Alert triage and detection-rule authoring for Elastic, with field masking so the same workflow runs against a cloud, private or air-gapped model.
A 14-day trial licence, issued as soon as you sign in.
Read the hands-on evaluation
An Elastic analyst spends the day on two things: deciding which alerts matter, and writing the detection rules that raise them. Both are judgement work that an assistant can carry most of the way.
RST AI Copilot for Elastic triages alerts, assembles the context for an investigation, and drafts detection rules against your own data model. Multi-turn conversations keep the thread of an investigation instead of restarting at every question.
Field masking decides what may leave the cluster. The same workflow runs against a cloud model, a private one, or nothing off-site at all, which is what makes it usable in an environment where the first two are not permitted.
A question, the query, the answer
People who cannot write a query get their own answers - and see the result: nine accounts were tried in rotation, and only svc_backup eventually let someone in.
Morning shift opens the queue: 42 alerts
A batch arrives and a person starts at the top - including telling apart the two that look alarming and are in fact your own systems.
Open the first one: what actually happened
The first ten minutes of an investigation - gathering the context - is already done, with the ATT&CK chain assembled along with it.
Next time, it raises the alert itself
Writing a detection rule goes from an afternoon in the documentation to one sentence describing the behaviour - and the rule that comes back can be read and reviewed.
What does our own procedure say?
Answers follow your own response procedures rather than generic advice, and the page says which documents they came from.
Of these fields, which may leave?
You decide which fields may leave your network, and it still works when the answer is none of them.
A question, the query, the answer
People who cannot write a query get their own answers - and see the result: nine accounts were tried in rotation, and only svc_backup eventually let someone in.
Also in the box
Free
Includes
$99/user/yr
$9.9/user/mo
Includes
Pricing on request
Unlimited servers · 12-month term
| Capability | CommunityNo licence · Free for good | ProfessionalRecommended1 server · 12-month term | EnterpriseUnlimited servers · 12-month term |
|---|---|---|---|
| Price | Free | $99/user/yr | Pricing on request |
| Batch alert triage with recommended action | Not included | Included | Included |
| Investigation context assembled automatically | Not included | Included | Included |
| Detection-rule drafting with ATT&CK mapping | Not included | Included | Included |
| Platform ops copilot | Not included | Included | Included |
| Reports and scheduled reports | Not included | Included | Included |
| Audit forwarding to an external SIEM | Not included | Not included | Included |
| Multi-provider LLM failover / high availability | Not included | Not included | Included |
| OIDC single sign-on / enterprise identity | Not included | Not included | Included |
| Offline / air-gapped licence issuance | Not included | Not included | Included |
Professional and Enterprise both include the following. None of it is gated by edition.
Need Enterprise, or a deployment shape not in the table? Contact sales
