July 2025 Summaries

Liferay's partnership with Elastic, formed in 2015, has significantly enhanced its digital experience platform by embedding Elasticsearch, providing advanced search capabilities tailored to the unique needs of enterprise customers. This collaboration allows Liferay to offer sophisticated search functionality with better scalability, cluster replication, and failover capabilities, essential for complex business environments. As an Elastic OEM partner, Liferay benefits from vendor-backed support, enabling it to meet market demands efficiently while reducing internal development costs. The partnership has simplified procurement processes, offering customers a streamlined experience and attractive pricing, which in turn has driven revenue growth for Liferay. The integration of Elasticsearch as the default search server in Liferay's platform supports a flexible, low-code configuration and personalized content management, enhancing the customer experience. The partnership also opens avenues for future collaborations, particularly in AI search experiences, positioning Liferay well for evolving technological advancements.

The general availability of Elastic Cloud Serverless on Azure marks a significant advancement in cloud integration, offering Azure users a more accessible and powerful experience. This integration allows users to seamlessly discover, manage, and subscribe to Elastic Cloud solutions through the Azure portal, aligning with native Azure services for a unified management experience. Elastic Cloud Serverless eliminates the need for complex infrastructure management, enabling real-time scaling and focusing on data insights for search, observability, and security applications. The architecture supports optimal performance and cost efficiency by decoupling compute and storage, allowing for independent scaling and low-latency querying. The integration simplifies billing, offers streamlined access via Azure's single sign-on, and facilitates the management of Elastic deployments alongside other Azure resources, enhancing procurement, time-to-value, and control for organizations. These enhancements provide a seamless purchasing experience and maximize Azure investments, while Elastic retains discretion over the release and timing of new features.

Security teams at the UK Ministry of Defence are grappling with an overwhelming volume of sophisticated cyber threats and the inefficiencies of traditional Security Operations Center (SOC) workflows. Automation has become essential, as manual processes are insufficient to handle the pace and complexity of modern threats. Elastic's Search AI Platform offers AI-driven solutions that help streamline operations by automating repetitive tasks, enhancing cross-domain visibility, and integrating compliance into routine workflows. This allows analysts to focus on more strategic tasks, improving response times and reducing fatigue. The platform's features, such as Attack Discovery and cross-cluster search, enable efficient triaging and correlation of security events, which helps security teams manage threats effectively without being bogged down by false positives or fragmented data systems. As automation frees analysts from mundane tasks, they are empowered to take on more proactive roles in threat detection and defense readiness.

Elasticsearch has started migrating from AWS SDK for Java v1 to v2 due to the former reaching its end of support at the end of 2025. The transition to SDKv2 introduces several changes, including the requirement for specifying AWS regions, the exclusive use of IMDSv2 for instance metadata, and the adoption of full URL endpoints. Elasticsearch versions 8.19 and onwards, starting from 9.1.0, will incorporate SDKv2, with compatibility measures in place to minimize disruptions for users. The migration process involved extensive testing to handle differences between the SDK versions, with an emphasis on end-to-end tests that simulate real AWS API interactions. Users are advised to update their configurations where necessary, particularly concerning region specifications and endpoint URLs, and to conduct thorough tests on non-production clusters before applying changes in production environments.

Elastic has announced the general availability of Elastic 9.1 and 8.19, featuring enhancements across its Search AI Platform, Elastic Observability, and Elastic Security solutions. The updates include Better Binary Quantization for faster processing, a new algorithm called ACORN for efficient vector search, and token pruning for improved semantic search. Elastic Observability now integrates with Azure AI Foundry, enhancing data centralization and operational efficiency, while Elastic Security introduces automated Attack Discovery with persistent results and natural language investigations for streamlined threat management. Additionally, ES|QL is now fully production-ready, offering improved data architecture with LOOKUP joins and enhanced cross-cluster search capabilities. These releases are available on Elastic Cloud Serverless, now accessible on Microsoft Azure, AWS, and Google Cloud, making it easier to deploy and scale Elastic's solutions without managing infrastructure.

