Know who to watch before the incident finds you

Elastic Security v9.4 introduces Entity Analytics Watchlists, a feature that allows security, HR, and ops teams to create named, weighted lists of users, hosts, and services so that that organizational context (e.g., departing employees, privileged users, critical hosts) is injected directly into the platform's entity risk scoring pipeline without ES|QL or pipeline engineering; watchlists can be manually curated or automatically populated and are intended to prioritize investigations by compounding list membership with alerts, asset criticality, and behavioral signals.