Elastic Security 9.4: Workflows GA and SIEM Readiness

In Elastic 9.4, released on 5 May 2026, security changed most in four places: Elastic Workflows reached GA, a SIEM readiness assessment appeared, privileges for rules and alerts can be separated, and entity analytics (users, hosts, services) gained four new capabilities. For a team running a SIEM on Elastic Security this release is more about organising work than about new rules. Below we discuss what is worth switching on first.

Features and statuses at a glance

Feature	Status in 9.4
Elastic Workflows (automation: enrichment, triage, response, notifications, cases)	GA
Granular privileges for detection rules and alerts	GA
SIEM Readiness: Visibility Health and data coverage	Technical preview
Precision Entity Identification, Entity Resolution, Dynamic Watchlists, Entity-Driven Hunting Leads	GA
Runscript and script library, memory dump on Linux (response actions)	GA
Skills for the AI agent: alert triage, rule authoring, entity investigation, threat hunting, anomaly analysis	Status not given in the announcement
Workflow authoring skill	Experimental

Source: the Elastic 9.4 announcement. The announcement says that Workflows for security are available to customers with an Enterprise subscription. Check the licence scope of the other features in the documentation before you plan to use them.

Workflows: automation where the data lives

Workflows is a mechanism built into Kibana that lets you describe a process step by step: enrich an alert with data from other sources, assess its severity, notify the team, open a case or trigger a response. In version 9.3 the feature was a preview. From 9.4 it has GA status.

Before you start, check two things. First, access is controlled by the Workflows privilege under Analytics in a Kibana role: reading needs Read or All, and full management needs All. Second, the documentation requires a suitable subscription. It is best to start with one simple process, for example enriching an alert with information on whether the host is a critical server, and opening a case only for such alerts. Only when that process runs reliably should you add more. An automatic response that disables an account or isolates a host needs separate approval from the system owner and clear exception conditions.

Separate privileges for rules and alerts

Version 9.4 lets you grant separate privileges for detection rules and for alerts. After the upgrade, review your existing roles and decide who should have which privilege. The documentation describes the rules for how existing roles are handled, so read it before you make changes. It helps if changing a rule requires review by a second person, but that is a question of process, not of a Kibana feature.

SIEM Readiness: is your data what you think it is

The most practical novelty for a SIEM owner is SIEM Readiness, for now in technical preview. According to Elastic’s post of 4 May 2026, the tool assesses visibility health in five log categories: endpoint and host, identity, network, cloud, and application and SaaS. It rates each category along four dimensions:

• Coverage: whether the data your rules need arrives at all,
• Quality: whether the data is good enough for detection,
• Continuity: whether it keeps arriving, without gaps,
• Retention: whether it is kept long enough.

The assessment is based on data your environment already sends. In SIEM projects it is common to find that a rule exists but the source stopped sending data three weeks ago and nobody noticed. It is worth doing such a review regularly, not only at deployment. Because the tool is a preview, treat the result as a prompt for your own review, not as a final compliance rating.

Entity analytics in GA

Four entity analytics features have GA status in 9.4. Precision Entity Identification builds verified profiles of users, hosts and services. Entity Resolution merges accounts from different sources, such as Okta, Entra and Active Directory, into one identity. Dynamic Watchlists let you raise the risk score for important entities, for example administrator accounts. Entity-Driven Hunting Leads suggests threat hunting leads based on risk. You will see the greatest benefit where one person has several accounts in different systems, because the risk assessment then concerns a person, not a single login.

Response actions on hosts

Two features with GA status were added to response actions in 9.4: Runscript with a script library, which runs scripts from the response console or as a rule action, and memory dump on Linux. Memory dump was available earlier on Windows, so a team doing post-intrusion analysis gets similar capabilities on Linux servers. Scripts run remotely on hosts are a risky tool, so decide who may add them to the library and who may run them, and write it into your incident response procedure.

AI agent skills

The announcement describes five skills for the AI agent in Elastic Security: alert triage, detection rule authoring, entity investigation, threat hunting and anomaly analysis. The skills can run one after another, and a separate, experimental skill helps create workflows. The announcement does not give their status, so before you use them in SOC work, check it in the documentation and assess the results on alerts you already know. It is safest to treat such an agent like a junior analyst: a human checks its conclusions.

What to watch

• AI agents and skills. Elastic adds skills for the agent (triage, rule writing, entity analysis). Before you enable them, establish what data may reach the model and where that model runs. This is a decision for security and data protection, not a technical setting.
• Preview features should be enabled in a test environment first.
• Upgrading to 9.4 requires a review of the breaking changes, especially if you also use metrics and time series. We describe them in the article on Elastic 9.4 for metrics.

How to apply this in practice

For the first weeks after upgrading to 9.4 we suggest this order: a review of roles and privileges, one simple workflow to enrich alerts, SIEM Readiness once a week in a test environment, and entity analytics wherever you have data from an identity directory. If you are only starting to build a SIEM, begin with first steps with detection rules.

We cover data sources, rule tuning and alert handling in Elastic Security as part of our SIEM and security service.