As the cybersecurity landscape evolves, modern Security Information and Event Management (SIEM) platforms, enhanced by artificial intelligence (AI), play a crucial role in aiding Security Operations Center (SOC) teams to better manage their security data, analyze threats, and implement responses. The integration of AI into SIEM systems offers numerous benefits, such as accelerating threat detection, reducing false positives, and streamlining workflows, which helps alleviate challenges like alert fatigue and talent shortages faced by SOC teams. AI-driven SIEM solutions also provide advanced features like user behavior analytics and integration with security orchestration platforms, improving both compliance and threat response efficiency. Despite the advantages, legacy SIEM systems face limitations in scalability and integration, prompting organizations to transition to modern, AI-enhanced solutions. The adoption of these advanced SIEMs is evident across industries—from finance to healthcare—allowing companies to address complex security challenges while maintaining regulatory compliance. As AI continues to shape the future of SIEM, cloud-native solutions are anticipated to gain prominence, offering scalability, flexibility, and predictive analytics to keep pace with the rapidly changing threat landscape.

Artificial intelligence (AI) is both a significant threat and a crucial defense in the field of cybersecurity, transforming the approach from reactive resilience to proactive antifragility. While AI is used by threat actors to develop sophisticated attacks, it also equips cybersecurity teams with real-time insights and analytic capabilities, enabling them to detect and respond to threats at scale more effectively than human teams alone. AI facilitates adaptive security by allowing continuous risk assessment and dynamic response to evolving threats, enhancing the speed and adaptability of security operations. The integration of AI into security operations not only automates and streamlines processes but also augments human analysts' roles, allowing them to focus on strategic, high-impact tasks. This synergy between AI and human intelligence redefines security work, emphasizing adaptability and collaboration to build self-improving systems that enhance security postures. Elastic's use of GenAI-powered tools exemplifies how AI can be tailored to specific business and security needs, demonstrating its foundational role in modern cybersecurity strategies.

Version 8.18.4 of the Elastic Stack has been released, offering various performance and stability enhancements over its predecessor, 8.18.3. Notably, Logstash's persistent queue now boasts significantly increased throughput when workers are up to date, achieved by eliminating lock contention in pipeline workers to prioritize queue writers. This improvement is particularly beneficial for pipelines configured with larger batch sizes. Users are encouraged to upgrade to this latest version, and further details on fixed issues and specific changes can be found in the release notes.

Version 8.17.9 of the Elastic Stack has been released, bringing several performance and stability enhancements across its components. Notably, Logstash's persistent queue demonstrates a marked increase in throughput when its workers are up-to-date, thanks to the removal of lock contention in pipeline workers which prioritizes queue writers when insufficient events are available to fill batches. This update offers significant advantages for pipelines configured with larger batch sizes. Users are encouraged to upgrade to this version from 8.17.8 to benefit from these improvements, and detailed release notes are available for those seeking more comprehensive information on the changes.

Version 9.0.4 of the Elastic Stack has been released, offering various performance and stability enhancements compared to its predecessor, version 9.0.3. Notably, Logstash's persistent queue now achieves significantly higher throughput when its workers are caught up, thanks to the elimination of lock contention in pipeline workers, giving queue writers priority when batches are not yet full. Pipelines optimized with larger batch sizes are expected to see even greater improvements in performance. Users are encouraged to refer to the release notes for a detailed list of fixed issues and changes in this version.

Generative AI and knowledge-centered service (KCS) are transforming customer support by replacing traditional tiered models with more efficient, user-centric approaches. Traditional support structures often cause delays and frustration due to their internal focus and rigid workflows. In contrast, generative AI leverages comprehensive product documentation and unstructured data to provide immediate, personalized solutions, allowing customers to self-serve and reducing the need for human intervention in basic queries. This shift enables support engineers to focus on more complex issues, enhancing their role from troubleshooters to strategic advisors while improving customer satisfaction and operational efficiency. By utilizing technologies like semantic search and natural language processing, AI can predict and prevent potential issues, transitioning customer support from reactive to proactive. This evolution not only elevates the quality of service but also positions support teams as key contributors to business success.

