A general-purpose language model knows what a cryptominer is. It can describe containment best practices in reasonable terms. What it doesn't know is that your organization's IRP-004 requires dual approval from the SOC lead and payment operations before any payment host is isolated. It doesn't know that your PCI-DSS obligations require the compliance team to be notified within four hours of confirmation, not 24 hours, not "as soon as possible," but four hours documented in your own policy. It doesn't know that your network quarantine procedure uses VLAN PAYMENT-QUARANTINE or that your forensics team needs a disk snapshot tagged with the incident reference before any remediation begins.

That specificity is the difference between advice you can act on and advice you have to reinterpret before you can act on it. In a regulated industry, reinterpretation introduces risks like the wrong call, the missed notification window, or the undocumented step.

The answer isn't to train a model on your internal documentation (which changes, is version-controlled, and may be restricted). The answer is to put your incident response playbooks into Elasticsearch and give your AI agent a search tool over that index.

This is search in its most practical form: not a UI for humans to browse, but a retrieval mechanism for an AI agent to ground its reasoning in your actual procedures at the moment they're needed. When the agent confirms a cryptominer on a PCI-DSS-scoped host, it doesn't reach for general knowledge. It searches the playbooks, retrieves IRP-001 and IRP-004, and derives its recommendations directly from the steps your security and payment teams wrote and approved. "Isolate the host" becomes "apply the PAYMENT-QUARANTINE security group, allow inbound from the forensics VLAN only, get sign-off from SOC lead and payment operations, and notify the compliance team within four hours." Every recommendation is traceable to a specific section in a specific document.

This matters beyond compliance. It makes the AI's recommendations auditable. When a regulator asks how a decision was made, the answer isn't "the model suggested it." Instead, it's "the agent retrieved IRP-004 Section 3.2 and followed it." That's a chain of evidence you can defend.

The same principle extends beyond security playbooks. Product runbooks, escalation matrices, vendor SLAs, regulatory obligations, and change procedures shape how your organization responds to events. Ingesting them into Elasticsearch makes that guidance available to the agent as grounded, retrievable context. You're not training the model; you're giving it a library and teaching it to search.

Context engineering

Vector database

Search powered applications

Logs

Threat protection

Workflows

Elasticsearch

Kibana (Discover, Dashboards)

Elastic Agent Builder

AutoOps

Piped query language

Jina AI search models

Elastic Cloud Serverless

Elastic Cloud Hosted

Self-managed Elasticsearch

Ecommerce search

Customer support search

Search-driven apps

Log analytics

Infrastructure monitoring

Digital experience monitoring

App performance monitoring

AIOps

LLM observability

Next-gen SIEM

Agentic SOAR

XDR and endpoint security

AI for security

10x your data's value

Cloud providers

Elastic AI Ecosystem

Search AI Partner Program

AV-Comparatives

Forrester Wave™ XDR

Gartner Magic Quadrant Leader

IDC MarketScape

Search

Security

Observability

Get started

Demo gallery

Downloads

Integrations

Docs

Elasticsearch Labs

Elastic Security Labs

Elastic Observability Labs

Blog

Community

Events

Webinars

Discuss

Training

Support

Consulting

Author

Articles by Roberto Arico

Senior Solutions Architect

The security attack that hid inside your observability data

Sign up for Elastic Cloud free trial