• CONTEXT
  • TRIAGE
  • RECON
  • HUMAN

How to investigate security signals with your AI

Connect Elastic Security to your AI client to pull telemetry directly from your logs. You can query signals and grab context without switching tabs.

Ask AI about this page

Short answer

How can I use my AI to investigate security signals?

Your AI uses the Elastic Security MCP to query raw signals and pull enriched data like hostnames and user profiles. This gives you the context you need for incident response. You'll see the specific outcomes and workflow below.

Investigation outcomes

What you get from a signal search

The AI pulls the data so you can make the call.

CONTEXT

Enriched telemetry

The AI pulls hostnames, user profiles, and IP geolocations. You get the full identity of the involved entities immediately.

TRIAGE

Rapid signal review

The AI scans raw signals to find relevant events. You can quickly see if an alert is worth your time.

RECON

Network mapping

The AI identifies IP locations and user patterns. This helps you map out the scope of an incident.

HUMAN

Final triage decision

The AI presents the gathered evidence in your chat. You decide whether to escalate the threat or close the case.

The workflow

What your AI does when a signal arrives.

The AI handles the data retrieval so you can focus on the threat.

  1. Query signals

    The AI searches your Elastic Security logs for specific events or alert IDs.

    search_signals

  2. Pull telemetry

    The AI grabs hostnames and user profiles linked to the signal.

    search_signals

  3. Get geolocation

    The AI looks up IP addresses to find where the activity is coming from.

    search_signals

  4. Summarize context

    The AI bundles the raw telemetry into a single response for you.

    search_signals

Try it

Copy these to start.

Use these prompts to begin an investigation.

Starting points

Replace the specific IDs and names with your actual data.

Elastic Security Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_yoRwv3p0kyRWtXaW6iNtkYfU9l5Iu9BBOzCcOvtN/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Elastic Security capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "elastic-security-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_yoRwv3p0kyRWtXaW6iNtkYfU9l5Iu9BBOzCcOvtN/mcp"
    }
  }
}
Copy into chat04

  • Search for recent security signals related to user 'svc_account_01'.

  • Find the hostname and user profile for alert ID 99283.

  • Get the geolocation for IP address 10.0.4.52.

  • What are the recent signals for host 'prod-web-04'?

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Elastic Security once, then ask.

One connection gives your AI access to your security data. Your login stays encrypted on our side.

Connect Elastic Security to your AI

FAQ

How the task behaves

  • 01

    Can the AI change my security settings?

    No. The AI can only read and search signals.

  • 02

    Can the AI delete logs or alerts?

    No. The AI has no permission to delete or modify any data in Elastic Security.

  • 03

    Does the AI perform the actual remediation?

    No. The AI provides the telemetry and context, but you must perform the remediation yourself.

  • 04

    Can I use this with Cursor or VS Code?

    Yes. You can use this with any MCP-compatible client.

  • 05

    Does the AI see everything in my Elastic instance?

    The AI only sees the data it can access via the search_signals tool.

  • More questions about Elastic Security? See everything the Elastic Security Connector can do

Connect Elastic Security to Claude, Cursor, ChatGPT & more