Elastic

Every incident started with the same question: Is this a security issue or a platform issue? As Cathay Pacific modernized more than 300 mission-critical applications across 100+ stations worldwide, disconnected monitoring tools left infrastructure and security teams working from different data and debating ownership before they could begin resolving issues. By unifying observability and security telemetry on Elastic Cloud, those teams now work from a shared view of the same data, able to monitor business transactions from end to end. In turn, they’ve reduced operational IT noise by around 30%. See how Cathay Pacific is shifting from reactive firefighting to proactively identifying issues before they affect customers. Read the full story: https://go.es.io/4xEaUPk

At Black Hat, H. Michael Nichols joined theCUBE to talk about how Elastic is using AI to rethink tier 1 triage, helping security teams cut through the noise and focus on the threats that actually need their attention. A good conversation on a very real SOC problem.

Binary quantization sounds like it should tank recall. BBQ in Elasticsearch doesn't due to its asymmetric nature. Vectors compress to single-bit values. Queries stay at int4 precision, so distance calculations keep the detail that matters. You trade a bit of oversampling and reranking for an approximately 95% storage reduction. Trade-off: queries cost slightly more to compute per comparison. Storage costs don't move at all. How it works under the hood: https://go.es.io/4hRZd2E

Elastic{ON} FY27 is in seven cities this year: Mumbai, New York, Amsterdam, San Francisco, London, Singapore, and a Public Sector Summit in Washington, DC, running September 2026 through March 2027. Each stop gives you direct access to the engineers building the platform, and an honest look at what it takes to ground an agent in real-time context, when the data is messy and the latency budget is real. You'll leave with a clear path forward on the use case that's been blocked. Find the stop closest to you: https://go.es.io/4hrNMyE

How do you reduce alert volume without removing analysts from the decisions that matter? Where does automation make sense? How do you validate what an AI agent is doing? And how do you keep the context, control, and visibility you need to understand and act on the results? Those conversations showed up everywhere last week at Black Hat 2026, from Alert Zero and continuous hunting to endpoint protection, security automation, model transparency, and new threat research. We talked about what this looks like in real environments with customers and alongside partners, not just what it looks like on a slide. Help, not hype. Thanks to everyone who stopped by and brought the hard questions. Keep them coming in the comments! #BHUSA

Here's everything you need to know about Elastic 9.5 from JP Hwang. A brand new columnar database, smarter vector search, and native Prometheus and PromQL support now GA. Plus new capabilities across Search, Observability and Security. Full release notes and docs in the blog: https://go.es.io/4z8IUol

A credential POST, then a reverse tunnel, then LaunchAgents to keep it alive. The parent process was vendor-signed Claude Code. We reviewed one macOS developer endpoint, a single window on 23 Jul. Immediate children were mostly zsh, not Claude running every binary itself. - curl POST to /login on a <id>.lhr[.]life host, credentials sitting in the command line - a poll loop until HTTP 200, bodies discarded to /dev/null - a cookie-authed /api/summary pull filtered to {spend} - cloudflared tunnel --url http://localhost:<port>, control plane at api.trycloudflare[.]com - PlistBuddy setting StartInterval 60 on a com.<vendor>.<app>.watchdog plist, reloaded via launchctl bootstrap In a queue that's an intrusion. It's also indistinguishable from vibe-coded ops: someone published a local dashboard through a free tunnel and logged into it with agent help. Nothing in the telemetry separates the two. VirusTotal flags the lhr[.]life apex. Free tunnel brokers get flagged precisely because they get abused, so that's a hunt signal and not a verdict. Load the apex yourself and it answers "no tunnel here." The Cyrillic status strings in the wrapper (проверка, "check") add attribution weight they haven't earned. The keychain read has the same problem. The host ran security find-generic-password -s "Claude Code-credentials", which prints an OAuth token to STDOUT. Documented Claude Code behavior. What fired: Unusual Network Connection to Suspicious Top Level Domain, Unusual Network Connection to Suspicious Web Service, Persistence via GenAI Tool. No single rule owned the sequence. Sequence is what made the case: readiness loop, publish localhost, then a LaunchAgent with KeepAlive polling the public URL. Don't auto-close it because Claude or Cursor sits in the process tree. That instinct only gets more expensive as agents take on more of what developers already do in a shell. Full write-up from Mika Ayenson, Ph.D. and Jia Yu Chan, including the days of tunnel-binary noise before this window, three related cases on other hosts, and the ATT&CK mapping: https://go.es.io/4pZOXY9

Most enterprise AI programs are still a collection of pilots. Different tools, different teams, no shared architecture, no consistent way to measure what's working. It's a familiar starting point, and one Elastic's own IT team decided to move beyond. CIO Adnan Adil and AI enablement lead Devin Rhoades set clear conditions before any AI workflow goes live: it’s grounded in proprietary data, instrumented for accuracy, and tied to specific business metrics from day one. Across conversational AI and autonomous agents deployed in support, sales, security, and IT, the outcomes are measurable: $1.7M in first-year cost avoidance $372M in AI-influenced pipeline ~1,300 work days saved over the past year If your AI initiatives are still fragmented across teams and tools, this playbook shows what it looks like to go from scattered pilots to a unified governed system. The full playbook → https://go.es.io/4bhY8NK

A week of putting help, not hype, into practice. James Spiteri with a quick recap from the Black Hat show floor.

AI doesn't just test your models. It tests the architecture they’re built on. As organizations move AI into production, disconnected data, point solutions, and complex integrations become harder to work around. The result is slower deployments, delayed ROI, and more time spent stitching systems together instead of putting AI to work. The organizations that move fastest won't simply adopt AI. They'll remove the friction that stands between AI investment and production. In this blog, Jesse Sladek, GVP Partner Sales, Strategy & Enablement at Elastic, examines why platforms are a competitive advantage for enterprises, and the partners helping customers put AI into production. The details: https://go.es.io/4z16inB