April 2025 Summaries

Elastic has introduced Automatic Migration, a feature designed to simplify the transition from existing SIEMs to Elastic Security by leveraging generative AI to map and translate detection rules, as outlined by Charles Davison and Mark Settle. This new capability, part of Elastic Security versions 8.18 and 9.0, aims to reduce the complexity and effort involved in migrating SIEM content by utilizing semantic search powered by the ELSER natural language processing model. Initially, Automatic Migration focuses on Splunk, with plans to support additional SIEMs and artifacts in the future. The feature uses AI to map existing detection rules to Elastic's prebuilt ones, translating unmatched rules into new Elastic queries and validating them for functionality. Elastic has tested Automatic Migration with real-world rulesets and offers it in technical preview to customers with specific licenses, enabling a faster, streamlined migration process.

Financial institutions are increasingly adopting AI technology to enhance fraud detection capabilities, with 91% of US banks using AI for this purpose and 83% of anti-fraud professionals planning to incorporate Generative AI (GenAI) by 2025. At the Financial Services Summit, experts discussed the dual role of AI as both a defensive and offensive tool in fraud prevention, with financial services needing to react in real-time to evolving fraud patterns. The use of AI enables rapid summarization and analysis of potential fraud events, significantly reducing response times, as demonstrated by PSCU's partnership with Elastic, which saved $35 million in fraud losses and reduced response times by 99% for 1,500 credit unions. However, as criminals also leverage AI for their schemes, success in fraud prevention will require a balanced integration of classical machine learning, GenAI approaches, and human oversight. The industry's focus is on combining automation, AI, and data to enhance customer protection, while ensuring proper governance and security management for successful implementation.

Elastic has introduced the LOOKUP JOIN function in its Elasticsearch Query Language (ES|QL), enabling efficient data joining within search workflows, which is particularly beneficial for threat hunting, alert triage, and incident response in security operations. This new function allows security analysts to integrate external data seamlessly into their queries without the need for preprocessing or managing enrichment jobs, thereby enhancing the context and speed of investigations. The LOOKUP JOIN function facilitates the correlation of data across multiple sources, helping analysts prioritize alerts by comparing them with threat intelligence feeds and enabling incident responders to connect fragmented information in real time. By incorporating ES|QL's LOOKUP JOINs, Elastic aims to streamline data analysis processes, allowing for more effective detection and response to security threats while maintaining an intuitive and flexible search environment.

In the evolving landscape of financial services, reliance on manual review alone is no longer viable for detecting risks and ensuring compliance, as firms contend with vast amounts of communication data that must be monitored to prevent financial crime and misconduct. A collaboration between Fingerprint and Elastic addresses these challenges by integrating explainable AI and unified data architectures, enabling firms to process millions of communications efficiently. This approach not only enhances compliance oversight from a mere 2%-3% to full coverage but also reduces costs and boosts productivity for compliance teams through automation. As global regulatory demands increase, financial institutions are investing heavily in AI-driven tools to navigate complex environments, with Gartner projecting a doubling of such investments by 2027. Unifying data sources and leveraging AI, as demonstrated by FICO's use of Elastic for advanced analytics, allows for real-time risk detection and improved decision-making, marking a significant shift in how financial services manage compliance and risk.

Elastic Security Labs has released the 2025 State of Detection Engineering report, providing an unprecedented look into the company’s detection engineering processes. This report reveals details about how Elastic creates, maintains, and assesses its Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) rulesets. Elastic Security Labs is committed to transparency, offering over 2,300 expert-written detection rules aligned with the MITRE ATT&CK framework, which are regularly updated and tuned by security researchers. The report highlights Elastic's dedication to innovating detection engineering and empowering the security community, showcasing internal methodologies, real-world threat analyses, and future plans. Through this openness, Elastic aims to foster a broader discussion around detection engineering and enhance the understanding and effectiveness of its security solutions.

