Výsledky hledání

výrobce: Elastic× téma: AI× v celém archivu zrušit filtry

36 karet z 36 položek CZ · EN/orig

1. 9. 2026 1

Linux Detection Engineering - Fileless Execution

Fileless execution on Linux has moved from niche tradecraft into real-world intrusion chains. By executing payloads from memory or anonymous file descriptors, attackers can reduce on-disk artifacts and weaken controls that rely heavily on file inspection.In our own analysis of VoidLink, we observed how fileless execution can be paired with a rootkit. The loader scans for processes running from memfd and passes their PIDs to the rootkit, allowing an already running fileless implant to be hidden…

tg: rozbor tg: propagace tp: malware tp: AI

Elastic Security · 1. 9. 16:26

25. 8. 2026 2

Inside Elastic's agentic SOC: How we took AI alert triage from 60% to 92% accuracy

AI verdict correctness in our security operations center (SOC) is 92%, up from 60%, but we didn't switch models to get there. What we changed is the context the agents get before they decide anything, including the detection rule's investigation guide and user risk data from Workday, along with the closure reasons from 30 days of past cases on that same rule. This post covers how the agentic SOC pipeline is built in Elastic Workflows and Elastic Agent Builder, down to the prompts and the…

tg: rozbor tg: propagace tp: AI

Elastic Security · 25. 8. 02:00

Inside Elastic's agentic SOC: How we took AI alert triage from 60% to 92% accuracy

AI verdict correctness in our security operations center (SOC) is 92%, up from 60%, but we didn't switch models to get there. What we changed is the context the agents get before they decide anything, including the detection rule's investigation guide and user risk data from Workday, along with the closure reasons from 30 days of past cases on that same rule. This post covers how the agentic SOC pipeline is built in Elastic Workflows and Elastic Agent Builder, down to the prompts and the…

tg: rozbor tg: propagace tp: AI

Elastic Security · 25. 8. 02:00

11. 8. 2026 2

13 million tool calls: auditing every AI coding agent action with Elastic Agent

We gave hundreds of developers an AI agent that can run shell commands, edit files, and call Model Context Protocol (MCP) servers on their laptops, then realized we had no record of what it actually did. So we built one. One 280-line dependency-free bash script, fired by Cursor's hooks, records every tool call as JSONL, and the Elastic Agent already on each endpoint ships it to Elasticsearch. Since the May rollout we have logged over 13 million tool-call events from more than 1,100 machines. A…

Cursor Elastic US

tg: rozbor tg: návod tg: propagace tp: AI

Elastic Security · 11. 8. 02:00

13 million tool calls: auditing every AI coding agent action with Elastic Agent

We gave hundreds of developers an AI agent that can run shell commands, edit files, and call Model Context Protocol (MCP) servers on their laptops, then realized we had no record of what it actually did. So we built one. One 280-line dependency-free bash script, fired by Cursor's hooks, records every tool call as JSONL, and the Elastic Agent already on each endpoint ships it to Elasticsearch. Since the May rollout we have logged over 13 million tool-call events from more than 1,100 machines. A…

Elastic Cursor US

tg: návod tg: propagace tp: AI

Elastic Security · 11. 8. 02:00

5. 8. 2026 1

Benchmarking the Agentic SOC: How we evaluate LLMs for security workflows

An agentic SOC is only as good as the model driving it. The moment you let an LLM triage an alert, hunt across your telemetry, or author a detection rule, the question stops being "is this a smart model?" and becomes something much more specific: will it pick the right skill, call the right tool in the right order, and reach the right disposition without inventing a result it never actually checked? That is not a question a general-purpose leaderboard can answer. A model can top every public…

tg: rozbor tg: propagace tp: AI

Elastic Security · 5. 8. 01:59

4. 8. 2026 3

Benchmarking the Agentic SOC: How we evaluate LLMs for security workflows

An agentic SOC is only as good as the model driving it. The moment you let an LLM triage an alert, hunt across your telemetry, or author a detection rule, the question stops being "is this a smart model?" and becomes something much more specific: will it pick the right skill, call the right tool in the right order, and reach the right disposition without inventing a result it never actually checked? That is not a question a general-purpose leaderboard can answer. A model can top every public…

tg: rozbor tg: propagace tp: AI

Elastic Security · 4. 8. 23:59

Agents vs. agents: how we triage HackerOne reports for $2 each, 85% as well as a human

