Human-in-the-loop approvals routed to Slack

Automation you can trust starts with understanding what Workflows will do and when it will ask for help. When a workflow reaches a decision that needs a person or an approval or other input, it pauses and routes the request to a tool your team already uses, like Slack. Automation handles the routine, while your team stays on top of the decisions that need judgment. Workflows runs natively within the Elasticsearch platform extending across search, observability, and security, so it runs where your security data already lives, rather than stitched as a layer on top. Together, our drive to Alert Zero, enhanced endpoint protection, and automation where your data lives reinforce each other.

Stronger prevention keeps alerts from being raised in the first place, and the ones that remain arrive validated instead of raw. Automation underneath keeps prevention and investigation moving at machine speed, while your analysts stay on the decisions that need a human. That’s what the agentic SOC looks like when it’s built to help the people in it rather than replace them. "Security teams are not losing because they lack tools; they're losing because the tools generate more work than the team can absorb," said Mike Nichols, general manager Security, Elastic. "Elastic Security is built by people who've sat in the SOC and worked the queue.

These updates go after one of the biggest sources of analyst burnout, which are alerts that shouldn't be alerts in the first place. We know every barrier is a liability and we’re building an open, transparent platform that breaks down those barriers and makes it easier for teams to customize and manage the security stack they need to protect their organizations.