Generative AI promises significant organizational transformation through natural language outputs, but its success hinges on a robust data strategy aligned with business priorities. A solid generative AI data strategy requires high-quality, transparent, governable data and must be crafted to align with specific business goals. This involves selecting appropriate tools and technologies, embedding AI into existing workflows to enhance functionality without causing tool sprawl, and bridging the gap between technology and business outcomes by making IT a strategic function. Additionally, measuring the business value of AI initiatives is crucial, requiring continuous monitoring, defined success KPIs, and ensuring scalability, sustainability, and ethical considerations. Real business impact, such as improved productivity and new revenue opportunities, can be achieved through strategic implementation of generative AI, exemplified by case studies like Elastic's internal AI assistant, ElasticGPT.

Elasticsearch has been integrated as a recommended vector database within the NVIDIA Enterprise AI Factory validated design, offering enterprises a robust framework for deploying AI Factories on-premises. This integration combines NVIDIA's accelerated computing and AI software with Elasticsearch's proven vector database capabilities for enhanced AI model deployment, multimodal data extraction, and embedding generation. The collaboration aims to accelerate AI applications by providing a pre-engineered blueprint, including the use of NVIDIA cuVS for GPU-accelerated vector search, which improves index build times and query performance for real-time AI applications. Elastic plans to build upon its optimization work for vector search performance, using techniques like CPU SIMD and Better Binary Quantization, to reinforce Elasticsearch's position as a leading vector database choice. Caution is advised when using third-party generative AI tools, as Elastic disclaims responsibility for their use or any potential data security concerns, while trademarks and logos remain the property of their respective owners.

A Security Operations Center (SOC) leader plays a pivotal role in managing an organization's cybersecurity efforts by overseeing a team responsible for monitoring, detecting, and responding to cyber threats in real-time. This role involves balancing strategic planning, technical oversight, and team leadership while ensuring the effective use of security tools such as SIEM, SOAR, and XDR for comprehensive threat detection and response. Key responsibilities include coordinating incident response, mentoring team members, integrating threat intelligence, and reporting to senior management on security performance and risks. SOC leaders face challenges such as managing alert fatigue and adapting to evolving threats, requiring ongoing training, technology upgrades, and proactive threat management strategies. Elastic Security offers solutions that support SOC leaders with AI-driven analytics to streamline operations and enhance their organization's security posture.

The Elasticsearch Model Context Protocol (MCP) server is now available on the AWS Marketplace, allowing customers to easily deploy it as a container under the AI Tools and Agents category. This server enables AI agents and applications to interact with Elasticsearch using natural language, facilitating real-time information retrieval and decision-making. It supports the development of intelligent applications by integrating with Amazon Bedrock models, enhancing the capabilities of generative AI (GenAI) agents with features like vector search, hybrid search, and real-time AI observability. Elastic, recognized as a leading AWS GenAI Competency Partner and awarded the AWS Global Generative AI Infrastructure and Data Partner of the Year, continues to innovate in the AI/ML space, offering advanced tools for scalable AI solutions. While the MCP server is free, users should be aware of potential infrastructure and server costs, and are advised to exercise caution when using AI tools, especially when handling sensitive data.

Elastic has announced the inclusion of C7gd instance types in its Elastic Cloud Hosted — FedRAMP Moderate Authorized service, offering significant price-performance improvements for U.S. agencies and organizations. Powered by AWS Graviton3 processors and local NVMe-based SSDs, these new instances boast up to 45% better real-time NVMe storage performance compared to Graviton2-based counterparts, making them particularly suitable for Elastic workloads involving Search, Observability, and Security within the secure FedRAMP Moderate environment. Users can experience up to a 40% improvement in price performance over Intel-based instances. The process for creating or migrating to C7gd instances is straightforward, with detailed instructions provided for both new and existing users. Elastic emphasizes that the release and timing of new features are at its discretion, and there is no guarantee that all described functionalities will be available as planned.

