E

Attack Discovery

Application

by Elastic

An LLM-based application that analyzes security alerts, identifies potential attacks, and groups related alerts into attack narratives.

Find alternatives to Attack Discovery

What it does

• Threat detection and response

Features 4

• Attack narrativesEach discovery groups related alerts into an attack narrative with involved users and hosts.
• MITRE ATT&CK mappingShows how alerts map to the MITRE ATT&CK matrix and which threat actor might be responsible.
• Manual or scheduled runsRuns can start from the UI (manual or scheduled), an automated workflow, or an Elastic Agent Builder conversation.
• LLM connector supportRequires a configured LLM connector; Elastic Managed LLMs may be available with no setup.

Sources

Pricing

Pricing page · 15 Oct 2026

"billed based on usage"

Description

Official documentation · 15 Oct 2026

"analyze alerts and identify potential attacks."

What it does

Official documentation · 15 Oct 2026

"Each discovery groups related alerts into an attack narrative."

Sold within

Official documentation · 15 Oct 2026

"Attack Discovery (AI-powered alert correlation)"

Name

Official documentation · 15 Oct 2026

"Get started with Attack Discovery"

URL

Official documentation · 15 Oct 2026

"Get started with Attack Discovery"

Deployment

Official documentation · 15 Oct 2026

"Elastic Security on Elastic Cloud Serverless"

Also from Elastic

• Elastic AI Assistant Platform

  A conversational assistant embedded in Kibana that answers natural-language questions against a customer's own indexed data across Elastic's Observability, Security and Search solutions.

• Elastic Agent Builder Agent platform

  A builder for custom AI agents that answer questions and take actions over data indexed in Elasticsearch, using configurable tools, skills and prompts.

• Elastic AI SOC Engine Application

  An AI security-operations layer that correlates alerts from a customer's existing security tools, prioritizes threats and guides response workflows without replacing their SIEM.

• Elastic Workflows Agent platform

  An automation engine that runs both scripted steps and AI agents which reason through investigations and execute response actions against data in Elasticsearch.

• Elastic Inference Service Model API

  Hosted inference endpoint that runs Elastic-managed LLMs, the ELSER sparse-embedding model and third-party embedding models for ingest, search and chat without provisioning ML nodes in a customer's own Elasticsearch deployment.

• Elastic AIOps Application

  GenAI- and ML-driven capability inside Elastic Observability that automatically detects, diagnoses and helps resolve operational issues, providing recommended actions for SREs.

• Elastic LLM Observability Application

  Monitoring capability inside Elastic Observability for generative-AI and agentic applications: performance, cost control, guardrail tracking and reliability for GenAI workloads.

• Elastic Security Application

  Agentic security-operations platform unifying SIEM, XDR and native automation, with autonomous agents handling detection-to-response workflows and purpose-built AI skills for threat hunting, alert analysis and detection engineering; supports multiple LLMs including on-premises models.

• Elasticsearch Platform

  Stores structured, unstructured, and vector data.

• Elastic Observability Platform

  Uses machine learning to identify anomalies before they become incidents.

• Streams Application

  Uses AI to structure and enrich raw logs.

• Elastic Context Engine Infrastructure service

  Distills source data into context for retrieval by agents and applications.

Open Elastic in the directory

Something wrong here? Send a correction — quote this product id: elastic-attack-discovery.