AI-Driven Entity Analytics

**Background:**

Entity Analytics represent the key pieces of information involved in a security incident in a SIEM. They are the “who”, “what”, “where”, and “when” of any research, hunt or investigation providing crucial context for effective response. Entities are objects in every modern SIEM and can include users, hosts, files, network artifacts, threat intelligence, vulnerabilities and much more.

Threat hunting has traditionally been a highly manual process requiring deep expertise in adversary behaviors, query languages, infrastructure, users and security analysis. Most organizations lack dedicated threat hunters or the time required to perform regular hunting operations. Even when orgs have the resources, the process is inefficient and often reactive rather than proactive.

**What problem are we solving**

Among the personas that comprise our customers' security operations teams, many of them rely on complex processes and query languages in order to investigate and find threats and risky behaviors in their environments. Threat hunting activities, in particular, are in need of this specialized, technical knowledge on a regular basis, as these individuals who go hunting are proactive.

We can significantly impact and streamline threat hunting activities through natural language, by providing guided experiences based on the combination of generative AI, entity analytics data, curated threat intelligence, and the powerful search analytics capabilities provided by Elastic.

**Expected outcome**

Deliver AI-driven entity analytics, including historical entity store, NL-driven entity queries, entity resolution, NL-based visualizations, and more, to satisfy today’s SIEM requirement that was historically fulfilled by legacy UEBA vendors, to complement all analyst and threat hunting workflows, as well as the needs of insider threat teams.

**Roadmaps Included**
- Privilege User Monitoring
- Entity Risk Scoring Alert Filtering
- Entity GenAI Hightlights
- Historical Context Changes & Behavioral Baseline
- Watchlist
- Overview Homepage
- Entity Graph