Elastic and OpenAI join forces to enhance artificial intelligence on unstructured business data

Elastic and OpenAI Collaborate to Bring Advanced Intelligence to Unstructured Business Data

AI agents are only as good as the data they have access to. Elastic and OpenAI are working together to help businesses unlock the value of their unstructured data—documents, tickets, logs, metrics, traces, and security alerts—to build production-ready AI applications.

Three Key Outcomes

The collaboration between Elastic and OpenAI aims to deliver three key outcomes for businesses:

• Contextual intelligence: AI agents need access to relevant business data to provide accurate and useful responses. Elasticsearch serves as a contextual layer, providing persistent and governed memory that allows agents to retrieve what’s relevant and maintain useful knowledge across interactions.
• Operational efficiency: By automating investigations and remediation using telemetry data, historical incidents, design documents, runbooks, and guidelines, teams can apply repeatable practices and reduce the time spent gathering evidence and switching between tools.
• Security and compliance: Elastic Security provides a unified, agentic security operations platform that investigates, correlates evidence, and prepares a response plan while analysts retain judgment, validation, and approval. This helps security teams simplify investigations and improve outcomes.

Why It Matters

The partnership between Elastic and OpenAI represents a significant step toward intelligent management of unstructured business data. This type of data, which includes documents, tickets, logs, metrics, traces, and security alerts, is often scattered and subject to varying permissions. The goal is to create production-ready AI applications that can leverage OpenAI models integrated with Elasticsearch to their fullest potential.

Business Context and Innovation

The collaboration between Elastic and OpenAI represents a significant step toward intelligent management of unstructured business data. This type of data, which comprises documents, tickets, logs, metrics, traces, and security alerts, is often dispersed and subject to variable permissions. The objective is to create AI applications ready for production that can make the most of OpenAI models integrated with Elasticsearch.

Elasticsearch: The Context Layer for Agentic AI

In the era of agentic AI, the value of a company lies in its context: data, history, decisions, and institutional knowledge scattered across unstructured data. OpenAI’s internal data agent demonstrates that reliable results depend on the ability to integrate multiple layers of context. Elasticsearch, as a context layer, provides agents with persistent and governed memory, allowing them to retrieve what is relevant and maintain useful knowledge across interactions.

Challenges and Solutions

The practical challenge of context is a retrieval problem: selecting the right information at the right time with the appropriate permissions. Elasticsearch combines lexical and vector search, semantic re-ranking, filters, and access controls into a single platform. In Elastic’s internal tests, using Elasticsearch for organizational memory provided a recall of 0.89 and complete data protection among users.

Economy and Accuracy

Economy is as important as accuracy. In a limited experiment using the BrowseComp-Plus dataset, Elastic’s precomputed knowledge indicators reduced input token usage by up to 75% compared to the standard Retrieval-Augmented Generation (RAG) baseline, while response accuracy improved from 60% to 92%. Results vary by workload, but the direction is clear: better retrieval can improve both reliability and cost.

Elastic Agent Builder

Elastic Agent Builder can be used with OpenAI models and agents to enhance context and provide greater relevance and efficiency. Agent Builder tools can be exposed to OpenAI agents via MCP, skills are available for Codex, and Agent Builder supports GPT models for reasoning and tools.

Elastic Observability: Agentic Investigations Powered by Unstructured Telemetry

Operational context resides in unstructured telemetry data. Agentic applications introduce additional data such as prompts, tool calls, model responses, token usage, traces, and retrieval steps. Elastic Observability unites these AI application signals with logs, metrics, traces, and digital experience data into a single observability platform. With Elastic Workflows, Agent Builder, and skills, teams automate investigations and remediation using telemetry data, historical incidents, design documents, runbooks, and guidelines, applying repeatable practices.

Agentic Investigation Experiences

Elastic’s agentic investigation experiences begin when an alert fires, correlating evidence across signals, identifying a likely root cause, and showing the next recommended steps as SRE investigation begins. The result is less time spent gathering evidence, less tool switching, and faster resolution.

Agentic Security Operations Platform

Security teams face a similar context problem with too many alerts scattered across an increasing number of endpoints, networks, cloud providers, identities, and application data. Elastic Security is an agentic security operations platform that unifies SIEM, XDR, and native automation around an agentic operating model. The platform investigates, correlates evidence, and prepares a response plan while analysts retain judgment, validation, and approval. These capabilities are available in Elastic Security today, and this new operating model is already helping our customers simplify investigations and improve outcomes.

Attack Discovery

Attack Discovery works with OpenAI’s latest models to correlate disparate alerts into coherent attack chains, mapping activity to MITRE ATT&CK, identifying affected users and hosts, and attaching the results to cases and response workflows so analysts can triage a handful of evidence-backed attacks instead of thousands of raw alerts.

Elastic Agent Builder

Agent Builder comes with a native, ready-to-use agent with skills, such as threat hunting and alert analysis, controlled access to tools, and complete reasoning traces for auditability. Teams have the option to build custom agents and workflows based on Agent Builder. Meanwhile, Automatic Import builds custom data integrations in minutes, Automatic Migration translates detection rules from Splunk and QRadar to Elastic Security, and the Elastic Security MCP app brings alert triage, threat hunting, and case management to the AI tools analysts already use.

Measurable Value

With these capabilities, our customers are already seeing measurable value. Visa, as part of its migration from a legacy SIEM to Elastic Security, built its first agentic SOC workflow with a human-in-the-loop AI validation step. This reduced the triage of a high-risk mainframe detection from 10-20 minutes to seconds, while keeping every AI decision auditable. Airtel’s managed security team reports up to 40% faster triage and analysis and up to 30% faster investigations using Attack Discovery, Agent Builder, and Automatic Import.

Monitoring the OpenAI Platform

Elastic also helps security and compliance teams monitor the OpenAI platform itself. The existing integration ingests organizational audit events, such as access attempts, API key lifecycle changes, role assignments, and configuration updates. These events can be analyzed alongside endpoint and network activity to identify suspicious behaviors in the broader AI environment. Upcoming support for Elastic’s OpenAI Compliance Logs Platform will give enterprise teams a more complete and auditable view of activity across OpenAI workspaces and services.