AI-assisted network analysis for Elastic data
This package gives Elastic users a reusable set of Agent Builder agents and ES|QL-backed tools for investigating network telemetry. Use it when analysts need help moving from broad network health checks into packet evidence, suspicious DNS or TLS behavior, HTTP failures, Suricata findings, and conversation-level triage.
The agents are designed for SOC, network operations, and observability teams that collect Elastic Network Packet Capture data, Suricata EVE events, or ECS-compatible network telemetry in Elasticsearch. They provide guided analysis while keeping conclusions grounded in the available evidence.
What is included
- Network Analyst: reviews network health, traffic paths, protocols, ports, latency, failures, and IDS evidence.
- Network Threat Hunter: investigates Suricata alerts, suspicious DNS activity, TLS posture, and cross-sensor evidence without overstating unconfirmed detections.
- Packet Forensics Investigator: reconstructs application transactions and correlated timelines from HTTP, DNS, TLS, PostgreSQL, flow, and Suricata metadata.
- Supporting ES|QL tools for data coverage, protocol health, top conversations, Community ID tracing, DNS anomalies, HTTP failures, TLS risks, and Suricata findings.
- A ZIP package with exported Elastic Agent Builder JSON definitions that can be reviewed and imported into a compatible Kibana environment.
When to use it
Use these agents during network triage, packet-inspection reviews, threat hunting, and operational health checks. They are useful when an analyst needs to ask repeatable questions such as which data sources are fresh, which protocols are failing, which conversations dominate traffic, whether DNS or TLS signals look risky, and how Suricata evidence maps to related network events.
Before using the package in production, review each agent and tool definition, validate index patterns, and test the ES|QL queries against your own data. The tools expect ECS-style fields from Elastic Network Packet Capture and/or Suricata data, including fields such as network.community_id, source/destination addresses, protocol, port, status, timing, and alert metadata.
Compatibility and source
This package was exported from the Elastic Content Share Kibana 9.4.3 test deployment and is tagged for Elastic Stack 9.4.3. Because Agent Builder APIs and artifact formats can evolve quickly, review the imported definitions after upload and test them in a non-production space first.
Source: creator-submitted Elastic Agent Builder export from the Elastic Content Share 9.4.3 test cluster. Agent IDs: network-analyst, network-threat-hunter, and packet-forensics-investigator.
Related content: pair these agents with the Network Monitoring Suite for Kibana, the Filebeat Suricata Canvas dashboard, and more Elastic AI tools.
| Tested versions | |
| ECS compliant | |
| Tested versions |
You must log in to submit a review.