Elastic has announced the general availability of its Cloud Serverless solution on Google Cloud, specifically in the Iowa (us-central1) region, providing a swift method for launching and scaling security, observability, and search solutions without the need for infrastructure management. This service is built on the innovative Search AI Lake architecture, utilizing Google Cloud Storage to offer vast storage capabilities, separate storage and computing functions, low-latency querying, and advanced AI features. Elastic Cloud Serverless is designed to dynamically scale according to workload demands, automatically adjusting to traffic spikes while maintaining low-latency search capabilities, all without the operational burden of managing clusters or nodes. It offers a usage-based pricing model and a streamlined, purpose-built workflow to accommodate unique use cases, with plans to extend availability to more Google Cloud regions and introduce additional features in the future. Users can easily create projects for observability, security, or Elasticsearch by signing up or logging into the Elastic Cloud console, choosing Google Cloud as the provider, and selecting the Iowa region.

Elastic has introduced a new Privileged Access Detection package as a technical preview in Kibana versions 8.18 and 9.0, designed to detect suspicious privileged access activities across Windows, Linux, and Okta environments. Utilizing machine learning, the package establishes baseline behaviors to identify anomalies in privileged account activities, such as unusual access patterns or multiple concurrent sessions from the same account, which could signal unauthorized use. The package's workflow involves data preparation, featurization, and machine learning, with features transformed from raw event logs being analyzed to detect anomalous behavior. It includes 21 anomaly detection jobs and dedicated dashboards to help security teams investigate and address detected anomalies efficiently. This integration aims to enhance organizational security by identifying deviations from typical usage patterns in hybrid IT environments, allowing for more proactive threat detection and response.

Generative AI (GenAI) is transforming the banking sector by enhancing customer experiences, operational efficiency, and decision-making, as explained by Tim Brophy at the Elastic Financial Services Summit. GenAI enables smarter transaction searches, improves chatbot interactions, and delivers personalized recommendations by utilizing semantic search and real-time knowledge bases. Despite its potential to significantly boost global banking profits, only a quarter of banks are prepared for GenAI adoption due to inadequate data management platforms. The use of AI in banking is evolving towards specialization, particularly in compliance and fraud detection, with examples from companies like EY demonstrating the technology’s capability to provide faster, more accurate responses. This technological shift highlights the necessity for banks to integrate AI solutions to better understand and meet customer needs through context-aware searches and personalized services, while also emphasizing the importance of cautious use of AI tools to protect sensitive data.

In a transformative move, BBVA, one of Spain's largest multinational banks, utilized Elastic's search engine technology to unify over 45 billion data points across more than 50 banking services, significantly enhancing customer experience and operational insight with sub-second response times. Initially facing challenges such as performance lags and scalability issues when Elastic was in its early stages, BBVA's strategic implementation enabled customers to access nearly 20 years of transaction history with efficient search capabilities. This shift from fragmented systems to a centralized data backbone has allowed BBVA to maintain high service levels and explore cost-effective solutions like Elastic's frozen data tier. BBVA's journey underscores the potential of Elastic's technology to evolve from a log engine into a mission-critical platform for banking operations, demonstrating its capability to handle complex financial transactions efficiently and cost-effectively.

Elastic Defend has significantly reduced its data volume while maintaining its protection level and visibility, addressing the challenges of excessive endpoint telemetry that can lead to storage cost increases, search delays, and alert fatigue. From version 8.13 to 8.18, data volume was reduced by 68% on Linux, 57% on macOS, and 48% on Windows, thanks to several data efficiency improvements. These include merging short-lived process and network events, eliminating duplicate network events, and focusing on SHA256 hashes instead of legacy MD5 or SHA1 hashes. The changes are controlled by advanced options, ensuring existing Elastic Defend policies maintain prior behavior post-upgrade. The enhancements aim to lower operational costs and improve the usability of Elastic Defend without compromising its security effectiveness.

