Attack Discovery

Attack Discovery uses large language models (LLMs) to analyze alerts and identify potential attacks. Each discovery groups related alerts into an attack narrative. It shows which users and hosts are involved, how alerts map to the MITRE ATT&CK matrix, and which threat actor might be responsible. Use discoveries to prioritize investigation and shorten mean time to respond.

You can start a run from the UI (manual or scheduled), from an automated workflow, or from an Elastic Agent Builder conversation. All methods use the same analysis steps. To act on the attacks you confirm, refer to Respond and contain.

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. To have AlertZero take an attack from discovery to containment, with a forensics report and proposed response actions, refer to Respond to an attack.

For a demo, refer to the following video (click to view).

Note

Attack Discovery requires at least one configured LLM connector. If your subscription or project includes Elastic Managed LLMs, one may already be available with no setup required. Otherwise, refer to Configure access to LLMs to add one.

We recommend using one of the models in the Large language model performance matrix for Attack Discovery.

Information included in each discovery

Each discovery includes the following information describing the potential threat, generated by the connected LLM:

A descriptive title and a summary of the potential threat.
The number of associated alerts and which parts of the MITRE ATT&CK matrix they correspond to.
The implicated entities (users and hosts), and what suspicious activity was observed for each.

Get started with Attack Discovery

Choose how to start a run from the Attacks view, a workflow, Elastic Agent Builder, or the Attack Discovery page in Run Attack Discovery.