From vulnerability report to CVE draft in minutes: how Elastic automated security advisories with AI

Elastic’s InfoSec Product Security Team built the “Elastic Security Advisory Generator,” a generative AI agent using Elastic Agent Builder that drafts CVE-style advisories by performing retrieval-augmented generation (RAG) against indexed MITRE CWE and CAPEC catalogues. The report provides crawler configurations for ingesting CWE/CAPEC data into Elasticsearch, describes the agent’s tooling and grounding workflow, enumerates prompt-level guardrails (classification safety, disclosure checklist, CVSS reasoning), shows example output (ESA-2026-01), and outlines plans to integrate the agent into triage workflows.