The pipeline resolves known false positives with deterministic ES|QL queries before escalating ambiguous cases to specialized LLM agents. Orchestration lives in Elastic Workflows rather than an agent layer for cost-effective scale and auditability across thousands of monthly alerts.