--- title: Elastic Agent Builder agents overview description: Learn how Agent Builder agents use tools to solve problems. Compare built-in and custom agents and understand the iterative reasoning loop. url: https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents products: - Elastic Cloud Serverless - Elastic Documentation - Elastic Observability - Elastic Security - Elasticsearch - Kibana applies_to: - Elastic Cloud Serverless: Generally available - Elastic Stack: Generally available since 9.3, Preview in 9.2 --- # Elastic Agent Builder agents overview Agents are AI models (LLMs) defined with custom instructions and a set of assigned [tools](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools). Elastic Stack: Generally available since 9.4 Agents can also be equipped with [skills](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills), which are reusable instruction sets that provide specialized expertise. Users [chat](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat) with agents using natural language, in the Agent Builder UI or programmatically. An agent parses user requests to define a goal and then runs tools in a loop to achieve that goal. The agent provides responses based on its configured tools, instructions, and behavior settings. ## How agents work When you ask a question to an agent, it analyzes your request to define a specific goal. It selects the most appropriate tools and determines the right arguments to use. The agent evaluates the information returned after each action and decides whether to use additional tools or formulate a response. This iterative process of tool selection, execution, and analysis continues until the agent can provide a complete answer. The process of tool selection, execution, and analysis consumes tokens. To understand how usage is calculated, refer to [Token usage in Elastic Agent Builder](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/monitor-usage). Elastic Agent Builder includes a default agent named `Elastic AI Agent`. You can [create custom agents](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/custom-agents) with custom instructions and selected tools to address specific use cases or workflows. You can also use pre-configured [built-in agents](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/builtin-agents-reference) that are specialized for common use cases. ### Elastic deployment awareness - Elastic Cloud Serverless: Generally available - Elastic Stack: Planned Agents tailor their guidance on features, navigation, and terminology to the Elastic deployment they run in, and they can answer questions about that deployment directly. To make this possible, Elastic Agent Builder adds details about the deployment to the instructions of every agent, built-in or custom. The details depend on the deployment type: - Elastic Stack: Planned **Elastic Cloud Hosted, Elastic Cloud Enterprise, and self-managed**: The environment, the Elastic Stack version, and, when available, the space's solution view and the license type and status. If Kibana is configured as air-gapped, the details also say so. - Elastic Cloud Serverless: Generally available **Elastic Cloud Serverless**: The environment, the project type, and the product tier, when the project has one. Elastic Agent Builder adds these details automatically, and you can't turn them off. Agents can share these details with anyone who chats with them, even though they don't disclose their other instructions. ## Built-in agents Elastic Agent Builder includes a pre-configured built-in agent optimized for common use cases, which you can also customize using custom instructions, tools, and skills. - **[Elastic AI Agent](/docs/explore-analyze/ai-features/agent-builder/builtin-agents-reference#elastic-ai-agent)**: The default general-purpose agent - Elastic Stack: Removed in 9.4, Elastic Stack: Generally available in 9.3, Elastic Stack: Preview in 9.2 **[Observability Agent](/docs/explore-analyze/ai-features/agent-builder/builtin-agents-reference#observability-agent)**: Specialized for logs, metrics, and traces - Elastic Stack: Removed in 9.4, Elastic Stack: Generally available in 9.3, Elastic Stack: Preview in 9.2 **[Threat Hunting Agent](/docs/explore-analyze/ai-features/agent-builder/builtin-agents-reference#threat-hunting-agent)**: Specialized for security alert analysis Built-in agents cannot be modified or deleted. To customize one, you can clone it and create a custom agent.Built-in agents are space-agnostic and are available in all [Kibana spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces). For the complete list of built-in agents and their assigned tools, refer to [Built-in agents reference](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/builtin-agents-reference). ## Custom agents Create custom agents tailored to your specific needs by defining custom instructions and selecting relevant tools. Custom agents give you full control over: - Agent behavior and personality through custom instructions - Available tools and capabilities - Elastic Stack: Generally available since 9.4 Assigned skills for specialized expertise - Elastic Stack: Planned [Subagents](#subagents) the agent can delegate tasks to - Visual appearance and organization Custom agents are space-aware: they are only available in the [Kibana space](https://www.elastic.co/docs/deploy-manage/manage-spaces) where they were created. To learn how to create and manage custom agents, refer to [Custom agents](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/custom-agents). ## Managing agents in the UI The **Agents** page provides a centralized view of all your agents. From this page you can: - View all your agents with their names and labels - Search for specific agents using the search bar - Filter agents by labels using the **Labels** dropdown - Create new agents using the **New agent** button - Start chatting with an agent or perform other actions: - **Built-in agents**: You can **chat** or **clone** built-in agents. They cannot be edited or deleted. ![Chat with agent and clone agent buttons](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/images/chat-and-clone-buttons.png) - **Custom agents**: You can **chat**, **edit**, **clone**, or **delete** custom agents. ![Agent context menu showing Chat, Edit, Clone, and Delete options](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/images/chat-edit-clone-delete.png) ## Elastic capabilities - Elastic Stack: Generally available since 9.4 The **Enable Elastic capabilities** toggle controls whether an agent is automatically assigned all current and future Elastic-built [tools](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools/builtin-tools-reference), [skills](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/builtin-skills-reference), and