Generative AI (GenAI) is revolutionizing the banking sector by shifting from rigid, keyword-based systems to more intuitive, conversational interfaces that understand context and intent, significantly enhancing customer experiences, operational efficiency, and fraud detection. Banks are rapidly adopting GenAI to stay competitive, with projections indicating that over 80% will integrate the technology by 2026, up from just 5% today. This innovation enables banks to optimize operations, reduce time spent on compliance, and improve productivity by up to 500%. Key use cases include improved customer support through advanced chatbots, accelerated financial report analysis, and real-time fraud detection. Companies like EY, in collaboration with Elastic, are leveraging GenAI to extract insights from unstructured data, increasing accuracy and speed. Elastic’s Search AI Platform plays a pivotal role in ensuring data security while facilitating scalable, conversational banking solutions. The platform integrates with large language models while maintaining stringent security measures and offers features like geospatial understanding to manage extensive customer data efficiently.

Financial institutions are increasingly leveraging AI-driven technologies such as Retrieval Augmented Generation (RAG), vector search, and Elastic’s Better Binary Quantization (BBQ) to enhance efficiency, reduce costs, and provide real-time insights. A robust data foundation is essential for the success of AI initiatives, as emphasized by industry leaders like J.P. Morgan's Jamie Dimon. RAG connects internal data with large language models, improving decision-making and customer interactions, while ensuring compliance. However, AI scalability remains a challenge due to memory demands, prompting advancements like BBQ, which significantly compresses vectors to lower costs and accelerate insights. Elastic's tools, including its popular vector database, enable financial services to optimally utilize their data assets, ensuring smarter insights and regulatory compliance, although the release of specific features remains at Elastic's discretion and users are advised to exercise caution when employing third-party AI tools.

In "Hunting with Elastic Security: Exfiltration over C2 channel," Justin Higdon discusses the stealthy technique of exfiltrating data over Command and Control (C2) channels, as outlined by MITRE ATT&CK® T1041. This method allows adversaries to disguise data theft within legitimate C2 traffic, making it difficult to detect amidst the typical network noise. Higdon emphasizes the importance of understanding this technique to prevent sensitive data from being exfiltrated undetected. The article highlights the need for analyzing various data sources such as network traffic, process monitoring, DNS, and proxy logs to identify unusual patterns that could indicate exfiltration attempts. It provides strategies and specific Elastic Security Query Language (ES|QL) queries to detect covert activities, advocating for continuous monitoring and proactive threat hunting to enhance security defenses. The piece underscores the dynamic nature of cybersecurity threats and encourages leveraging resources from Elastic Security Labs to stay ahead of adversaries.

Financial institutions in India are gearing up to comply with the Securities and Exchange Board of India’s (SEBI) Cybersecurity and Cyber Resilience Framework (CSCRF), which was announced in August 2024 and mandates a comprehensive approach to governance, threat management, recovery, and continuous improvement. The framework applies to various regulated entities and expects them to demonstrate proactive deployment of cyber resilience capabilities by early 2025. Elastic’s integrated Security and Observability solutions provide these entities with essential tools to align with the CSCRF's pillars, offering capabilities such as real-time threat detection, compliance reporting, and automated workflows for internal audits. Additionally, Elastic supports financial institutions by enabling the implementation of Security Information and Event Management (SIEM), Security Operations Centers (SOC), and incident response strategies to meet CSCRF requirements. Elastic's solutions also focus on capacity planning, resilience, and continuous improvement, ensuring high availability and business continuity through advanced monitoring, anomaly detection, and threat intelligence integration. Through these offerings, Elastic aims to help organizations meet SEBI's high standards for cybersecurity and operational excellence.

Financial Services Institutions (FSIs) face challenges with fragmented tools, high costs, and security alerts, which hinder their cloud strategy optimization. At the Elastic Financial Services Summit, experts emphasized the need for FSIs to unify data and integrate intelligent, cloud-optimized data architectures to tackle these issues. Despite the explosion of digital signals and a global shortage of cybersecurity professionals, many executives are dissatisfied with cloud outcomes and cost reductions. The path forward involves breaking down operational silos while maintaining data control, as highlighted by integration difficulties across legacy systems and privacy concerns. Goldman Sachs exemplifies successful data management using Elastic's tools, achieving scalable, efficient operations across hybrid environments. Elastic offers innovative solutions like searchable snapshots and AI-driven capabilities to reduce cloud costs and enhance data accessibility, ensuring that data remains fully searchable while optimizing storage efficiency.

