Elastic targets AI-powered SOC with Alert Zero to eliminate alert fatigue
Security operations centers have spent years stacking tools to solve alert volume issues that tools simply can’t fix, and Elastic is now making the case that AI-powered SOC is the only viable path forward.
The problem is structural, according to Mike Nichols (pictured), general manager of security at Elastic. Analysts are burning out because their tools generate more noise and chaos than any human team can absorb. It’s not a matter of lacking the necessary tools, so Elastic’s answer is Alert Zero, a destination where agents and analysts work together to reduce the queue so only validated, legitimate attacks remain. Machine speed handles the volume, and human judgement handles making the calls.
“We hire and pay for these detectives to come work in our environments, but then most security operations centers, they’re beat cops writing traffic tickets all day long,” Nichols said. “Imagine if you could eliminate that work, and they really are just showing up at the scene of the crime and doing their analysis and investigation.”
Nichols spoke with Krista Case at Black Hat USA during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed how Elastic’s expanded Attack Discovery platform now investigates threats before they reach an analyst, why vendor lock-in is the next major risk in the AI-powered SOC market and where human judgement remains indispensable.
