latency detection without the cost of true real-time pipelines. analytics rules to Elastic via LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code..

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Start a Sentinel-to-Elastic rule migration to automatically translate your detection rules and plan data onboarding around what those rules actually require.
    📍In Elastic Security, go to Security Launchpad › Manage Automatic Migrations, select your AI provider, expand 'Migrate your existing SIEM rules to Elastic', and choose Microsoft Sentinel from the top-right drop-down. Follow the prompts to export rules from your Sentinel workspace and upload them.
    • Adds automatic migration of Microsoft Sentinel Scheduled and Near Real Time (NRT) analytics rules into Elastic Security using an LLM of your choice.
    • Supports Watchlists-to-ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis. Lookups conversion and Sentinel severity mapping during rule migration.
    • Identifies required Elastic integrations from exported Sentinel rules, enabling a rules-first migration path to plan data onboarding before moving logs.
    • Surfaces per-rule translation status (Installed, Translated, Partially translated, Not translated, Failed) in the Manage Automatic Migrations UI.
    • Available in Tech Preview in Elastic Security 9.5 across multiple cloud providers and regions.

    5 details in Everything

54. docs update Jul 27, 2026 · issue 027

    Elastic Security v9.4 adds Entity Analytics Watchlists to inject organizational risk context directly into entity risk scoring.

    • New Entity Analytics Watchlists let teams create named, weighted lists of users, hosts, and services that feed directly into the platform's risk scoring pipeline — no ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis. or pipeline configuration required.
    • Watchlist memberships compound with alert activity, asset criticality, and behavioral anomalies to produce a single prioritized risk score per entity.
    • Supports both manual curation and automated population via API, enabling integrations (e.g., HR systems) to add or remove entities as conditions change.
    • Allows creation of allow-list watchlists to dampen scores for known-safe entities, keeping analyst focus on genuine risks.

    4 details in Everything

55. docs update Jul 27, 2026 · docs issue 004

    Elastic Security v9.4 adds Entity Analytics Watchlists to inject organizational risk context directly into entity risk scoring.

    • New Entity Analytics Watchlists let teams create named, weighted lists of users, hosts, and services that feed directly into the platform's risk scoring pipeline — no ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis. or pipeline configuration required.
    • Watchlist memberships compound with alert activity, asset criticality, and behavioral anomalies to produce a single prioritized risk score per entity.
    • Supports both manual curation and automated population via API, enabling integrations (e.g., HR systems) to add or remove entities as conditions change.
    • Allows creation of allow-list watchlists to dampen scores for known-safe entities, keeping analyst focus on genuine risks.

    4 details in Everything

56. Azure AD Graph Activity Logs: Ingestion and threat detection to close the visibility gap (2026-06-19) Jun 19, 2026 · issue 001

    Elastic now ingests Azure AD Graph Activity Logs for SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. detection, closing a decade-long visibility gap on legacy AAD Graph enumeration.

    ⤢ ⤢ ⤢ ⤢
    └──▷ TRY IT
    Verify AAD Graph Activity Logs are flowing into Elastic and confirm ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. fields are populated after enabling the diagnostic setting.
    copy

    $ FROM logs-azure.aadgraphactivitylogs-* | LIMIT 20

    Enable the AzureADGraphActivityLogs diagnostic category in Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. so logs are forwarded to your Event Hub and ingested by Elastic.
    📍In the Azure portal, go to Entra ID › Monitoring › Diagnostic settings › + Add diagnostic setting. Under Logs, check AzureADGraphActivityLogs (and optionally MicrosoftGraphActivityLogs, SignInLogs, AuditLogs). Under Destination details, select Stream to an event hub pointing to the same hub configured in the Elastic Azure integration. Save.
    Force AAD Graph telemetry for ingestion testing by calling legacy graph.windows.net endpoints across common object types.
    copy