Stealthy adversaries often exploit system utilities to execute malicious code using techniques like MITRE ATT&CK® T1059, which involves command and scripting interpreters such as PowerShell, Bash, Python, and JavaScript to camouflage their activities among legitimate operations. This method enables attackers to conduct reconnaissance, escalate privileges, and move laterally within environments, posing a challenge for distinguishing between benign and malicious script executions. The article emphasizes the importance of detecting unauthorized script executions to prevent system compromise and suggests using various data sources like network traffic logs, process monitoring logs, file monitoring, and proxy logs to optimize threat detection. By leveraging Elastic's ES|QL queries and machine learning capabilities, security teams can identify suspicious patterns and enhance their threat-hunting efforts, thereby safeguarding organizational assets against potential exploitation through script-based attacks.

In the evolving landscape of financial services, banks are increasingly merging observability and security to bolster operational resilience, minimize risk, and reduce costs. By integrating these traditionally separate functions, banks like Wells Fargo and Bank Leumi are leveraging platforms like Elastic to gain comprehensive insights and respond swiftly to threats, thus enhancing system reliability and customer trust. As regulatory demands grow, exemplified by the EU's DORA, and technological threats become more sophisticated, unified platforms that consolidate system performance and security monitoring are becoming crucial. Elastic's comprehensive observability platform enables financial institutions to transform observability into a strategic advantage by combining real-time monitoring with business data, allowing for prioritized, impact-driven responses to system issues. This holistic approach not only enhances threat detection and issue resolution speeds but also significantly cuts monitoring costs, underscoring the importance of unified systems in achieving operational resilience.

Version 8.17.5 of the Elastic Stack has been released, with developers recommending an upgrade to this latest version. For comprehensive details about the issues addressed and the specific changes made to each product within this version, users are advised to consult the release notes.

US federal agencies are guided by the Office of Management and Budget's memoranda M-25-21 and M-25-22, which outline frameworks for implementing AI systems with appropriate safeguards. Elastic's Search AI Platform assists agencies in complying with these directives by offering a unified data mesh architecture that standardizes data operations and ensures privacy protection. Tools like vector search, cross-cluster search, and secure data exchange enable agencies to maximize data value while maintaining strict security measures. Elastic supports chief AI officers in establishing AI governance through comprehensive visibility, model documentation, and a vendor-neutral architecture that aligns with federal guidelines. By facilitating continuous monitoring, alerting, and performance analytics, Elastic empowers agencies to manage AI risks effectively and ensures compliance with federal mandates. Additionally, Elastic provides FedRAMP-authorized solutions and strategic guidance for agencies to meet compliance deadlines and leverage AI for enhanced citizen services while preserving privacy and civil rights.

Elasticsearch 8.18 introduces a new feature, the ES|QL’s LOOKUP JOIN command, marking the first SQL-style JOIN capability within the platform, available in a tech preview. This feature allows for data correlation and enrichment by using easily updatable lookup datasets, enabling users to integrate additional information such as host and asset details into events without significant data preparation. Unlike previous attempts like nested and _parent join field types, LOOKUP JOIN utilizes a new index mode called 'lookup', which is limited to a single shard with a maximum of 2 billion documents to enhance performance and scalability. This new capability simplifies the process of managing relational data without the need for denormalization and allows for more comprehensive analytical functions, such as grouping and aggregating data. Elastic plans to further develop this feature, enabling more join types and improving the user experience.

Elastic Security 8.18 and 9.0 introduce several enhancements aimed at improving efficiency and threat response for security operations teams. Key updates include Automatic Migration for transitioning from legacy SIEMs like Splunk, enhanced AI features, and the introduction of the ES|QL Lookup Join for dynamic data enrichment. The release also expands automated response integrations with Microsoft Defender and CrowdStrike, and introduces host traffic anomaly detection through machine learning. Additionally, Elastic Security now offers agentless data integration support for 15 widely used platforms, facilitating easier data management and reducing operational overhead. These updates aim to streamline detection engineering workflows, enhance endpoint visibility, and support a more seamless migration to modern SIEM solutions.

