Ask anyone running service management for a customer-facing operation what the worst part of an outage is, and it’s rarely the outage itself. It’s the ten or fifteen minutes spent figuring out what broke, why, and who it’s hitting, before anyone can actually fix anything.
Elastic and OpenAI’s recently expanded partnership is aimed specifically at that window, closing the gap between an alert firing and a CX observability team actually understanding what’s happening across their systems.
TL;DR
- Elastic and OpenAI have expanded their partnership to give AI agents governed access to the logs, tickets, and alerts service management teams already own but can’t search fast enough.
- The pitch is specific: less time spent assembling evidence before triage even starts.
- Visa cut mainframe threat triage from 10-20 minutes to seconds; Airtel reports up to 40% faster triage.
What’s the Actual Service Management Problem Here?
An incident rarely announces itself cleanly. A payment failure, a dropped call, a security alert, and the first ten minutes go to figuring out which system is involved and pulling logs from three different tools, just to see if it’s happened before. That’s not a diagnosis, it’s evidence-gathering, and every minute spent on it is a minute an SRE or analyst isn’t actually fixing the problem.
According to Gartner, unstructured data, including logs, tickets, and traces, makes up 70% to 90% of enterprise information. Most of it sits outside the tools built to search it quickly.
Elastic argues that Elasticsearch can serve as the retrieval layer that makes that data more usable in real time: lexical and vector search, permission controls, and filtering, so an agent pulls the right evidence instead of a person hunting for it by hand. OpenAI adds the reasoning that turns that evidence into a likely root cause.
Greg Tademoto, VP of Business Development and Strategic AI Partnerships at Elastic, explains:
“The success of enterprise AI depends on connecting powerful models with the knowledge businesses already possess. Much of that knowledge is buried in unstructured data.”
Colleen Kapase, VP of Strategic Global Partnerships at OpenAI, makes the same point from the model side:
“Great AI needs great context. We’re helping them build AI agents that are more accurate, more secure, and ready to deliver real-world results.”
What Would Actually Change on Your Team?
For a service management leader, the real test isn’t whether a product has AI in it. It’s whether, when an alert fires, someone still has to manually stitch together signals from five systems before they can even start working the problem.
Elastic’s answer is agentic investigation: an alert triggers automatic correlation across signals, a likely root cause gets surfaced, and the SRE starts their investigation with evidence already assembled rather than starting cold. If that holds up in practice, it doesn’t just save time. It changes who can respond well. A junior analyst working from a pre-built case starts to look a lot more like a senior one.
What Is CX Observability?
Analyzing the data a system produces, logs, metrics, and traces, to find and fix problems before customers feel them.
Does the Evidence Hold Up?
Two customers give this some real weight. Visa moved off a legacy SIEM onto Elastic Security and built an agentic SOC workflow with a human-in-the-loop validation step, so a person still signs off on every automated call. The result: triage on a high-priority mainframe detection dropped from 10-20 minutes to seconds. Airtel’s managed security team reports up to 40% faster triage and 30% faster investigations using Elastic’s Attack Discovery and Agent Builder tools.
Both numbers matter for the same reason. A 20-minute triage window on a live mainframe threat is 20 minutes where nobody knows the actual scope of the problem. That’s the difference between a contained incident and a customer-facing one, and it’s why cutting that window to seconds is a service management outcome worth taking seriously.
What Should You Ask Before Buying a Service Management Tool?
Don’t judge any of this on the announcement. Judge it on what you can verify against your own incident data.
The teams that get real value from any AI-driven service management tool won’t be the ones chasing the newest model.
They’ll be the ones who’ve already put in the work to make their logs, tickets, and incident history retrievable, and who know exactly what their own top incident types cost them in minutes today.
Agentic AI in service management refers to AI systems that can independently investigate incidents, correlate data across systems, and surface a likely root cause, rather than simply answering questions or generating text on request.
AI reduces incident triage time by automatically retrieving and correlating logs, tickets, and alerts across systems when an issue occurs, giving responders assembled evidence instead of requiring them to gather it manually.
Unstructured data in enterprise IT includes logs, tickets, transcripts, and traces that don't fit neatly into database fields. Gartner estimates it makes up 70% to 90% of the data enterprises hold.
Human-in-the-loop means a person reviews and approves an AI system's findings or actions before they take effect, keeping a documented decision point for accountability and audit purposes.
Enterprises should ask for evidence tied to a real incident type, confirm which capabilities are live versus on the roadmap, and test automation features directly rather than assuming they work natively out of the box.
What is agentic AI in service management?
How can AI reduce incident triage time?
What is unstructured data in enterprise IT?
What does human-in-the-loop mean in AI-driven security operations?
What should enterprises look for when evaluating AI observability tools?
