Prevention at machine speed: Hunting beyond known detections

James Spiteri

Senior Director, Product Management, Security

Elastic

Paul Ewing

Senior Manager, Product Management

Elastic

Adversaries now move at machine speed, executing actions before an analyst can open the first alert. Manual detection and response isn't enough; it’s time to stop chasing alerts and start closing gaps.

Elastic Security's James Spiteri and Paul Ewing show a two-pronged approach to using AI within security detection and response.

• At the endpoint: Behavioral protections and containment deny malicious behavior before it can execute, across Windows, macOS, and Linux, whether on-premises, in the cloud, or air-gapped.
• Beyond your detections: An AI system reads unstructured threat research, extracts the tradecraft, writes and runs the queries, and proposes new detection rules for analyst review, with a human on the loop at every step.

You'll walk away with:

• A prevention-first architecture: How to stop machine-speed attacks at the endpoint before they become incidents
• Agentic hunting in practice: How an AI system reasons across unstructured threat research to surface tradecraft your rules don't cover
• A sharper detection pipeline: How to turn external threat intelligence into reviewed, deployable detection rules without manual overhead

Additional resources

• [Article] AI use for security analysts
• [Virtual event] Unifying security operations with Elastic: From data ingestion to threat response
• Elastic Security, the agentic security operations platform