Elastic Security has introduced enhancements in its detection rule customization and update processes, simplifying workflows for detection engineers and enabling broader use case coverage with its prebuilt SIEM detection rules. With the release of Elastic Security 8.18 and 9.0, users can now apply Elastic-provided updates without losing custom modifications, which removes the need to duplicate rules. The platform offers over 1,300 expert-written detection rules aligned with the MITRE ATT&CK framework, and biweekly updates ensure that these rules remain effective against evolving threats. The new features include the ability to edit rules individually or in bulk, a streamlined rule update workflow that allows users to merge their edits with incoming updates, and improved rule management tools to prioritize updates based on severity and risk score. These improvements reduce maintenance burdens and enhance the efficiency of security operations by allowing teams to tailor detection rules to their specific needs while benefiting from Elastic's continuous updates and community-driven insights.

Elastic Observability 9.0/8.18 introduces several notable features, including the general availability of Elastic Distributions of OpenTelemetry (EDOT), providing a stable ecosystem for OpenTelemetry with components like the EDOT Collector and language SDKs for various platforms. This release also includes LLM observability for GenAI applications, offering insights for managing large language models across platforms such as Azure OpenAI and Google Vertex AI, while enhancing safety and reliability through features like Amazon Bedrock Guardrails. Additionally, the update brings performance and security improvements to Logstash and Elastic Agent support for AWS EKS, along with a consolidation of log exploration capabilities into Kibana Discover, eliminating the need for the separate Logs Explorer and Logs Stream. Elastic Cloud users can access these features directly, with further details available in the release notes.

Elasticsearch has released versions 9.0 and 8.18, which bring significant enhancements, including the introduction of Better Binary Quantization (BBQ), a high-performance alternative to traditional quantization techniques that is now generally available and offers up to 5x faster query speeds compared to OpenSearch. This release also includes enhanced support for multi-stage interaction models, out-of-the-box semantic search capabilities, and improved developer tools like a simplified API for quantized vector rescoring. The updates aim to provide faster, more efficient search results while reducing computing resources and improving the developer experience. Elasticsearch remains committed to innovation and has integrated these capabilities into Apache Lucene, maintaining its position as a leader in vector database technology. Additionally, the release offers new commands in Elasticsearch Query Language (ES|QL), such as JOIN for querying across datasets, and supports various deployment options, including Elastic Cloud and self-managed environments, while emphasizing caution in using third-party AI tools with sensitive data.

Elastic Platform's latest release, versions 8.18 and 9.0, introduces significant enhancements aimed at improving query performance, log management, and user experience for Elasticsearch and Kibana users. Key updates include the introduction of ES|QL Lookup Joins, which allow for real-time data enrichment and simplified management of security and observability data. Additional features such as partial query results and case-insensitive matching enhance ES|QL's analytical capabilities. The release also includes the default enablement of the logsdb index mode in Elasticsearch 9.0, offering more efficient log storage and management by reducing storage costs and improving query performance. Lucene 10 integration further boosts performance, providing faster and more efficient search queries. New APIs streamline index management and upgrading processes, while user experience improvements in Kibana, such as AI-driven insights and enhanced log analysis tools, support smoother transitions between different query languages. Elastic Cloud customers can access these features directly, and the release ensures Elastic's position as a leader in scalable search, security analytics, and observability solutions.

Elastic has announced the general availability of Elastic 9.0 and 8.18, bringing significant upgrades to Elasticsearch, Elastic's Search AI Platform, and core solutions like Elastic Observability and Elastic Security. Built on Lucene 10, Elastic 9.0 offers enhanced performance and efficiency with features like Better Binary Quantization (BBQ) and Elastic Distributions of OpenTelemetry (EDOT) now generally available. The release introduces significant advancements in AI-driven security analytics, such as Attack Discovery and Automatic Import, and enhanced capabilities in Elasticsearch Query Language (ES|QL) for real-time data joining and semantic search. Elastic Observability now includes comprehensive insights into Large Language Models (LLM) performance and costs, while Elastic Security offers customizable prebuilt rules and streamlined migration from legacy systems. The updates are available on Elastic Cloud, providing a scalable solution for security, observability, and search without the need for infrastructure management.

