Elastic 9.4: Workflows GA, Agent Builder updates, and Prometheus/PromQL support
2026-05-06T19:23:37Z•775365ff26d44ee4a4664ced81054a0b2a07091414081e36899f7fb395bd0a04
agent-builderapm-http2attack-discoveryautomatic-importcustom-threat-inteldetection-engineeringelasticelastic-9.4elastic-stack-8.19.15elastic-stack-9.3.4generative-aijvm-metricsllmobservabilityprometheuspromqlreleasesiem-readinesssoar-replacementsplunk-migrationupgrade-recommendedworkflows
What happened
Feed of Elastic product and security-related blog posts (May 2024–May 2026) highlighting Elastic 9.4 (Workflows GA, Agent Builder improvements, native Prometheus/PromQL and TSDB enhancements), SIEM Readiness (technical preview), native automation via Elastic Workflows (positioned as a SOAR replacement), GA of generative-AI security features (Automatic Import, Attack Discovery), a Custom Threat Intelligence integration, various guidance posts (JVM metrics, LLM/OWASP guidance, detection engineering), and release notices (Elastic Stack 8.19.15 and 9.3.4) that fix an APM HTTP/2 framing regression.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- elastic_security_blog
- Record identifier
- 775365ff26d44ee4a4664ced81054a0b2a07091414081e36899f7fb395bd0a04
- Enrichment time
- 2026-05-06T19:23:37Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.