Synthèse
The specialized agent workflow runs in production for automated alert triage at Elastic InfoSec. Every alert from our detection rules passes through the workflow, gets enriched by ES|QL queries, and routes to the appropriate specialized agents before an analyst opens it. For the full pipeline walkthrough, see Part 1: How we triage every alert before an analyst opens it. The single agent with skills is available in our environment for analyst-led investigation. It handles conversational pivots an
The specialized agent workflow runs in production for automated alert triage at Elastic InfoSec. Every alert from our detection rules passes through the workflow, gets enriched by ES|QL queries, and routes to the appropriate specialized agents before an analyst opens it. For the full pipeline walkthrough, see Part 1: How we triage every alert before an analyst opens it. The single agent with skills is available in our environment for analyst-led investigation. It handles conversational pivots and follow-on questions in ways the specialized workflow does not, and it gives the analyst flexibility to investigate a single alert, work across multiple domains in one session, hunt threats using indicators, or generate an executive summary for a case.
Source originale
link_tbd