Large language models (LLMs) made it trivially cheap to generate vulnerability reports. In the first half of 2026 alone, our HackerOne bug bounty program received over 1,390 reports, more than the full-year totals for 2024 and 2025 combined. Every one of them still requires human attention, so we decided to put agents against agents. If AI can generate reports at near-zero cost, AI should triage them at near-zero cost, too. The system we built agrees with human security engineers 85% of the…

tg: rozbor tg: propagace tp: AI

Elastic Security · 4. 8. 02:00

Agents vs. agents: how we triage HackerOne reports for $2 each, 85% as well as a human

Large language models (LLMs) made it trivially cheap to generate vulnerability reports. In the first half of 2026 alone, our HackerOne bug bounty program received over 1,390 reports, more than the full-year totals for 2024 and 2025 combined. Every one of them still requires human attention, so we decided to put agents against agents. If AI can generate reports at near-zero cost, AI should triage them at near-zero cost, too. The system we built agrees with human security engineers 85% of the…

tg: rozbor tg: propagace tp: AI

Elastic Security · 4. 8. 02:00

31. 7. 2026 3

Exploring the Hugging Face Breach: mapping AI agent tactics to Elastic Defend

Hugging Face reconstructed more than 17,000 attacker events from a July 2026 intrusion driven by an autonomous artificial intelligence (AI) agent. The path was familiar: untrusted dataset content abused a processing worker (file disclosure, then code execution), credential harvest, then multi-cluster lateral movement. Production Elastic Defend behavior rules and Elastic Security detection (SIEM) rules already watch those types of behaviors. This post maps each stage to detections you can enable…

Hugging Face OpenAI Elastic US

tg: incident tg: rozbor tg: propagace tp: únik dat tp: AI tp: identita

Elastic Security · 31. 7. 02:00

Alert Zero: AI-driven alert triage and attack investigation for the agentic SOC

It's 9 a.m. Monday, the start of your shift. You begin the day like any other Monday: You open the queue, and the wall of alerts is already waiting. New alerts land between 9:05 and 9:10 a.m., while you close yesterday’s. You're already drowning, and you haven’t even had a chance to refill your coffee. You know that you won’t be able to get to things that really need prioritization. Threat hunting stays deferred, and detection engineering waits. Incident response practice never quite starts.…

tg: novinka v produktu tg: propagace tp: AI

Elastic Security · 31. 7. 02:00

Alert Zero: AI-driven alert triage and attack investigation for the agentic SOC

It's 9 a.m. Monday, the start of your shift. You begin the day like any other Monday: You open the queue, and the wall of alerts is already waiting. New alerts land between 9:05 and 9:10 a.m., while you close yesterday’s. You're already drowning, and you haven’t even had a chance to refill your coffee. You know that you won’t be able to get to things that really need prioritization. Threat hunting stays deferred, and detection engineering waits. Incident response practice never quite starts.…

tg: novinka v produktu tg: propagace tp: AI

Elastic Security · 31. 7. 02:00

29. 7. 2026 2

Stop rewriting detection rules by hand: automatic Sentinel-to-Elastic migration is here

Elastic automatically translates your Microsoft Sentinel detection rules into Elastic Security. Export your Scheduled and Near Real Time (NRT) analytics rules from Sentinel, upload them, and Elastic picks up the mapping and translation from there using an LLM you choose. Watchlists and severity mappings carry over. This is the first automatic migration path off a modern SIEM, available now in Tech Preview in 9.5, and it works across multiple cloud providers and regions so you can deploy closer…

Elastic Microsoft US

tg: novinka v produktu tg: propagace tp: AI

Elastic Security · 29. 7. 02:00

Stop rewriting detection rules by hand: automatic Sentinel-to-Elastic migration is here

Elastic automatically translates your Microsoft Sentinel detection rules into Elastic Security. Export your Scheduled and Near Real Time (NRT) analytics rules from Sentinel, upload them, and Elastic picks up the mapping and translation from there using an LLM you choose. Watchlists and severity mappings carry over. This is the first automatic migration path off a modern SIEM, available now in Tech Preview in 9.5, and it works across multiple cloud providers and regions so you can deploy closer…

