Elastic announces native workflows built directly into Elastic Security

Elastic announced that Elastic Workflows, a native automation capability with direct access to alerts, cases, and investigation data, is now built directly into Elastic Security. By bringing native automation to the agentic security operations platform that already includes unified SIEM and XDR, Elastic is eliminating the “SOAR automation tax” by removing the need for a separate SOAR to turn insights into action.

Traditionally, security teams have relied on a standalone SOAR to automate investigation and response. This adds complexity, requiring extra vendors, integrations, and ongoing maintenance. In a security landscape where adversaries are using AI to execute attacks in minutes, organizations can no longer rely on a response workflow stitched together across several vendors. Elastic Workflows embeds automation directly within Elastic Security, giving teams the ability to act on alerts and security data quickly, all without the need for additional tools or extra add-ons.

“If you’re not using AI to fight AI, you’re already behind, and if you’re still relying on separate SOAR tools, you’re even further,” said Mike Nichols, general manager, Security at Elastic. “Elastic Workflows brings AI-driven automation directly to where data lives with no extra tools or integration overhead.”

Elastic Workflows allows analysts to execute scripted playbooks for consistent, repeatable responses alongside AI agents that reason through complex investigations. A single Workflow combines scripted automation with AI reasoning, helping teams respond effectively when an investigation doesn’t match a known pattern.

Built on the proven Elasticsearch Platform

Workflows gets its agentic capabilities through integration with Agent Builder, a native feature of Elasticsearch designed for building custom AI agents. Because Elastic Security is built on the Elasticsearch data and AI platform, agents reason with superior context, delivering more accurate results.