Building Production Security Features with LangChain and LLMs

elastic · Tech · 2024 · source Agentic: yes · promotional bias: high · source-backed · extracted with prompt 0.5.5 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Generative AI features for security operations

Elastic Security needed to help security teams migrate from legacy SIEM workflows to AI-assisted security analytics by automating labor-intensive tasks such as query generation, data integration creation, attack description, and analyst assistance.

Constraints:

• Security users need context-aware reasoning over complex security scenarios.
• ES|QL adoption required learning query syntax and functions.
• Generated security queries need rich retrieval context from Elastic content.
• Automatic integration creation is a stateful multi-step workflow.
• Production LLM features require tracing, debugging, performance tracking, and cost estimation.
• Enterprise customers may need to choose their own LLM provider.

Architecture

Elastic Security used LangChain, LangGraph, and LangSmith to deliver three AI-driven security features. Elastic AI Assistant generates ES|QL queries from natural language using RAG and a LangGraph workflow backed by a modified Elasticsearch LangChain vector store component. Automatic Import uses LangGraph and LLMs to generate integration packages from sample data through stateful workflows. Attack Discovery uses context-aware reasoning to identify and describe attacks. LangSmith instruments the LLM flows for tracing, debugging, performance tracking, and cost estimation, while Elastic's open inference API plus LangChain chat-model integrations let customers bring their LLM of choice.

Diagram confidence: reconstructed (reconstructed from prose).

flowchart LR
  security-user[Security user] --> elastic-ai-assistant[Elastic AI Assistant]
  security-user --> automatic-import[Automatic Import]
  security-user --> attack-discovery[Attack Discovery]
  elastic-ai-assistant --> esql-generation-graph[ESQL generation graph]
  esql-generation-graph --> rag-retriever[RAG retriever]
  rag-retriever --> elasticsearch-vector-store[Elasticsearch vector store]
  elasticsearch-vector-store --> elasticsearch-platform[Elasticsearch Platform]
  esql-generation-graph --> chosen-llm[Chosen LLM]
  chosen-llm --> open-inference-api[Open inference API]
  open-inference-api --> langchain-chat-model-ecosystem[LangChain chat model ecosystem]
  automatic-import --> automatic-import-graph[Automatic Import graph]
  automatic-import-graph --> chosen-llm
  attack-discovery --> chosen-llm
  esql-generation-graph --> langsmith[LangSmith]
  automatic-import-graph --> langsmith
  attack-discovery --> langsmith
  elasticsearch-platform --> elastic-observability[Elastic Observability]

Components

Data flow

For ES|QL query generation, a security user asks a natural-language question in Elastic AI Assistant. A LangGraph workflow retrieves vectorized context from Elasticsearch through a modified LangChain vector store, passes that context to the chosen LLM, and returns ES|QL. Automatic Import follows a separate LangGraph workflow that turns sample data into an integration package. LangSmith traces the resulting LLM requests and workflows so the team can debug, track performance, and estimate costs.

Why this architecture

Elastic used LangGraph because the workflows require context-aware reasoning, controllable stateful orchestration, and multi-step generation rather than simple one-shot prompting. RAG addresses the need for query-specific security context, LangSmith addresses the opacity of production LLM requests, and open inference plus LangChain's chat model ecosystem addresses enterprise model-choice requirements.

Models used: Customer-selected LLMs · LangChain chat models · Large language models

Scale

• Elastic AI Assistant for Security reached over 350 production users according to the quoted LangChain engineer.
  “has successfully deployed to production, reaching over 350 users”article, stated
• Elastic released three generative AI capabilities in this security suite.
  “We’ve released three capabilities — Automatic Import, Attack Discovery, and [Elastic AI Assistant]”article, stated

Alternatives considered (roads not taken)

Require analysts to learn ES|QL manually

Rejected because: Elastic wanted to simplify ES|QL adoption by generating queries from natural-language questions.

One fixed LLM provider

Rejected because: Enterprise security users may need their own preferred model for cost, compliance, or capability reasons.

Ship LLM workflows without trace breakdowns

Rejected because: Production LLM applications need request-level visibility to debug issues, performance, and cost.

Patterns

rag-retrieval (context-engineering)

Elastic AI Assistant uses retrieval over vectorized Elasticsearch content to ground ES|QL generation in relevant security context.

tool-use-orchestration (agent-architecture)

LangGraph orchestrates stateful security workflows for ES|QL generation and Automatic Import.

observability-tracing (operations)

Elastic uses LangSmith for LLM request breakdowns, debugging, performance tracking, and cost estimation.

model-routing (model-operations)

Elastic's open inference API and LangChain chat-model ecosystem let users integrate their preferred LLM into the same features.

structured-output-contract (output-control)

The ES|QL workflow turns free-form security questions into a specific query-language output.

Tradeoffs

Use LangGraph for controllable workflows

Chose Stateful graph workflows for query generation and import generation over Simple sequential prompt chains.

Rationale: The source emphasizes context-aware reasoning, stateful workflows, and controllable agent orchestration.

Let customers choose LLMs

Chose Open inference API plus LangChain chat-model ecosystem over A single hardcoded model provider.

Rationale: Security customers can integrate generative features with the LLM provider that fits their requirements.

Use Elastic search infrastructure inside the LangChain graph

Chose Modified Elasticsearch LangChain vector store over A separate retrieval backend disconnected from Elastic's platform.

Rationale: Using Elastic's own Search AI platform lets the generation workflow retrieve vectorized content needed for ES|QL formulation.

Gotchas (what bit them)

Security query languages impose a steep learning curve.

Root cause: Threat hunting and detection users otherwise need to learn ES|QL syntax and functions.

Resolution: Generate ES|QL from natural-language questions with RAG and LangGraph.

Production LLM workflows are hard to debug without trace visibility.

Root cause: LLM requests span retrieval, graph execution, model calls, and generated query output.

Resolution: Instrument workflows with LangSmith to get request breakdowns, traces, performance tracking, and cost estimates.

The public case study gives limited failure or quality data.

Root cause: The article is a partner/product post and does not provide accuracy, latency, or detailed lessons-learned metrics.

Resolution: Treat the reported production/user outcome as directional and preserve promotional-bias metadata.

Evaluation

The source does not report a formal accuracy evaluation. It describes operational observability through LangSmith tracing, performance tracking, and cost estimation, plus production deployment to over 350 users. Elastic also points to Elastic Observability with OpenTelemetry for tracing LangChain applications.

Metrics: LangSmith trace breakdowns · Performance tracking · Cost estimation · Production user count · Application tracing · Logging · Metrics analysis

Outcomes

• Elastic released Automatic Import, Attack Discovery, and Elastic AI Assistant as AI-driven security capabilities.
• Elastic AI Assistant for Security was reported as deployed to production with over 350 users.
• The ES|QL workflow uses RAG and LangGraph to generate queries from natural language.
• Automatic Import uses LangGraph to generate integration packages from sample data.
• Elastic Security users can integrate the features with their LLM of choice.
• The article does not provide objective accuracy, latency, or user-satisfaction metrics.

The only concrete scale claim in the source is production deployment reaching over 350 users; the post also states that three capabilities were released.