Get started with Elastic Security from your AI agent

Key Takeaways

• Elastic released open-source Agent Skills (v0.1.0) to integrate Elastic Security expertise into AI coding agents like Cursor, Claude Code, and GitHub Copilot.
• The 'create-project' skill allows users to provision an Elastic Cloud Serverless Security project directly via AI prompts.
• The 'generate-security-sample-data' skill populates environments with realistic, ECS-compliant security events and synthetic alerts for testing.
• Additional skills support alert triage, detection rule management, and case management workflows directly from the IDE.
• The skills encode expert workflows and safety measures, such as preventing credentials from displaying in chat and confirming billable resource creation.

Affected Systems

• Elastic Cloud Serverless
• Cursor
• Claude Code
• GitHub Copilot
• Windsurf
• Cline
• OpenCode
• Gemini CLI

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The article discusses tools for managing detection rules and alerts within Elastic Security but does not provide specific detection rules.

Detection Engineering Assessment

EDR Visibility: N/A — The article discusses an integration tool for AI agents, not a specific threat requiring EDR visibility. Network Visibility: N/A — Not applicable to this tool release. Detection Difficulty: N/A — Not applicable as this is a tool release, not a threat report.

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Threat actors may use Word macros to spawn PowerShell processes for ransomware deployment, as simulated in the Elastic sample data.	Process creation logs showing winword.exe spawning powershell.exe.	Execution	Medium
Adversaries may attempt to dump LSASS memory to harvest credentials.	EDR process access logs targeting lsass.exe.	Credential Access	Low

Recommendations

Immediate Mitigation

• N/A

Infrastructure Hardening

• N/A

User Protection

• N/A

Security Awareness

• Review the Elastic Agent Skills documentation and security considerations before integrating AI coding agents into your environment.
• Ensure AI agents are configured to handle credentials securely and never display them in chat interfaces.

MITRE ATT&CK Mapping

• T1059.001 - Command and Scripting Interpreter: PowerShell
• T1003.001 - OS Credential Dumping: LSASS Memory
• T1098 - Account Manipulation
• T1556.006 - Modify Authentication Process: Multi-Factor Authentication