Elastic Microsoft US

tg: novinka v produktu tg: propagace tp: AI

Elastic Security · 29. 7. 02:00

27. 7. 2026 2

Inside Elastic InfoSec's agentic SOC: How we cut AI agent LLM calls by 60%

This is Part 3 of the Inside Elastic InfoSec's Agentic SOC series. Part 1: How we triage every alert before an analyst opens it · Part 2: Choosing the right agent architecture for a 5× cost reduction We run 14 AI agents in the Elastic InfoSec security operations pipeline. They were producing correct verdicts and taking up to 19 large language model (LLM) calls to do work that needed 8, at thousands of input tokens per call. At hundreds of runs per day, that compounds fast. We built a five-step…

tg: rozbor tg: návod tg: propagace tp: AI

Elastic Security · 27. 7. 02:00

Inside Elastic InfoSec's agentic SOC: How we cut AI agent LLM calls by 60%

This is Part 3 of the Inside Elastic InfoSec's Agentic SOC series. Part 1: How we triage every alert before an analyst opens it · Part 2: Choosing the right agent architecture for a 5× cost reduction We run 14 AI agents in the Elastic InfoSec security operations pipeline. They were producing correct verdicts and taking up to 19 large language model (LLM) calls to do work that needed 8, at thousands of input tokens per call. At hundreds of runs per day, that compounds fast. We built a five-step…

tg: rozbor tg: návod tg: propagace tp: AI

Elastic Security · 27. 7. 02:00

24. 7. 2026 2

Inside Elastic InfoSec's agentic SOC: When to inline your agent's skills for a 5× cost reduction

This is Part 2 of the Inside Elastic InfoSec's Agentic SOC series. Part 1: How we triage every alert before an analyst opens it. Part 3: how we cut AI agent LLM calls by 60%. Investigating a Windows endpoint alert in Elastic InfoSec's production agentic security operations center (SOC) costs $0.69. That's what we pay running an orchestration workflow of specialized Elastic AI agents on the Elastic Inference Service (EIS). Route the same alert to a single agent working through 14 skills, and the…

tg: rozbor tg: návod tg: propagace tp: AI

Elastic Security · 24. 7. 02:00

Inside Elastic InfoSec's agentic SOC: When to inline your agent's skills for a 5× cost reduction

This is Part 2 of the Inside Elastic InfoSec's Agentic SOC series. Part 1: How we triage every alert before an analyst opens it. Part 3: how we cut AI agent LLM calls by 60%. Investigating a Windows endpoint alert in Elastic InfoSec's production agentic security operations center (SOC) costs $0.69. That's what we pay running an orchestration workflow of specialized Elastic AI agents on the Elastic Inference Service (EIS). Route the same alert to a single agent working through 14 skills, and the…

tg: rozbor tg: návod tg: propagace tp: AI

Elastic Security · 24. 7. 02:00

23. 7. 2026 2

How Elasticsearch ES|QL COMPLETION turns noisy curl and wget rules into high-fidelity cloud security alerts

We ran a noisy wget detection rule on Elastic's own cloud fleet for seven days. Three destinations survived deterministic filtering, Elasticsearch Query Language (ES|QL) COMPLETION triaged all three, and none of them created an alert that an analyst had to open. Each rule parses the destination from curl and wget executions, filters known-good hosts, redacts secrets, and then hands whatever’s left to a large language model (LLM) for a triage verdict. File transfer detections stay on in cloud…

tg: návod tg: propagace tp: AI

Elastic Security · 23. 7. 02:00

How Elasticsearch ES|QL COMPLETION turns noisy curl and wget rules into high-fidelity cloud security alerts

We ran a noisy wget detection rule on Elastic's own cloud fleet for seven days. Three destinations survived deterministic filtering, Elasticsearch Query Language (ES|QL) COMPLETION triaged all three, and none of them created an alert that an analyst had to open. Each rule parses the destination from curl and wget executions, filters known-good hosts, redacts secrets, and then hands whatever’s left to a large language model (LLM) for a triage verdict. File transfer detections stay on in cloud…

tg: rozbor tg: návod tg: propagace tp: AI

Elastic Security · 23. 7. 02:00

2. 7. 2026 2

Inside Elastic InfoSec's agentic SOC: cutting alert triage from 30 minutes to under 3

This is Part 1 of the Inside Elastic InfoSec's Agentic SOC series. Part 2: choosing the right agent architecture for a 5× cost reduction. Part 3: how we cut AI agent LLM calls by 60% Elastic's InfoSec team built an agentic SOC that triages every alert before an analyst opens it. A 30-minute manual investigation now finishes in under 3 minutes: deterministic ES|QL queries close obvious false positives at zero token cost, specialized AI agents investigate the rest across endpoint, cloud, and SaaS…

tg: rozbor tg: propagace tp: AI

Elastic Security · 2. 7. 02:00

Inside Elastic InfoSec's agentic SOC: cutting alert triage from 30 minutes to under 3