Elastic and Armis have collaborated to integrate Armis's real-time IoT device data into Elastic Security, providing enhanced insights for security teams dealing with IoT and unmanaged device vulnerabilities. This integration allows security analysts to utilize Armis's device discovery and risk assessment capabilities alongside Elastic's analytics, ES|QL querying, and AI Assistant for improved detection, investigation, and response times. The agentless architecture of Elastic facilitates easy setup through Kibana, offering real-time data access without deploying agents. Three data streams—devices, alerts, and vulnerabilities—are brought into Elastic, mapped to Elastic Common Schema (ECS) for seamless correlation with other security data. Purpose-built Kibana dashboards help prioritize and respond to risks effectively, while Elastic AI Assistant aids in crafting complex queries from natural language to streamline threat investigations. This collaboration aims to provide holistic, observable security across IT, OT, IoT, and IoMT environments, enhancing threat hunting and incident response capabilities.

Elastic Cloud Serverless is now available on AWS in regions including Frankfurt and Ohio, providing a seamless way to implement observability, security, and search solutions without infrastructure management. Leveraging the Search AI Lake architecture, it offers vast storage, decoupled compute and storage, and low-latency querying with AI capabilities for enhanced speed and scalability. Users can scale workloads independently, benefit from optimized hardware for different use cases, and enjoy hassle-free operations without managing clusters or nodes. The service, which features a flexible usage-based pricing model, allows easy project creation via the Elastic Cloud console and integration with AWS Marketplace for straightforward billing. Elastic plans to expand to more AWS regions and enhance features, aiming to revolutionize the search, security, and observability sectors by providing a high-speed, scalable, and cost-efficient solution.

The blog post by Tim Lee and Adrian Chen outlines a secure method for ingesting data from Azure Event Hubs using Entra ID and OAuth 2.0 authentication, replacing traditional static credentials like SAS keys. This approach is aligned with Microsoft's best practices, providing centralized identity management, enhanced security through expiring tokens, and simplified auditing. By configuring Logstash's Kafka input to authenticate via Entra ID, users can streamline their data ingestion pipelines, minimizing security risks and ensuring compliance with modern authentication standards. The guide details the necessary steps for setting up application registration, generating client secrets, and assigning roles in Azure, as well as configuring Logstash to interact with Event Hubs using OAuth. The secure pipeline setup is exemplified through a use case of streaming Azure Activity Logs into Elastic for security analysis, demonstrating the integration's benefits, including robust data processing and monitoring capabilities. The authors emphasize the importance of transitioning to token-based authentication to fortify security and suggest auditing existing data pipelines to ensure they adhere to contemporary security protocols.

Elastic has partnered with Microsoft to integrate with the Azure AI Foundry Model Catalog, enhancing security operations for Microsoft Azure customers by providing access to advanced large language models (LLMs). This collaboration aims to reduce analyst burnout by automating routine security tasks and offering reliable threat detection and remediation solutions. The integration elevates Elastic's AI Assistant and Attack Discovery, which leverage generative AI to prioritize security alerts effectively. The partnership with Azure AI models allows for quick summarization of alerts, contextual information about threats, and the generation of complex queries, optimizing the security workflow. The Azure AI Foundry Model Catalog offers a diverse range of models, including those from Microsoft, OpenAI, and other leading providers, ensuring comprehensive threat analysis capabilities. Elastic emphasizes ongoing innovation and rule optimization to adapt to evolving threats, while cautioning users about the privacy practices associated with third-party AI tools.

