Fight Smarter: Accelerate Your SOC with AI Discovered Attacks
summary
Elastic shows an actual pipeline: ingest alerts (including SentinelOne), run retrieval augmented generation against a vector store, and collapse 114 noisy alerts to one discovery made of 11 alerts, with a natural‑language summary, MITRE ATT&CK chain, an automated remediation plan, one‑click case creation and an ESQL hunt query that runs on the timeline. The demo uses public LLMs (GPT‑4/Claude/Mistral options), is rolling out as Attack Discovery in technical preview, and the live demo succeeds at prioritizing and operationalizing real detections.
AI-written summary · about
chapters (7)
- 0:00The challenge of alert fatigue
- 3:09Evolving the SOC with AI
- 7:29Retrieval augmented generation
- 10:43Addressing AI concerns
- 14:01Attack discovery demo
- 25:40Elastic security ecosystem
- 27:19Q&A and closing discussion
related talks
45mAdvanced Security Operations with Elastic Security
20mCatch Attackers Before They Strike with AI-powered Threat Intelligence
17mOutpace Cyber Threats with Agentic AI + Human Ingenuity
29mThresholds Are for Old Threats: Demystifying AI and Machine Learning to Enhance SOC Detection
28mSupercharging Threat Intelligence with AI
30mFrom Zero to a DevSecOps Hero: Extending Microsoft Sentinel
30mSpotting Threats with Elastic SIEM
28mScaling Your Defenses: Next Level Security Automation for Enterprise