This is Part 1 of the Inside Elastic InfoSec's Agentic SOC series. Part 2: choosing the right agent architecture for a 5× cost reduction. Part 3: how we cut AI agent LLM calls by 60% Elastic's InfoSec team built an agentic SOC that triages every alert before an analyst opens it. A 30-minute manual investigation now finishes in under 3 minutes: deterministic ES|QL queries close obvious false positives at zero token cost, specialized AI agents investigate the rest across endpoint, cloud, and SaaS…

tg: rozbor tg: propagace tp: AI

Elastic Security · 2. 7. 02:00

23. 6. 2026 1

From vulnerability report to CVE draft in minutes: how Elastic automated security advisories with AI

Elastic's InfoSec Product Security Team built a generative AI agent using Elastic Agent Builder that drafts complete CVE security advisories (CWE classification, CAPEC methodology, CVSS scoring, and mitigation guidance) directly from raw vulnerability reports. The agent uses RAG against the MITRE CWE and CAPEC catalogues indexed in Elasticsearch, which grounds its output in authoritative data and prevents hallucinated classification IDs. ESA-2026-01 is already in production as an example of…

tg: rozbor tg: propagace tp: AI

Elastic Security · 23. 6. 02:00

2. 6. 2026 1

From API key to live threat detections in minutes: how Elastic Security ingests Google Threat Intelligence

Elastic Security natively ingests Google Threat Intelligence: known-malicious IPs, domains, URLs, and file hashes matched against your telemetry the moment they appear, each carrying a verdict and a 0–100 threat score. The setup consists of an API key and two data streams, with no extra infrastructure. When an indicator is ambiguous, workflows built on Agent Builder query VirusTotal in real time, enrich the alert, correlate with your telemetry, and summarize findings in real time. How threat…

tg: novinka v produktu tg: propagace tp: AI

Elastic Security · 2. 6. 02:00

12. 5. 2026 1

Elastic Security MCP App: Interactive security operations inside your AI Tools

Every SOC analyst knows the drill: an alert fires, and the next ten minutes are spent switching between a triage dashboard, a threat hunt, a case file, and the AI tool that told you to look in the first place. Recently, we introduced MCP Apps for Elastic, built on the open MCP Apps extension to the Model Context Protocol, that lets an MCP tool return an interactive UI alongside its text response, rendered inline in Claude Desktop, Claude.ai, VS Code Copilot, Cursor, or any compatible host. This…

tg: novinka v produktu tg: propagace tp: AI

Elastic Security · 12. 5. 02:00

5. 5. 2026 2

Elastic Workflows GA: automation where your security data already lives

Elastic Workflows is generally available in 9.4. It is the automation layer built directly into Elastic, running where your data lives across Security, Observability, and Search. While this post focuses on a security deep dive, the same workflow capabilities apply across solutions, with no separate platform to deploy and no data to move. When an alert fires or a schedule triggers, a Workflow executes: querying Elasticsearch, enriching with threat intel, creating cases, calling external APIs,…

tg: novinka v produktu tg: propagace tp: AI

Elastic Security · 5. 5. 02:00

AI-generated hunting leads: The hunt starts before you ask the question

Threat hunting has always been a human art; a practitioner staring at logs, forming a hypothesis, and patiently chasing it down. What if the hardest part of the hunt (knowing where to look) could be done for you, automatically, in milliseconds, and tuned specifically to your environment? This is where AI-generated hunting leads come in, allowing you to shift from reactive alerting to proactive defense with entity-centric, risk-based threat hunting tailored specifically to your environment's…

tg: novinka v produktu tg: propagace tp: AI

Elastic Security · 5. 5. 02:00

4. 5. 2026 3

From plain English to production rule: AI-native Elasticsearch ES|QL detection in Elastic Security