    $ TOKEN=$(az account get-access-token --resource https://graph.windows.net --query accessToken -o tsv)
    TID=$(az account show --query tenantId -o tsv)
    for obj in users groups servicePrincipals applications tenantDetails; do
      curl -sS -o /dev/null -H "Authorization: Bearer $TOKEN" \
        "https://graph.windows.net/$TID/$obj?api-version=1.6&\$top=5"
    done

    • Adds ingestion of AzureADGraphActivityLogs into Elastic via the Azure integration, landing events in logs-azure.aadgraphactivitylogs-* with full ECS extraction.
    • New dedicated Azure AD Graph Activity Logs integration item available for direct policy-template installation in Kibana.
    • Enables typed ECS fields (event.action, http.request.method, source.ip, user.id, user_agent.original) plus dataset-specific fields under azure.aadgraphactivitylogs.properties.* for AAD Graph telemetry.
    • Supports threat hunting across five detection patterns: known offensive tooling user-agents, endpoint breadth (bulk enumeration), *-internal API version misuse, FOCI client-ID mismatches, and 4xx surge detection.
    • Exposes azure.aadgraphactivitylogs.properties.api_version to flag callers requesting 1.61-internal, which returns strongAuthenticationDetail data not available via Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs..

    +2 more show less

    • Populates related.user with both user.id and properties.app_id, enabling simultaneous pivot on identity and OAuth client dimensions.
    • Retains raw JSON in event.original for forensic replay, queryable via ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis.'s JSON_EXTRACT().

    7 details in Everything

57. From API key to live threat detections in minutes: how Elastic Security ingests Google Threat Intelligence (2026-06-02) Jun 2, 2026 · issue 001

    Elastic Security adds native Google Threat Intelligence integration with prebuilt dashboards, indicator match rules, and agentic VirusTotal enrichment.

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Stand up continuous GTI-based detection in minutes by installing the integration from Kibana and enabling both data streams.
    📍In Kibana, go to Integrations catalog → search Google Threat Intelligence → Add integration → enter your GTI API key → enable Threat List (high-confidence detections) and IOC Stream (hunting coverage) → set polling frequency to match your API limits → Save.
    Pivot from a single IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. to all associated campaign infrastructure and hunt across historical telemetry using ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis. against the GTI threat intelligence data view.
    copy

    $ FROM logs-ti_google_threat_intelligence.* | WHERE threat.indicator.type == "ipv4-addr" AND google_threat_intelligence.threat_actor == "<actor-name>" | STATS count = COUNT() BY threat.indicator.ip, google_threat_intelligence.malware_family, google_threat_intelligence.score | SORT count DESC

    • New Google Threat Intelligence (GTI) integration ingests known-malicious IPs, domains, URLs, and file hashes into Elastic Security via two data streams — Threat List (high-confidence detections) and IOC Stream (broader hunting coverage) — with no additional infrastructure required.
    • Each ingested GTI indicator carries a verdict (Malicious, Suspicious, or Undetected), severity, and a composite 0–100 threat score, enabling confidence-based tuning of indicator match detection rules.
    • Supports 14 categorized GTI feed types including ransomware, infostealers, phishing, malicious infrastructure, IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. threats, macOS threats, threat actors, and vulnerability exploitation — coverage adjustable to subscription tier without Elastic configuration changes.
    • Automatic indicator lifecycle management handles expiration and revocation, reducing false positives from stale intelligence.
    • Prebuilt dashboards summarize threat intelligence activity across malware families, campaigns, threat actors, toolkits, and vulnerabilities to show which threat types are most active in the environment.

    +2 more show less

    • Agentic enrichment via Agent Builder and Elastic Workflows enables real-time VirusTotal queries, alert enrichment, telemetry correlation, and structured investigation summaries for indicators not yet in an indexed feed.
    • GTI indicators are normalized to Elastic Common Schema (ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping.) and stored in a dedicated threat intelligence data view, enabling ES|QL-based historical hunting and correlation alongside TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. feeds, custom intelligence, and endpoint/cloud telemetry.

    7 details in Everything