Problem Solved
Security Operations Centers face a critical scaling crisis. The average SOC receives over 10,000 alerts per day, but human analysts can realistically investigate only a small fraction. This creates alert fatigue - analysts become desensitized, threats slip through undetected, and mean time to respond stretches into hours. The result is a dangerous gap between alert volume and investigation capacity. SentinelOps solves this by deploying three AI agents that automate the entire alert lifecycle: triage, investigation, and incident response. What takes a human analyst approximately 55 minutes, SentinelOps completes in roughly 25 seconds — a 130x speedup — ensuring every alert receives proper analysis.
Features Used
SentinelOps leverages the core capabilities of Elastic Agent Builder extensively:
• Custom ES|QL Tools (7 tools): Parameterized ES|QL queries for alert retrieval, high-severity filtering, IP alert history, network traffic profiling, authentication pattern analysis, threat intelligence lookups, and incident case summaries. Each tool targets a specific security operation and uses ES|QL's aggregation and filtering capabilities.
• Custom Workflow Tools (3 tools): Workflow tools that allow agents to trigger multi-step Elastic Workflows directly from conversation, bridging chat-based reasoning with automated pipelines. • Elastic Workflows (3 workflows): Multi-step automations combining elasticsearch.search, elasticsearch.request, ai.agent, and console step types. Workflows handle alert triage automation, threat investigation orchestration, and incident response with case creation and audit logging.
• Multi-Agent Architecture (3 agents): A Triage Agent for alert classification, an Investigation Agent for cross-source correlation and risk scoring, and a Response Agent for incident case management. Each agent has tailored system prompts, specialized tool assignments, and access to built-in platform tools like execute_esql, search, and cases.
• Fully Programmatic Setup: Everything is created via the Kibana API using Python scripts - no manual interaction on UI required.
Features Liked and Challenges
The feature I liked most was the workflow and agent integration. Being able to embed an ai.agent step inside an Elastic Workflow means you can combine deterministic data retrieval with LLM-powered reasoning in a single pipeline. This is genuinely production-grade orchestration, not just a chatbot wrapper. I also appreciated how parameterized ES|QL tools let agents pass dynamic values (like an IP address) into pre-built queries. This gives agents structured, reliable data access without risking hallucinated queries.
The biggest challenge was also the Elastic AI Agent platform that don't support custom code (like python) and don't support images that limit may possibility. The next one is designing the prompt with lean structure, high density of information and following standard SOC procedure to make a stable agent.
Log in or sign up for Devpost to join the conversation.