The Dunhuang Digital Scripture Cave, an extensive online database of Dunhuang documents, has been made accessible to the public, featuring over 9,900 volumes and more than 60,700 images, thanks to AI technologies from Elastic and Tencent Cloud. This initiative leverages large language models and advanced search capabilities to make traditional Chinese and rare characters in ancient texts searchable, translatable, and understandable. The platform offers real-time AI assistance, multilingual translation, and intelligent summarization, thus significantly lowering the barrier to understanding these ancient works. With the integration of Tencent Cloud Elasticsearch Service and advanced AI technology, users can efficiently search, retrieve, and interpret ancient texts, enhancing the global dissemination of cultural heritage. Through specialized tokenization and hybrid search methods, the system provides contextually accurate responses, promoting a deeper understanding of texts like the Diamond Sutra.

In an increasingly complex cyber threat landscape, the role of the Chief Information Security Officer (CISO) is vital for safeguarding an organization's digital assets and ensuring operational resilience. CISOs are tasked with developing and enforcing comprehensive security policies, aligning cybersecurity initiatives with business objectives, and fostering a culture of security awareness among employees to mitigate risks and maintain regulatory compliance. Their responsibilities include overseeing the implementation of security technologies, managing security teams, and collaborating with other departments such as IT to integrate security into the organization's strategic planning and daily operations. CISOs must possess a blend of technical expertise, leadership skills, and strategic thinking to navigate the challenges posed by emerging threats, such as AI-driven cyber attacks, while also effectively communicating complex security issues to non-technical stakeholders. With the continuous evolution of cyber threats, the CISO role is expanding, requiring them to anticipate future risks and modernize security postures, leveraging tools like Elastic Security for real-time visibility and threat response.

Elastic has been recognized as a Leader in the 2025 Gartner Magic Quadrant for Observability Platforms, highlighting its advancements in AI-driven capabilities, open architecture, and scalability. The company's solutions address the limitations of traditional dashboards and alerts by providing real-time investigations and cost-effective data management. Elastic's observability platform supports OpenTelemetry infrastructure, allowing seamless integration with open source tools, and offers AI-driven assistance to streamline incident management and root cause analysis. Moreover, Elastic's AI Assistant and advanced analytics enhance troubleshooting by utilizing natural language processing and retrieval-augmented generation, providing contextual insights across various data types. The platform's ability to manage large-scale, structured, and unstructured data through the Search AI Lake, combined with its emphasis on openness, positions Elastic as a significant contributor to the observability landscape. Elastic continues to innovate by addressing supportability challenges with its Elastic Distributions of OpenTelemetry and offers integrations with major AI models to improve operational reliability and manage costs effectively.

AI adoption in cybersecurity is transforming security operations by enhancing threat detection, automating incident response, and improving alert accuracy, offering significant advantages in handling advanced threats and complex ecosystems. The technology allows for more efficient data analysis, minimizes damage from attacks by responding in near real-time, and acts as a force multiplier by managing repetitive tasks, freeing up security teams to focus on high-value investigations. Key use cases for AI in cybersecurity include threat detection, SOC automation, fraud detection, and data onboarding, while common pitfalls in AI implementation include inadequate governance, weak access controls, and overreliance on automation. Best practices for integrating AI into security operations include developing a clear strategy, investing in data quality, seamless tool integration, continuous monitoring, and ongoing team training. Elastic Security leverages its Search AI Platform to enhance SOC workflows, enabling efficient alert triage and the use of generative AI to improve security operations, though potential users are advised to exercise caution with third-party AI tools due to privacy and data security concerns.

