Elastic's InfoSec Product Security Team has developed a generative AI agent designed to automate the drafting of CVE security advisories. By leveraging the Elastic Agent Builder and Retrieval-Augmented Generation (RAG), the system transforms raw vulnerability reports into standardized advisories complete with CWE classifications, CAPEC methodologies, and CVSS scoring. This approach ensures consistency and accuracy while significantly reducing the manual effort required to distill complex technical reports into customer-facing documentation.
The solution prevents LLM hallucinations by grounding the agent's output in authoritative data scraped from the MITRE CWE and CAPEC catalogs using the Elastic Crawler. The team optimized the agent's performance through rigorous system prompt tuning, incorporating memory-safety verification, disclosure checklists to prevent proof-of-concept leaks, and a requirement for the agent to provide its reasoning for human reviewers. This end-to-end pipeline facilitates faster disclosure cycles while maintaining high standards of technical accuracy and security.