plugins. The set of assigned capabilities is dynamic and grows as Elastic adds new built-in content. Disable this toggle to manage tool, skill, and plugin assignments manually. ![Enable Elastic Capabilities toggle ON](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/images/elastic-capabilities.png) This toggle is available for all agents, both built-in and custom. Elastic Stack: Planned Elastic Cloud Serverless: Generally available The toggle doesn't affect the [HTTP API tools](/docs/explore-analyze/ai-features/agent-builder/tools/builtin-tools-reference#http-api-tools), which every agent has. Elastic Stack: Planned Elastic Cloud Serverless: Preview This toggle doesn't assign [connectors](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/connectors), but it includes the `connector-discovery` skill that agents need to find their assigned connectors. You assign connectors to each agent separately, and agents start with none, including the built-in **Elastic AI Agent**. For details, refer to [Assign connectors to an agent](/docs/explore-analyze/ai-features/agent-builder/connectors#assign-connectors-to-an-agent). ### Default settings - **Built-in agents**: Elastic capabilities are **enabled** by default. Disable if you want to limit the agent to the tools and skills you assign. Elastic Stack: Planned Elastic Cloud Serverless: Generally available The agent keeps the HTTP API tools. - **Custom agents**: Elastic capabilities are **disabled** by default. Enable if you want the agent to have access to all current and future Elastic-built tools, skills, and plugins. To review which tools and skills are active, open the agent's **Tools** or **Skills** tab after enabling the toggle. Elastic-provided items are marked with a lock icon. ## Subagents - Elastic Cloud Serverless: Generally available - Elastic Stack: Planned An agent can delegate tasks to subagents. A subagent is another agent that works on a task separately and returns the result. The agent can also delegate to a copy of itself. In the UI, that copy is labeled **This agent (self-fork)**, and it has the same custom instructions, tools, and skills as the agent. Use subagents to split a complex request into focused tasks, or to hand part of the work to an agent with specialized instructions and tools. ### How subagents run The agent decides when to delegate a task and writes the task instructions for the subagent. The subagent doesn't see the conversation, only those instructions. The agent can wait for a subagent to finish, or let the subagent run in the background while it continues working. Background subagents are available only in saved conversations. In a saved conversation, the agent can also start a named subagent and send it follow-up tasks later in that conversation with the `send_message_to_agent` tool. The named subagent keeps the history of those tasks. If you approve APIs for the first task, that approval does not apply to the follow-up tasks. The subagent returns its result to the agent, not to you, and the agent uses it in its response. To review what a subagent did, select the `run_subagent` tool call in the conversation, then select the **Sub-agent execution** link. #### Limits and safeguards - A subagent can't delegate tasks to its own subagents. - The agent can only delegate to agents that you can access. The UI and the API accept only those agents. When the agent runs, it skips agents in the **Delegable subagents** list that you can't access or that were deleted. - Before it delegates a task that can modify or delete data, the agent might ask you to approve the APIs the subagent can call. If you select **Deny**, the subagent runs without access to those APIs. - Subagents can't show you confirmation prompts. For details, refer to [Human-in-the-loop prompts require an interactive conversation](/docs/explore-analyze/ai-features/agent-builder/limitations-known-issues#human-in-the-loop-prompts-require-an-interactive-conversation). ### Configure subagents New custom agents have subagents turned off. By default, the Elastic AI Agent can delegate to a copy of itself. If the Elastic AI Agent existed in a space before subagents were available, for example after an upgrade, it keeps its configuration without subagents. To change an agent's subagents, you need permission to edit the agent. 1. Edit the agent and go to the **Subagents** section of the **Settings** tab. You can also select **Edit agent settings** on the agent's **Overview** page. 2. Select **Enable subagents**. **This agent (self-fork)** appears under **Delegable subagents**. 3. Under **Delegable subagents**, select the other agents this agent can delegate to. To stop the agent from delegating to a copy of itself, remove **This agent (self-fork)**. 4. Select **Save**. The following example shows an agent that can delegate tasks to a copy of itself and to one custom agent: ![The Subagents section of the agent Settings tab, with Enable subagents selected and This agent (self-fork) and a custom agent selected under Delegable subagents.](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/images/agent-subagents-settings.png) #### Configure subagents with the API To configure subagents with the Agents API, set `configuration.subagent_ids` when you [create](https://www.elastic.co/docs/api/doc/kibana/operation/operation-post-agent-builder-agents) or [update](https://www.elastic.co/docs/api/doc/kibana/operation/operation-put-agent-builder-agents-id) an agent: - The list takes up to 50 unique agent IDs. - To let the agent delegate to a copy of itself, use `_self`. You can't use the agent's own ID. - An empty list turns subagents off. - If you omit `subagent_ids` when you update an agent, the agent keeps its current list. ## Agents API The Agents API enables programmatic management of both built-in and custom agents. ### Quick overview For an overview, refer to [Agents API](/docs/explore-analyze/ai-features/agent-builder/kibana-api#agents-apis). ### API reference For the complete API reference, refer to the [Kibana API reference](https://www.elastic.co/docs/api/doc/kibana/operation/operation-get-agent-builder-agents). ## Related pages - [Custom agents](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/custom-agents) - [Best practices for prompt engineering in Elastic Agent Builder](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/prompt-engineering) - [Built-in agents reference](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/builtin-agents-reference) - [Tools](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools) - [Skills in Elastic Agent Builder](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills)