Elastic's InfoSec Product Security Team has developed a generative AI agent to automate the drafting of security advisories, significantly reducing the time required to process vulnerability reports. This new system leverages Retrieval-Augmented Generation (RAG) against MITRE's Common Weakness Enumeration (CWE) and Common Attack Pattern Enumeration and Classification (CAPEC) catalogs, which are indexed in Elasticsearch.
The manual process of creating security advisories is described as time-consuming, primarily due to the need to distill lengthy, technical vulnerability reports into concise, customer-friendly advisories. This process includes identifying the correct CWE and CAPEC classifications, which adds complexity and delays. Elastic follows a standard CVE description template: "[PROBLEMTYPE] in [COMPONENT] in [VENDOR] [PRODUCT] [VERSION] on [PLATFORMS] allows [ATTACKER] to [IMPACT] via [VECTOR]." The PROBLEMTYPE is mapped to a CWE entry, and the VECTOR to a CAPEC entry.
To address the inefficiencies, the team built a custom agent using Elastic Agent Builder. A critical aspect of this development was preventing LLM "hallucinations," where models generate plausible but incorrect information, such as non-existent classification IDs. To achieve this, the Elastic Crawler was used to scrape data from the CWE and CAPEC websites. This data was then ingested into two Elasticsearch indices: `web-crawl-mitre-cwe-software` and `web-crawl-mitre-capec-software`.
The crawler configurations are designed to run on a continuous schedule, ensuring that the indexed data remains up-to-date with new entries published by MITRE. This automated updating process keeps the AI agent's grounding data fresh without manual intervention.
The CWE crawler configuration specifies seeding from the software weaknesses view on the MITRE website. It follows links matching the pattern `/data/definitions/` and extracts structured fields from each weakness page. These fields include descriptions, mitigations, consequences, and observed examples, all prepared for semantic search and RAG pipelines. The configuration details how to extract the full URL, the CWE ID, title, description, extended description, alternate terms, common consequences, potential mitigations, background details, modes of introduction, applicable platforms, likelihood of exploit, demonstrative examples, observed examples, taxonomy mappings, related attack patterns, and references.
Similarly, the CAPEC crawler configuration applies the same approach to the MITRE CAPEC catalog. It seeds from the software attack patterns view and extracts structured fields from each pattern page. These fields encompass attack descriptions, execution flow, prerequisites, required skills, and mitigations, all of which are indexed into Elasticsearch alongside the CWE data.
The output of this automated pipeline is demonstrated by ESA-2026-01, which has already gone through the system and is in production. This system aims to streamline the entire lifecycle of product vulnerability management, from discovery to disclosure, by automating the generation of standardized security advisories. The use of RAG ensures that the AI's output is grounded in authoritative data, preventing inaccurate classifications and improving the efficiency and consistency of Elastic's security advisories.
