Principal Software Engineer - Networking, Platform Infrastructure

Elastic has launched AlertZero, an AI-powered system built into Elastic Security that uses specialised agents to handle security operations tasks. The system manages alert triage, investigation, threat hunting, detection tuning, and forensic analysis, aiming to reduce thousands of raw alerts to a short queue of recommended actions. AlertZero operates through "Watches" — named groups of agents with specific responsibilities that run on triggers and schedules. These include Triage Watch for alert management, Hunt Watch for continuous threat hunting, Detection Watch for rule tuning, and Forensics Watch for specialist analysis. The system works with any AI model across Elastic Cloud, self-managed, or air-gapped deployments. Security teams retain control over which actions are automated and which require human judgment. AlertZero is available as a technical preview to Elastic Security customers. Mike Nichols, general manager of Security at Elastic, said the platform provides teams with visibility and control to deploy agentic automation at scale.

Elastic introduces Elastic nightshift AI SRE to investigate with the full context others can't afford to keep. October 8, 2026 The AI SRE uses complete context from across the entire stack to continuously detect issues and learn from every incident, delivering evidence-backed answers engineers can trust SAN FRANCISCO-(BUSINESS WIRE)- Elastic (NYSE: ESTC) today announced the private preview of Elastic(R) nightshift AI SRE, an AI agent built into Elastic Observability that investigates like an engineer and shows its work. It continuously detects and investigates issues across the entire stack with full context, including surfacing unknowns that rule-based alerts miss. Elastic nightshift AI SRE tests multiple root-cause hypotheses in parallel against telemetry and other relevant context to deliver evidence-backed answers with its reasoning visible at every step. Cloud-native systems now produce more telemetry than any team can review manually, and agentic development has made the problem worse: code that writes code can fail in ways that don't trip a clean error code or fire an alert. In the past year, 78% of organizations had at least one incident where no alert fired and customers found the problem first, according to a NeuBird AI study from April 2026. Once an incident surfaces, investigation depends on context that is usually incomplete: telemetry dropped to control cost, knowledge scattered across code, runbooks and Slack, and lessons from past incidents lost. Observability agents only see what alerts catch, while standalone AI SREs reason over data they don't own. Elastic nightshift AI SRE brings detection, investigation, context and remediation together in a single AI SRE built into Elastic Observability. Transparent Investigation Elastic nightshift AI SRE investigates like an SRE would: ruling out dead ends, following connected signals and converging on root cause with transparent reasoning. Once an investigation identifies the likely root cause, Elastic nightshift AI SRE recommends a fix. It can select an existing workflow or pre-configured action and fill in the incident parameters or provide commands for an engineer to run. Engineers can inspect the investigation steps, including the queries the agent ran and the underlying data. Complete Context Each investigation draws on full context based on cost-efficient telemetry storage, so customers can keep what the AI needs instead of sampling it away. A knowledge graph connects that telemetry to source code from GitHub repositories, so Elastic nightshift AI SRE can point to the commit that likely caused an exception instead of leaving engineers to guess what changed. Investigation memory compounds over time, so every resolved incident makes the next investigation faster to resolve. Detects Unknowns Elastic nightshift AI SRE does not wait for a rule to fire. It continuously evaluates the environment and all telemetry for what needs attention, correlating alerts, SLOs and anomalies into findings an engineer should actually see, including issues that preconfigured alerts are blind to. "Named role agents, including AI SRE, are the first step to AI-fueled operations," said Shannon Kalvar, IDC Senior Research Director. "These agents need access to a broader context, particularly heterogeneous estates, along with the ability to both learn from their own action and reflect on those actions after the fact to begin to create the human-directed operating model of the future." "Most Observability agents only get smarter by scraping more data. Elastic nightshift AI SRE gets smarter by paying attention to how engineers work through investigations, and by checking its own homework once an incident is closed," said Baha Azarmi, general manager, Observability, Elastic. "That is how it keeps up with production without running up a token bill nobody wants to see." Availability Elastic nightshift AI SRE is available today in private preview on Elastic Observability Serverless, free for existing Elastic customers during the early access period. Elastic plans to bring it to technical preview later this year with broader support for third-party tools and data stores. Teams can join the waitlist at: elastic.co/observability/ai-sre/signup Additional Materials About Elastic Elastic (NYSE: ESTC) integrates its deep expertise in search technology with artificial intelligence to help everyone transform all of their data into answers, actions, and outcomes. Elasticsearch, which is the foundation for its search, observability, and security solutions, is used by thousands of companies, including more than 75% of the Fortune 100. Learn more at elastic.co. Elastic and associated marks are trademarks or registered trademarks of elasticsearch B.V. and its subsidiaries. All other company and product names may be trademarks of their respective owners.

Elastic launched a metrics platform within Elasticsearch, combining a columnar store with existing log, trace and vector data capabilities. The company claims the solution is 30 times faster than Prometheus and Mimir and eight times faster than ClickHouse, with significant storage efficiency gains, though benchmarks were not independently verified. The product targets AI-driven telemetry growth and high-cardinality workloads. Baha Azarmi, Elastic's General Manager of Observability, said AI deployments create rising data volumes, including monitoring of large language model calls and graphics-processing-unit activity. The platform offers PromQL compatibility and migration tools for existing Prometheus users. Elastic expects adoption to build gradually due to longer sales cycles in observability deals. The product launched in June at the start of Elastic's fiscal year.