James

Helping folk do security things with @elastic. Views are my own. Creator of and

[Samir @SBousseaden]

new detection content for Kubernetes covering a variety of techniques using k8 audit logs:

https://t.co/VTBCknTQaP

[James @jamesspi]

Built something new to showcase what's possible with @elastic's Workflow and Agent Builder capabilities in 9.4.

Lurelit - an agentic screenshot analyzer for phishing and smishing attempts. Entirely powered by an Elastic workflow, end-to-end.

Upload a screenshot of a suspicious message. The workflow handles the rest:

AI vision analysis extracts IOCs and classifies the threat

VirusTotal and https://t.co/yOB3RwOskF enrich every URL and domain

Automated ES|QL hunting across your Elastic environment
Human-in-the-loop gates before proceeding with hunts

Token consumption tracking with per-model cost breakdowns

It demonstrates Workflows GA, Agent Builder's new skills framework, the connector framework, the consumption API, and human-in-the-loop steps with conditional triggers.

The workflow is 700+ lines of configuration. I didn't write a single line. The natural language workflow authoring skill built the entire thing.

Code, docs, bootstrapping UI, and sample data included.

https://t.co/ZnpV9ZKFjM | https://t.co/xmdVMnH9ha

[Elastic @elastic]

Agent Builder in Elastic 9.4 cuts token costs by up to 40%.

Not by truncating context, but by enabling agents to manage it independently.

Four mechanisms do the work:
• Dynamic skill loading: instructions load only when needed, not all at once
• Conversation context store: large result sets stay out of the prompt until required
• Selective compaction: long conversations compress without losing what matters
• OAuth connectors: query Google Drive, Salesforce, Slack without copying data

In internal testing, dynamic skills alone cut input token usage by 21 to 39%.
Top snippets retrieval added another 27 to 34% reduction.

Context window stays stable past 30 turns.
Without this, it balloons to max size by turn twelve.

[Elastic @elastic]

Elastic 9.4 is now available, bringing new advancements across the Elasticsearch Platform.

Key new features:
• Elastic Workflows GA, scripted automation and agentic reasoning enable AI agents to act on their findings
• Elastic Agent Builder enhancements optimize context, transforming agents from open-ended prompts into controlled, action-driven systems
• Native Prometheus and PromQL support, with significant TSDB efficiency improvements, position Elastic Observability as a compelling alternative to competing metrics solutions and enable a single platform across logs, metrics, and traces

Transform data into answers, actions, and outcomes.

Learn more: https://t.co/ja8HiIOrFY

[James @jamesspi]

@HackingDave I honestly hate that Cursor took away the usage indicator below the agent window. Now the only way I find out is when the Amex notifications start blowing my phone up 🥹🥹🥹

[Elastic Security Labs @elasticseclabs]

We have identified a novel social engineering campaign abusing Obsidian, the popular note taking app, to deliver a previously undocumented RAT #PHANTOMPULSE and it’s loader #PHANTOMPULL targeting individuals in finance and crypto.

The attack never exploits a vulnerability. It abuses Obsidian's own plugin ecosystem to execute code the moment a victim opens a shared vault.

Full analysis: https://t.co/y7sGjClCKc

[James @jamesspi]

@uwu_underground @_devonkerr_ @statictear @elasticseclabs You might want to clarify just a bit, many are confused by your post.

[James @jamesspi]

@dez_ @_devonkerr_ “Dislike” 🥺

[James @jamesspi]

@_devonkerr_ @andythevariable @soolidsnakee @bluish_red_ @k33b0i @rsprooten @cyril_t_f This is amazing

[James @jamesspi]

Quick new thing, in case it helps anyone.

https://t.co/LSWooBJBGa

Have fun!

[Joe Desimone @dez_]

We open sourced the tool used to detect the Axios supply chain compromise! I built it Friday after a red eye home from RSAC. Also, wrote up the full story, including the hectic moments after that first critical alert
https://t.co/HAm8eMr8vO

[International Cyber Digest @IntCyberDigest]

‼️ Meet the guy almost everyone loves for alerting the axios devs about the supply chain attack.

He built a supply chain monitoring system last week, and was alerted within minutes of the axios compromise.

The world should be thanking Elastic Security's finest:
Joe @dez_

[Elastic Security Labs @elasticseclabs]

ElasticSecurityLabs detects the Axios npm supply chain attack across Linux, Windows & macOS.

Our behavioral detections caught it without relying on static indicators.

Full malware analysis dropping soon: https://t.co/RLFNCpS6AG

[Elastic @elastic]

Elastic Cloud Hosted on AWS GovCloud (US) achieves FedRAMP® High authorization, continuing our team’s longstanding commitment to the highest levels of security and efficiency for sensitive government data.

https://t.co/FObcNQRwD3

[Joe Desimone @dez_]

We are working it, sharing what we know as of now - https://t.co/iYq5HUJ767

[James @jamesspi]

@ReEnElec @elasticseclabs It’s just an example to show additional evidence collection by an agent once something is detected. Very common practice to back up a finding with known intel.

[Elastic Security Labs @elasticseclabs]

APT confirmation used to take hours. Now it takes 4 minutes.

Attack Discovery correlates alerts into a single narrative.
A workflow triggers the agent.
The agent:
• Looks up the hash on VirusTotal
• Runs ES|QL queries across your logs
• Finds the on-call analyst
• Creates a case
• Opens a Slack incident channel

All before you read the threat intel report.

[James @jamesspi]

@Ubiquiti @stiltznet 🥹

[Gabriel Landau @GabrielLandau]

Step right up! 📢 We’re serving up a Windows kernel exploit that never goes stale. 🍿 Forget patches, this forever-day is popping off and it's here to stay. Grab a bucket and watch the show! https://t.co/E3zbarcY7L

[James @jamesspi]

@dipl3_ @Flangvik @EmericNasi @ShitSecure @_JohnHammond @domchell That’s right. What was previously endgame is now part of Elastic Security, has been for a few years now. I had started a series a while back showing some of its capabilities here, in case you wanted to take a peek - https://t.co/91ZFYUh7ic