Elastic Security Labs introduces AI-generated hunting leads, a feature built on top of the Elastic entity store that automatically surfaces proactive threat hypotheses tailored to a specific environment. Unlike static detection rules or threat intel feeds, the system maintains longitudinal profiles of users, hosts, and services across four dimensions: attributes, lifecycle, behavior, and risk scoring. By correlating these entity profiles, the AI reasoning layer generates prioritized hunting hypotheses without requiring analysts to know what questions to ask, addressing the 'blank page' problem in threat hunting. The goal is to shift security teams from reactive alerting to continuous proactive defense, with senior analysts starting their shift with pre-curated leads rather than spending hours forming hypotheses.
