Inside Elastic InfoSec's agentic SOC: How we cut AI agent LLM calls by 60%

This post describes a five-step, repeatable optimization process Elastic InfoSec uses to reduce LLM call counts, token usage, and inconsistent behavior in Agent Builder agents: (1) measure baseline consumption, (2) capture representative test conversations, (3) analyze traces for inefficiencies, (4) revise and verify prompts, and (5) monitor for drift. It includes concrete patterns, prompt fixes (stopping checklists, anti-redundancy rules, field projections), verification guidance, and metrics to watch post-deployment—practical operational guidance, not an incident report.