Financial services companies face the dual challenge of harnessing AI while managing data complexity, security, and compliance. Elastic's leadership, including CEO Ash Kulkarni, CIO Matt Minetola, and CISO Mandy Andress, discuss how AI can transform the industry by reducing costs and enhancing customer experience, but stress the importance of quality data and risk management. They highlight the need for a unified platform approach, as provided by Elastic's Search AI Platform, which integrates real-time data processing with built-in security and compliance features to maintain visibility and control. This platform supports organizations in meeting regulatory demands with transparency and auditability, enabling proactive security management. While AI offers operational efficiencies and improved customer engagement, success hinges on accessible and trusted data.

Generative AI (GenAI) is increasingly shaping the future of IT, with many organizations planning to boost their investments in this technology, but it is crucial for IT leaders to discern between hype and long-term value. While GenAI offers transformative potential by providing actionable insights and automating repetitive tasks, it is not a replacement for human expertise, which remains essential for contextual understanding and decision-making. The technology's reliability can be enhanced through retrieval augmented generation (RAG), which integrates proprietary data to tailor AI outputs for specific organizational needs while maintaining security and privacy standards. Despite concerns about security risks, GenAI systems can be fortified with robust measures, including encryption and compliance with regulations like GDPR, ensuring data protection. As GenAI continues to evolve, IT leaders are advised to implement it thoughtfully, focusing on strategies that enhance productivity and drive innovation without compromising ethical standards. With the technology's adoption growing rapidly across industries, businesses can future-proof themselves by prioritizing scalable, secure, and ethically sound AI integration.

The blog post discusses the potential of transforming general-purpose large language models (LLMs) into domain-specific experts using a technique called retrieval augmented generation (RAG). While creating custom LLMs for specific domains is often prohibitively expensive and complex, RAG offers a practical alternative by pairing existing LLMs with domain-specific knowledge bases to provide context-aware, detailed responses. This method allows organizations to leverage advanced AI capabilities without starting from scratch, making technical documents and complex regulations accessible to non-experts. By using RAG, users can interact with AI assistants in plain language, obtaining accurate and actionable insights from vast documents and guidelines, thereby enhancing decision-making and reducing cognitive overload. The post highlights the flexibility of Elasticsearch in integrating RAG and LLMs, offering these advanced features as part of its Enterprise license, thus enabling a wider audience to solve real-world problems effectively.

Site reliability engineers (SREs) are increasingly recognizing the hidden costs of tool sprawl in observability, prompting 80% of teams to actively pursue consolidation of their monitoring tools, according to a recent survey. The challenges of managing multiple tools include cognitive overload, training difficulties, integration issues, and budget concerns. However, consolidating tools is not without its hurdles, such as conflicting requirements, competing priorities, and resource constraints. Practical steps for successful consolidation involve auditing the current toolset, defining essential features, prioritizing integration, and considering open standards like OpenTelemetry to avoid vendor lock-in. Despite the challenges, the benefits of tool consolidation, such as faster incident response times, improved collaboration, and more time for innovation, are significant, leading to a more efficient and less stressful observability practice.

Financial services firms face the challenge of adopting AI technologies while navigating an increasingly complex regulatory landscape, particularly in light of regulations like the EU AI Act, which imposes a risk-based approach to AI practices. Experts at the Elastic Financial Services Summit emphasized that successful AI integration requires a unified data foundation and a comprehensive approach involving a business-led digital roadmap, skilled talent, and scalable solutions. Elastic, in partnership with Microsoft, offers a scalable infrastructure for AI implementation, focusing on maintaining regulatory compliance while fostering innovation. The collaboration highlights the importance of robust governance frameworks, operational adaptability, and enterprise-wide accessible data to support responsible AI adoption. EY's partnership with Elastic exemplifies the practical application of these principles, delivering high-performance AI solutions that enhance compliance and accelerate development for financial institutions.