Elastic Security now includes AI-powered detection rule creation, built into the rule creation workflow. Analysts describe a threat behavior in plain English and receive a complete, validated Elasticsearch Query Language (ES|QL) rule in return, with MITRE ATT\&CK mappings, severity recommendations, and a preview against live data, all without leaving the platform or writing a single line of query syntax. This post walks through exactly how that works using an Okta credential stuffing and…

tg: novinka v produktu tg: propagace tp: AI

Elastic Security · 4. 5. 02:00

Elastic Conversational Entity Analytics: threat hunting in a single conversation

Entity Analytics is a core security analytics capability that extends Elastic Security from event-centric to entity-centric investigation. By focusing on critical entities, such as users, hosts, and services, it builds a complete profile of each entity’s attributes, lifecycle, behaviors, relationships, and risk score over time. This security context equips threat hunters to stop chasing isolated alerts and instead uncover the full narrative of a potential compromise. In this blog, we walk…

tg: novinka v produktu tg: propagace tp: AI

Elastic Security · 4. 5. 02:00

One agent, the right skills: Elastic Security 9.4 brings domain expertise on demand to every SOC workflow

Three things land on you at once: Attack Discovery correlated 12 alerts into a credential-harvesting campaign overnight, your team just onboarded a new fleet of macOS endpoints and needs detection rules for LOLBin abuse, and a risk score spike on a service account just crossed the critical threshold. In most security operations centers (SOCs), that's three different people, three different workflows, and a morning spent context-switching. In Elastic Security 9.4, it's one conversation. You open…

tg: novinka v produktu tg: propagace tp: AI

Elastic Security · 4. 5. 02:00

25. 4. 2026 1

Monitoring Claude Code/Cowork at scale with OTel in Elastic

As AI coding assistants become standard tools in engineering workflows, security teams face a new challenge: how do you maintain visibility into what an AI agent is doing (and why) across your organization? When those agents can execute shell commands, read files, call APIs, and interact with internal systems via MCP connectors, you need real-time observability to support threat detection, incident response, and compliance. This post walks through how Elastic's InfoSec team built a monitoring…

Anthropic Elastic US

tg: návod tg: propagace tp: AI

Elastic Security · 25. 4. 02:00

24. 3. 2026 3

Investigating from the Endpoint Across Your Environment with Elastic Security XDR

Preamble Security investigations rarely stay confined to a single host. Today’s attackers increasingly use automation and AI to compress multi-stage attacks into minutes, turning what once unfolded over days into coordinated activity across endpoints, identities, workloads, and cloud services within minutes. While many attacks begin on an endpoint, investigators must quickly determine how that activity spreads across the environment. In many environments, per-endpoint licensing limits how…

tg: návod tg: propagace tp: AI

Elastic Security · 24. 3. 01:00

Streamlining the Security Analyst Experience

The term Agentic SOC (Security Operations Center) is one of the most popular concepts in security today. But what does it truly mean in practice, and how does Elastic Security approach this next evolution of security operations? In simple terms, an Agentic SOC is a security operations center that has deployed AI Agents and corresponding AI Agent Skills to perform SOC-related workflows such as detection engineering, alert triage, incident investigation, escalation, response, and threat hunting.…

tg: návod tg: propagace tp: AI

Elastic Security · 24. 3. 01:00

Supercharge Your SOC

Preamble The landscape of cybersecurity is evolving, and the role of the Detection Engineer (DE) is more critical and demanding than ever. Traditionally, this role involves a comprehensive, end-to-end workflow: from threat modeling and telemetry tuning to writing, testing, and maintaining performance-optimized detection rules to flag malicious behavior. Elastic Security is purpose-built to streamline this entire workflow, empowering DEs - and anyone involved in security operations - to build,…

tg: návod tg: propagace tp: AI

Elastic Security · 24. 3. 01:00

17. 3. 2026 1

Get started with Elastic Security from your AI agent

Get started with Elastic Security from your AI agent Elastic Agent Skills are open source packages that give your AI coding agent native Elastic expertise. If you're already using Elastic Agent Builder, you get AI agents that work natively with your security data. Agent Skills are for the other side: bringing that same Elastic Security knowledge to the external AI tools your team already uses, like Cursor, Claude Code, or GitHub Copilot. If you use an AI coding agent and want to evaluate…

tg: novinka v produktu tg: propagace tp: AI

Elastic Security · 17. 3. 01:00

13. 3. 2026 1

Managing Elastic Security Detection Rules with Terraform

At the core of Elastic Security lie outstanding detection capabilities, allowing users to create, test, tune, manage, deploy detection rules, as code, in their environments. The ability to create robust detections is critical for Security Operations as detection logic elevates threat signal from the telemetry noise. This article highlights how Elastic's new Terraform resources for security detection rules and exceptions expand practitioners' capabilities for detection-as-code deployment. Below…

tg: novinka v produktu tg: návod tg: propagace tp: AI

Elastic Security · 13. 3. 01:00