Elastic Security 9.4 introduces 'Skills', a modular AI agent architecture for security operations centers. Instead of one monolithic AI prompt covering all SOC workflows, Skills are self-contained packages of domain expertise, curated tools, and specialized instructions that activate on demand. Five core skills ship with 9.4: Detection Rule Edit (writes ES|QL rules, maps to MITRE ATT&CK), Alert Analysis (triage and threat intel enrichment), Threat Hunting (hypothesis-driven iterative querying), Entity Analytics (risk profiling), and Security ML Jobs (anomaly investigation). Skills compose naturally — Alert Analysis can hand off to Entity Analytics mid-investigation — without requiring analysts to switch agents or manually transfer context. Three platform skills (Dashboard Management, Workflow Authoring, Graph Creation) round out the release. The architecture is extensible, with each skill operating in its own focused context window so adding new skills doesn't degrade existing ones.
