One SOC, 100 projects: running centralized alert triage on Elastic Security Serverless
Elastic validates centralized SOC alert triage using cross-project search across 100 linked Elastic Security Serverless projects with ~2,100 detection rules.
Elastic Security Labs describes an origin project executing ~2,100 prebuilt detection rules and consolidating alerts across 100 linked Serverless projects, preserving tenant isolation because data never moves between projects. The post covers the detect-triage-investigate-respond workflow, recommended ES|QL query patterns for cross-tenant hunting, and performance findings under realistic SOC load. Response actions remain local to each linked project, keeping tenants isolated.
- Cross-project search lets one origin project run detection rules across all linked projects without moving data.
- Benchmark used ~2,100 prebuilt rules, 10-minute triage sweeps, weekly reviews, and 30-day IR lookbacks.
- Recommended pattern: triage centrally, act locally, keeping response within the project that owns data.
- ES|QL patterns cover cross-tenant hunting and per-project severity rollups with dynamic scope.
- Vendors
- Elastic
From the original article
8 min read at elastic.co
We linked one Elastic Security project to 100 others and ran the full prebuilt detection catalog from the origin, with all the ingest landing in the linked projects. It held up, and where it deliberately does not reach is the interesting part.
By Chuddy Park · elastic.co
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.