Integrating Microsoft Defender for Endpoint data with Elastic Security enhances threat detection, investigation, and response by providing a unified platform that combines endpoint insights with contextualized data from networks, cloud environments, and identity systems. This integration addresses the limitations of endpoint data alone, which can lack the broader context needed for comprehensive threat mitigation. Elastic Security leverages AI-driven analytics and machine learning to deliver advanced threat detection and response capabilities, enabling security teams to operationalize Microsoft Defender for Endpoint telemetry alongside signals from other security domains. This approach reduces tool sprawl and costs while enhancing visibility across an organization’s entire attack surface. By offering features such as prebuilt detection rules, customizable analytics, AI-assisted investigations, and centralized dashboards, Elastic Security ensures that security operations centers can effectively correlate alerts, accelerate investigations, and respond to sophisticated threats. Additionally, Elastic Security supports long-term data retention and advanced analytics, allowing for historical threat hunting and forensic analysis, while also offering the flexibility to integrate with Elastic Defend for endpoints not covered by Microsoft Defender. This holistic security approach fosters resilient security operations and a consistent security posture across hybrid environments.

Integrating CrowdStrike endpoint data with Elastic Security aims to enhance threat detection, investigation, and response by creating a unified security operation that leverages both platforms' strengths. Elastic Security ingests and normalizes data from multiple sources, including CrowdStrike, to provide a comprehensive view of threats across endpoints, networks, cloud environments, and identity systems. By operationalizing CrowdStrike telemetry within Elastic, organizations gain deeper visibility and can conduct AI-driven investigations, utilizing prebuilt detection rules and machine learning models to identify anomalies and suspicious behaviors. The integration supports advanced analytics, long-term data retention, and real-time security insights, enabling proactive threat hunting and anomaly detection. Elastic's open, scalable ecosystem allows security teams to apply unified detections and response workflows across various domains, thereby maximizing endpoint security investments and accelerating threat detection and response. With Elastic's AI Assistant, analysts receive contextual insights and remediation suggestions, facilitating quicker and more effective security actions. This collaboration ultimately aims to break down data silos, reduce tool sprawl, and provide a holistic defense against evolving cyber threats.

Integrating SentinelOne endpoint data into Elastic Security enhances threat detection and response by providing a unified platform that aggregates and analyzes data from multiple sources, including networks, cloud environments, and identity systems. This integration enables security teams to overcome fragmented visibility and siloed data by offering centralized monitoring and analytics capabilities. Elastic Security utilizes AI-driven analytics and machine learning to deliver real-time threat detection and response, allowing for faster and more informed decision-making. The platform's features, such as the Elastic AI Assistant, assist in contextualizing alerts and recommending remediation steps, while the Elastic Attack Discovery automates threat correlation to provide a comprehensive view of attack campaigns. By leveraging Elastic's capabilities, organizations can maintain a robust security posture with long-term data retention and advanced analytics, ultimately reducing blindspots and improving overall security operations.

Elastic has partnered with Google Cloud to enhance the performance of Elasticsearch on Google's custom Arm64-based Axion Processors, specifically the C4A virtual machines, which provide up to 40% higher indexing throughput compared to previous-generation VMs. This collaboration aims to optimize Elastic Cloud Serverless, facilitating faster deployment and scaling of observability, security, and search solutions with reduced query latency for AI-driven applications. By leveraging Google's Axion processors and Titanium Local SSD storage, Elastic is committed to driving joint AI innovation, particularly for customers developing generative AI applications using Elastic's Search AI Platform. Users can explore Elastic Cloud Serverless and Search AI Lake through a technical preview on Google Cloud, although the availability of features and functionality is at Elastic's discretion.

Elastic Security has announced the general availability of two key generative AI capabilities: Attack Discovery and Automatic Import. These tools aim to enhance organizational security by transforming alerts into actionable insights and streamlining data integration, thereby increasing visibility and efficiency while reducing risk. Powered by retrieval augmented generation (RAG) technology, Elastic’s AI-driven security platform enables users to employ large language models (LLMs) of their choice, providing flexibility in terms of cost, speed, accuracy, and privacy. The announcement highlights the ease of use and immediate value of these capabilities, reflecting Elastic's commitment to equipping security practitioners with advanced, yet user-friendly tools. Users can try these features free of charge, and Elastic emphasizes caution when using AI tools with sensitive information, as third-party generative AI tools are beyond their control and may have different privacy practices.

