Which setup investigates a security incident best?
Work an incident from the logs in Elasticsearch.
Best in this use case · ranked only on systems that ran every core tasksecops-es-agent + gpt-5.6-sol·reasoning-offGot 86% of cases right, averaged over 1 core task.
Best value · at least 10% cheaper, still at least ¾ of the best scoreThe best is also the best valueNothing ranked here is at least 10% cheaper and still close to it.Cheapest that works: secops-es-no-tools + gpt-5.6-sol·reasoning-off·no-tools · 53% · $0.75
bar = share of cases right · each row is one full system
SecOps investigation in Elasticsearchsecops-es-investigationOne alert, one question, a live read-only SIEM — 54 auto-graded SOC investigations over 239k ECS documents in Elasticsearch.54 cases · 3 runs · core taskOpen task: rules, cases, every run →