What happened
On Oct 8, 2026 Elastic announced AlertZero, the agentic layer built into Elastic Security: a team of specialized agents (Triage, Hunt, Detection, Forensics Watches) that continuously triage, investigate, hunt, and tune detections, delivering evidence-backed answers toward an 'inbox zero' of recommended actions. It releases as a Technical Preview and works with any model across Elastic Cloud, self-managed, and air-gapped deployments; analysts retain control over what is automated.
Why it matters
AlertZero is Elastic's answer to the autonomous-SOC wave (Sekoia, Exabeam, Stellar Cyber, Elastic's agentic-leaning competitors), distinguishing itself with model-agnostic/air-gapped support and Watch-based delegation. Its Detection Watch proposes rule changes but requires approval, addressing analyst-trust concerns.
Applicability
Elastic Security customers should join the AlertZero Technical Preview to evaluate Watch-based agentic triage, especially air-gapped or multiple-model environments.