Elastic AlertZero Enters Technical Preview With Four SOC Watches Behind Human Approval Gates

AUSTIN - Elastic on Oct. 8, 2026 put AlertZero into Technical Preview as an agentic layer inside Elastic Security, organizing automated SOC work into four named Watches that propose evidence-backed actions while leaving consequential changes to a human. In an Elastic Security Labs post the same day, product design lead James Spiteri describes Triage, Hunt, Detection, and Forensics Watches that run on triggers and schedules, write findings into a shared Investigation record, and surface Proposed Actions for approval, modification, escalation, or dismissal. Elastic's investor release frames the goal as inbox zero for the alert queue: a short list of recommended actions instead of thousands of raw alerts. Analysts choose how much to delegate and which model to use, including in Elastic Cloud, self-managed, and air-gapped deployments.

Each Watch stays in a defined lane. Triage Watch enriches alerts, decides true or false, closes noise with a reason, and escalates real findings, using Attack Discovery to connect related alerts into attack narratives. Hunt Watch continuously searches telemetry against threat research without waiting for a detection to fire. Detection Watch reviews noisy rules and coverage gaps and prepares rule changes for review; it will not change a rule without approval. Forensics Watch examines endpoint activity for malware analysis and exploit paths when a finding needs specialist depth. Within each Watch, Workers implement specific tasks as Elastic Workflows that call Agent Builder agents and skills. Autonomy is configurable per Worker as manual, assisted, or supervised, and Spiteri writes that every consequential action is still proposed for analyst approval at every level.

The Labs walkthrough uses an impossible-travel finding on an executive account, cfo@corp, to show Triage and Forensics working together. Before an analyst opens the Proposed Actions page, the Watches have already assembled evidence: the account was active in Boston and then, 39 minutes later, from a distant hosting network on the same session identifier without a fresh multifactor authentication event, and an unsigned process on the endpoint was accessing browser session material. The example Proposed Action under Respond is host isolation through Elastic Defend. In manual endpoint mode, the analyst reviews the target, rationale, and likely impact before approving or declining; supervised mode is designed to permit host isolation, process termination, and process suspension without an extra click for each action, while detection rule changes continue to require approval. Escalations let teammates link Investigations into one conversation and ask follow-up questions of an agent or keep the thread human-only for sensitive cases.

On the detection-engineering side, the Detection Watch can rank rules by recently closed false-positive alerts with an ES|QL query over the security alerts index, then prepare a Proposed Action that packages the diagnosis, sample alerts, current and proposed logic, and a backtest. In the Labs example, five sample false positives no longer match the revised query after the change; Spiteri notes that a benign-only backtest does not by itself prove attack coverage is preserved, so a detection engineer still validates known malicious activity through the team's existing testing process before approving. Hunt findings can also feed Detection Watch by asking whether existing rules would catch the observed behavior.

For SOC teams evaluating agentic tooling after Cloudflare's Managed Defense harness and similar platforms, AlertZero's published design is a governance brief as much as a product preview: named responsibilities, per-Worker autonomy, Proposed Actions with audit trails that record decision and execution outcome separately, and an explicit rule that Detection Watch will not edit detections silently. Elastic's Oct. 8 investor materials cite a recent high-profile attack in which an autonomous AI agent generated more than 17,000 events across a production environment in four days, arguing that individual signals were detectable but that understanding the attack required connecting them. Elastic says customers can extend the same Agent Builder skills and Elastic Workflows used to build AlertZero. No general availability date or separate AlertZero price appears in the Oct. 8 materials. The release builds on Attack Discovery, ES|QL, Agent Builder, and Elastic Workflows already in Elastic Security.