Elastic Speeds Up SIEM Data Integration with AI-Driven Automatic Import

Elastic (NYSE: ESTC), known for its Search AI technology, has launched a new feature called Automatic Import to expedite the integration of SIEM data. This pioneering tool automates the process of integrating custom data sources into security analytics systems, significantly reducing the time required from several days to under ten minutes. This advancement enhances SIEM implementation efficiency and expands visibility across security operations.

A major Elastic customer recently migrated nearly 200 data sources, including custom technologies, thanks to Automatic Import. This automation helps customers save considerable time and consulting costs.

Michelle Abraham, IDC’s research director for Security and Trust, noted that Automatic Import simplifies the challenging task of onboarding custom data sources, thereby cutting costs and easing the migration process.

Automatic Import utilizes generative AI to streamline security operations tasks, complementing Elastic’s existing AI-driven tools such as Elastic AI Assistant and Attack Discovery. By handling unstructured data at scale and leveraging Large Language Models (LLMs) and Retrieval Augmented Generation (RAG), Elastic enhances its security analytics capabilities.

The feature, part of the Elastic Search AI Platform, provides versatile access to LLM knowledge and integrates proprietary data using RAG. It supports the flexible handling of diverse data types, boosting security visibility and analysis.

Nate Thompson, Senior Manager of Cybersecurity Analytics & Automation at Dana Inc., praised Automatic Import for simplifying the creation and testing of custom data integrations, thereby improving environmental visibility.

Elastic Security already includes over 400 prebuilt data integrations. Automatic Import extends these capabilities, ensuring data is normalized to the Elastic Common Schema (ECS) for uniform analysis through dashboards, search functions, alerting, and machine learning.

Mike Nichols, Elastic’s VP of Product for Security, emphasized that Automatic Import addresses the inherent difficulties of establishing comprehensive IT visibility, particularly as organizations look to replace outdated SIEM tools.