Automate security operations

Use workflows to close the loop between detection and response. When a detection or alerting rule fires, a workflow can enrich the alert with additional context, create or update a case, notify the right channel, and take follow-up actions, all without leaving Elastic.

This section describes common security automation patterns you can build with workflows today. Each pattern uses capabilities that already exist in the workflow engine: alert triggers, Elasticsearch action steps, Cases action steps, AI steps, and external system connectors.

The following patterns map directly to workflow building blocks:

• Respond to alerts automatically. An alert trigger starts the workflow when a detection rule or alerting rule fires. The full alert context is available as event.alerts[*], so later steps can query additional data, build case content, and route notifications based on alert fields.
• Create and populate cases. Cases action steps give you 27 step types to create cases, attach alerts and observables, assign on-call reviewers, and manage the case lifecycle. Use cases.createCase to open a case from the alert payload, then cases.addAlerts and cases.addObservables to attach supporting evidence.
• Route by severity or entity. Use if or switch steps to branch on alert severity, host, user, or rule name, and send notifications to different Slack channels, PagerDuty services, or Jira projects.
• Enrich alerts with external context. Use HTTP actions to pull data from threat intelligence APIs, CMDBs, or identity providers, then write the enriched record back to Elasticsearch or into the case body.
• Investigate with AI assistance. AI steps let a workflow classify alerts with ai.classify, summarize evidence with ai.summarize, or invoke an Elastic Agent Builder agent with ai.agent.
• Gate destructive actions on human approval. Use human-in-the-loop with the waitForInput step to pause for analyst confirmation before the workflow isolates a host or blocks a user.
• Stack Experimental 9.5+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Experimental since 9.5 This functionality is experimental and is not ready for production usage. Experimental features may change or be removed at any time. Elastic will work to fix any issues, but experimental features are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Serverless Experimental Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Experimental This functionality is experimental and is not ready for production usage. Experimental features may change or be removed at any time. Elastic will work to fix any issues, but experimental features are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Auto-triage alerts as true or false positives. Configure the managed Alert analysis workflow to analyze alert context with AI, write verdicts to notes and tags, and optionally auto-close high-confidence false positives.

Step-by-step guides for building the most common security automation workflows:

• Triage a security alert into a case: The full SOC triage loop. Enrich the alert, open a case, attach alerts and observables, isolate the host, and notify Slack.
• Triage alerts with an AI agent: Run an Elastic Agent Builder agent on Attack Discovery alerts, populate a case with the analysis, and post a summary to Slack.
• Enrich an alert with threat intelligence: A focused enrichment recipe you can run standalone or compose into a larger triage workflow.

• Managed workflows: Elastic-shipped workflows that power product features.
• Alert analysis workflow: Configure the managed workflow for AI alert classification.
• Alert triggers: Configure a detection or alerting rule to invoke a workflow.
• Cases action steps: 27 step types for working with Elastic Security cases.
• Kibana action steps: Reference for alert-management and other Kibana API actions.
• AI steps: Reference for ai.prompt, ai.classify, ai.summarize, and ai.agent steps.
• Human-in-the-loop: Pause for reviewer approval before destructive actions.
• Elastic Agent Builder for Elastic Security: How Agent Builder integrates with Security workflows.
• Call Elastic Agent Builder agents from Elastic Workflows: Detailed patterns for invoking AI agents from workflow steps.
• elastic/workflows GitHub repo: More security example workflows you can adapt.