One agent, the right skills: Elastic Security 9.4 brings domain expertise on demand to every SOC workflow

Elastic Security 9.4 introduces a modular AI Agent architecture called "skills" that packages focused system prompts, curated tools, and domain content to perform discrete SOC workflows (Detection Rule Edit, Alert Analysis, Threat Hunting, Entity Analytics, Security ML Jobs). The article explains how skills activate on demand to avoid context dilution, shows example scenarios (macOS LOLBin detection, credential-harvesting triage, and service-account exfiltration) to illustrate end-to-end workflows, and describes integration with Attack Discovery, Workflows, and platform skills for automation and analyst productivity.