Elastic is participating as a Signature Sponsor at Google Cloud Next 2025, showcasing a series of innovations, activities, and technical content centered around AI and data transformation. Key highlights include the integration of Elasticsearch's vector database into Google Cloud's Vertex AI platform, enhancing information retrieval and leveraging Google's Gemini models. Elastic also announced the general availability of large language model observability and groundbreaking AI features for Elastic Security, aimed at modernizing security operations. Elastic Cloud Serverless, built on the Search AI Lake architecture, is moving towards general availability, promising rapid scalability without infrastructure management. Additionally, Elastic's collaboration with Google Cloud has led to performance improvements with the Google Axion Processors, and their AI Ecosystem aims to accelerate generative AI application development. Elastic has been recognized with two Google Cloud Partner of the Year Awards for their contributions to AI in data management and tooling.

Elastic has been honored with two 2025 Google Cloud Partner of the Year Awards for its AI capabilities, specifically in Data Management & AI and Tooling, demonstrating its strong partnership with Google Cloud. This collaboration has led to significant advancements in generative AI (GenAI) applications, including Elastic's integration into Google Cloud’s Vertex AI platform, enabling developers to leverage Elastic's vector search capabilities. The partnership focuses on creating practical AI solutions, simplifying the development and deployment of sophisticated applications through seamless integrations. Furthermore, Elastic extends its AI innovations beyond application building to IT operations, utilizing Google Cloud’s Gemini models to enhance features like Elastic AI Assistants, attack discovery, and automatic data importation. Elastic ensures observability and security for GenAI applications by monitoring Vertex AI platform usage and providing a complete AI lifecycle management solution. This dual recognition underscores Elastic's commitment to AI innovation and its ongoing efforts to empower organizations to achieve new levels of efficiency and productivity.

The Forge the Future hackathon, organized by Elastic and powered by AWS in Singapore, showcased the transformative potential of Generative AI (GenAI) in various industries, highlighting advanced applications developed by 12 competing teams. The winning team, Buckle Up 4 AI, impressed judges with their Financial Insights Accelerator, a tool that transforms complex financial data into actionable insights using Elasticsearch and other advanced AI technologies. Other notable projects included an AI-powered health companion by Team Squareshift to enhance medical decision-making and Dr. HowsER by the Singtel Code Crew, which offers personalized health recommendations at home. The event underscored Singapore's commitment to becoming a leader in AI innovation, supported by significant government investments in AI and quantum computing. With advanced search capabilities like retrieval augmented generation (RAG), GenAI applications can offer more accurate, contextual responses, unlocking new possibilities for organizations leveraging proprietary data.

Public sector organizations are increasingly focused on efficiency, cost reduction, and resilience amid economic and political challenges, and Elastic Security is highlighted as a solution that addresses these needs by integrating AI and ML for enhanced security analytics. According to a study by the Enterprise Strategy Group, Elastic Security offers significant cost savings and improved security posture by consolidating tools, optimizing resources, and reducing infrastructure and personnel-related expenses. The study reveals quantifiable benefits such as reduced risk exposure, lower total cost of ownership, and faster response times to security incidents. Additionally, Elastic's flexible data tiering and open-source technology support various use cases beyond cybersecurity, making it a versatile tool for government agencies. The report emphasizes Elastic's ability to provide extensive visibility and efficient data management, enabling agencies to leverage data for multiple applications while maintaining compliance with storage regulations.

Elastic employs a quantified approach to cybersecurity risk management by using the FAIR model, which breaks down threat scenarios into likelihood and losses to calculate annualized risk. To address these risks effectively, Elastic's Risk Management team maps attack chains for each scenario, allowing them to identify weaknesses and improve risk assessments. The process involves laying out infrastructure, assigning probabilities to each malicious action, and mapping attack routes to calculate the Loss Event Frequency (LEF). By breaking down risks into detailed, actionable insights, this method enhances transparency and accuracy in risk quantification, providing a more efficient cybersecurity risk management service.