Monitoring AI agent sessions: Leveraging embedding models to aid threat hunting and attack discovery workflows

Query rules find behavior you can define, but agent sessions contain unstructured behaviors you can only describe. I stored six months of my own Claude Code and Cursor sessions as semantic vectors in Elastic and searched them instead of handing every session to a large language model (LLM). One in seven sessions came back requiring triage of suspicious actions.

Read the full article at Elastic Security Labs →