Skip to main content

Elastic Security Labs provides an under-the-hood look at its detection engineering processes

The 2025 State of Detection Engineering at Elastic explores how we create, maintain, and assess our SIEM and EDR rulesets.

By

Isai Anthony,

Alyssa VanNice

SDE-blog.png

Today, Elastic Security Labs is releasing the 2025 State of Detection Engineering at Elastic! This brand new report is the first of its kind — we’re pulling back the curtain on our Detection Engineering practices, going beyond the traditional survey-style State of Detection Engineering report. By revealing this information — information that security tool creators often keep private — we aim to demonstrate our commitment to our users and reinforce the fact that you are not alone in your security journey. We’re right here with you, every step of the way. 

Detection engineering involves tuning security tools to inform you of potential threats in your system. And while the practice is essential for navigating today’s dynamic threat landscape, many security teams struggle to allocate the time and resources required toward this initiative. 

To aid our customers and users, Elastic Security Labs has provided 2,300+ expert-written detection rules for both our SIEM and EDR solutions. These prebuilt rules map to tactics, techniques, and procedures (TTPs) across the MITRE ATT&CK® framework and are actively assessed and tuned by our expert security researchers to maximize value for organizations and individuals alike.

A dedication to detections

Elastic Security Labs is no stranger to pushing the boundaries of detection engineering. With regularly published detection science articles ranging from detecting hotkey-based keylogging attempts to exposing Linux Persistence techniques, we believe in not just innovating within our own products but also empowering the broader security community. 

There are many passionate Elastic Security Labs detection engineers who dive into real-world threats, developing cutting-edge detection rules and enhancements for the Elastic Security solution — all while meticulously measuring our performance along the way. This new report allows us to showcase their discoveries while giving our users a better understanding of their tools.

Behind the scenes

Elastic’s openness and transparency is what encourages us to maintain public-facing repos for both our SIEM and EDR rulesets, but we want our users and customers to understand what that maintenance looks like. The 2025 State of Detection Engineering at Elastic provides an inside look at the processes and methodologies, as well as our future intentions with Elastic Security’s detections. In this report, you'll find details on:

  • Our approach to analyzing real-world threats like the CUPS vulnerability and Scattered Spider
  • Our strategies for robust rule development, including the use of threat hunting and the Detection Engineering Behavioral Maturity Model
  • Our enhancement of Elastic integrations to broaden threat coverage and expand endpoint visibility
  • The internal metrics and evaluation processes for ensuring rule effectiveness
  • How we utilize the Elastic Global Threat Report to prepare for the upcoming year, with a sneak peek into our plans for 2025

The discussion continues

Elastic Security Labs is dedicated to providing in-depth research to the security community — whether you’re an Elastic customer or not. By sharing the details of how we manage and leverage the Elastic Security solution, we hope to spark a broader conversation around detection engineering and encourage the community to hold our work accountable. If you’re interested in a deeper look at how we made this, you can check out the article on Elastic Security Labs. 

Download the free report, and join the conversation! 

The release and timing of any features or functionality described in this post remain at Elastic's sole discretion. Any features or functionality not currently available may not be delivered on time or at all.

Sign up for Elastic Cloud free trial

Spin up a fully loaded deployment on the cloud provider you choose. As the company behind Elasticsearch, we bring our features and support to your Elastic clusters in the cloud.

Start free trial