About 3 years ago, we were trying to figure out what it meant to start to leverage Generative AI within a security operations team. ChatGPT took the world by storm, and for the first time we had a machine model where natural language was the primary interaction, democratizing the technology. In June 2023, we launched the first flavor of the AI Assistant, as we wanted to see what value that would start to provide. LLMs were still really developing. GPT-4 was the standard, with a max of 32,000 tokens. You could ask questions to help out in day to day. A new paradigm for teams, which was already showing some promise - but it was clear that it would be a while before it could really be put into practice.
As we continued to develop the chat experience, and add more functionality, we wanted to start going beyond chat. About a year later, in May 2024, we launched Attack Discovery (patent pending) - a process that leverages LLMs to perform triage over alerts in bulk, and output any findings in a dedicated interface - not chat. Anthropic's Claude 3 family of models had just landed, and it was clear, with the results we were getting from Attack Discovery, that we can keep pushing the limits of these models even further. It also became clear that evaluations were a necessity to ensure quality over time.
Throughout the rest of 2024 and 2025, we launched Automatic Import, Automatic Migration and Automatic Troubleshooting - all dedicated features that leverage LLMs to help users with time consuming and difficult tasks. The AI Assistant got a ton of new capabilities, and we switched the architecture to use LangChain's LangGraph library - and added the first agent, which allowed users to use knowledge sources as part of the agent graph (even though agents weren't cool back then). We also added sub-agents for Query generation. Attack Discovery also pivoted to leverage agents under the hood too. We also launched EASE, a dedicated deployment type in our SaaS offering to consolidate all the AI features we had, in order to leverage them more effectively with 3rd party system alert, for those still living with other SIEM and/or EDR products.
In 2025, we saw MCP and other technologies really take off. Teams really started to grasp why this technology is useful. It started to become clearer and clearer that actions and the ability to interact with other systems in a secure way was key to be able to leverage AI efficiently and effectively in a SOC team. It also became evident that the reasoning, or thought process, is critical to be able to trust these agents in production. We also saw LLMs dramatically improve, especially towards the tail end of 2025. The conversations shifted from "we don't really know how we would use Generative AI in our SOC" to, "We want to achieve this end to end agentic flow to help improve our processes - how can we do it with Elastic?"
Between the 500-600 customer feedback sessions and interactions I've had in the last 1.5 years or so, one thing really started to become evident - users wanted more control, customization and insight into these AI and Agent processes.
So, about 10 months ago or so, we started to re-think some of these features. We worked with our search and platform team to re-think how we define agents within the stack overall. A few months into this process, we joined forces with Keep, and immediately began to see how we will be tying the two stories together - how do we bring automation to agents, and vice versa. We worked with our design team to improve the conversational elements and so much more. Agent Builder became generally available just recently.
Which leads us to today, with our 9.3 announcement, and the rest of my LinkedIn Post.