Elastic has achieved the FedRAMP High "In Process" status for its Elastic Cloud Hosted on AWS GovCloud (US), indicating a commitment to providing secure and compliant technology solutions for the US federal government. This status, which follows a volume-based discount program for federal agencies, marks a significant step toward securing the government's most sensitive unclassified data through the implementation of over 400 rigorous security controls. Elastic's platform allows public sector organizations to transform large datasets into actionable insights using open-source, scalable technology, while maintaining data in its original format for holistic analysis. The platform supports Zero Trust data strategies and optimizes data management budgets through cost-effective storage methods. As Elastic continues its journey toward full FedRAMP High authorization, it remains focused on enhancing security, transparency, and interoperability for federal agencies, offering multiple deployment options to meet diverse mission and security requirements.

Application performance management (APM) is an essential practice for monitoring, analyzing, and managing the performance and availability of software applications, especially within complex microservices environments. The process aims to ensure that applications run smoothly and meet user and business expectations by incorporating proactive monitoring, analysis, and management of both backend and frontend performance. Successful APM implementation involves continuous real-time insights, end-to-end visibility, and a user-centric approach, integrating multiple stakeholders like business experts, developers, and operations teams. Modern APM strategies utilize telemetry data such as traces, metrics, and logs, balancing auto-instrumentation with manual adjustments for critical operations to avoid over-instrumentation and maintain performance. Effective APM practices include setting up real-time dashboards, intelligent alerting, and employing advanced techniques like distributed tracing and synthetic monitoring. Elastic Observability facilitates seamless APM implementation by combining application performance data with logs, metrics, and traces on a unified platform, enabling businesses to optimize performance, reduce latency, and enhance stability, ultimately leading to better business outcomes.

The text explores the roles of SOC analysts and security analysts, highlighting their similarities and differences in the cybersecurity field. SOC analysts focus on real-time monitoring, threat detection, and incident response, working within a Security Operations Center and often progressing through three tiers of expertise. Security analysts, while also involved in monitoring and responding to threats, take a more strategic and preventive approach, often working outside the SOC. The text also details the required skills, career paths, and challenges faced by these professionals, noting the increasing integration of AI tools to enhance efficiency and manage alert fatigue. Additionally, it discusses the importance of continuous learning and certifications for career advancement and mentions Elastic Security's AI-driven analytics as a tool to streamline security operations and improve organizational security posture.

In the complex landscape of defense cybersecurity, AI and contextual search technologies are revolutionizing how security teams operate by offering real-time insights and reducing the burden of manual data analysis. As threats evolve to move at machine speed, traditional search and analysis methods are becoming inadequate, leading to delayed responses and increased risk. Advanced technologies like retrieval augmented generation (RAG) and natural language search are enabling systems to provide answers rather than just data, reducing alert fatigue and enhancing decision-making efficiency. The Ministry of Defence (MOD) and its partners are adopting these innovations to improve triage processes and foster more effective decision-making, demonstrating the practical application of AI in real-world defense environments. AI is positioned not as a replacement for human expertise but as an enhancement, freeing analysts to focus on strategic tasks and enabling broader participation in security operations through user-friendly interfaces like chatbots. These advancements, tested in rigorous scenarios such as NATO's Locked Shields exercise, demonstrate the potential of AI to transform defense cybersecurity by providing timely, relevant, and actionable intelligence.

Amazon Elastic Kubernetes Service (EKS) offers an enhanced monitoring solution through the integration of the Elastic Agent add-on, which facilitates comprehensive observability for cloud-native applications by centralizing the collection of logs, metrics, and security data. The Elastic Agent operates as a DaemonSet across EKS clusters, ensuring each Kubernetes node is covered and managed through Elastic Fleet, which allows for centralized configuration and updates via Kibana's UI. This setup supports scalability and robust visualizations for Kubernetes data while enabling users to customize deployments based on specific observability and security needs. The process involves deploying the Elastic Agent on EKS, verifying the setup through the AWS EKS Console, and exploring data in Kibana using prebuilt dashboards or custom visualizations to monitor EKS cluster health and performance. This method leverages the strengths of Elastic's tools to provide a unified and powerful observability solution, though it acknowledges inherent limitations within the managed EKS environment and advises caution when using generative AI tools in conjunction with Elastic's services.