What’s new in Elastic Security 8.18 and 9.0

The challenges of migrating to a new SIEM can leave some teams locked into using outdated solutions — slowing detection, investigation, and response. Automatic Migration, new in Elastic Security 8.18 and 9.0, expedites your move to a modern SIEM.

Our first release of Automatic Migration, available now in technical preview, provides an AI-driven workflow for migrating legacy SIEM detection rules to Elastic Security. We’re launching with support for Splunk, including multi-tenant environments, and planning to expand to other legacy SIEMs soon. Support for other types of SIEM content, like dashboards and visualizations, is also planned.

This release introduces Lookup Join support in Elasticsearch Query Language (ES|QL) — a highly requested feature that significantly enhances data correlation workflows in Elastic Security. With this new capability, practitioners can now dynamically bolster their analysis by using the Lookup Join function in queries. 

Unlike enrichment workflows that require preconfigured policies and policy execution, ES|QL Lookup Join allows users to correlate across datasets on the fly. Whether you’re matching asset metadata, user attributes, threat intelligence, or business context, it’s now easier to bring related context into your investigations.

Let’s examine a real security use case. During alert triage, analysts often wonder, “Did this alert contain IOCs flagged in a threat feed? Is there additional information about the host or user entity? Do I know more about this alert in organization-specific data?” All of these questions likely mean that the analyst is looking for more information in another index, a classic Join use case. Now you’re able to! 

In the video below, you can see how a user can query attributes from the alert (in this case the file name) and then compare to another data store, like a threat feed, and return that information to the final results!

Elastic includes over 1,300 detection rules built and maintained by Elastic Security Labs. Organizations sometimes tailor these rules to meet specific needs (e.g., adjust conditions, add tags). Starting with 8.18, you can apply rule updates without overwriting your custom changes.

Last year alone, Elastic Security Labs improved existing rules more than 2,400 times. With this enhancement in rule management, organizations that have made modifications can continue to benefit from those updates without needing to reapply customizations manually. This makes it easier to customize and maintain prebuilt detection rules over time, streamlining detection engineering workflows and helping teams expand coverage to more use cases with less effort.

Elastic continues to evolve as a unified, vendor-agnostic platform for endpoint analytics — giving analysts a single, integrated solution to detect, investigate, and respond across any environment. Building on the ability to take response actions with Elastic Defend, analysts can now take direct action on hosts protected by CrowdStrike Falcon, Microsoft Defender for Endpoint, and SentinelOne — without leaving the Elastic interface. 

This includes isolating or releasing hosts, collecting files, running scripts (CrowdStrike), and listing or killing processes (SentinelOne), all with real-time synchronization between platforms. These bidirectional integrations streamline response workflows, reduce context switching, and make it easier to take consistent, informed action across diverse endpoint deployments — all from a single, centralized workspace.

Read about these capabilities and more in the Elastic Security release notes.

The fastest and easiest way to experience Elastic Security is on Elastic Cloud Serverless. Try it now.

The release and timing of any features or functionality described in this post remain at Elastic's sole discretion. Any features, support plans, or functionality not currently available may not be delivered on time or at all, and mention of such plans or ideas reflects only our strategic goals and objectives. Such plans may be updated, cancelled or postponed.

In this blog post, we may have used or referred to third party generative AI tools, which are owned and operated by their respective owners. Elastic does not have any control over the third party tools and we have no responsibility or liability for their content, operation or use, nor for any loss or damage that may arise from your use of such tools. Please exercise caution when using AI tools with personal, sensitive or confidential information. Any data you submit may be used for AI training or other purposes. There is no guarantee that information you provide will be kept secure or confidential. You should familiarize yourself with the privacy practices and terms of use of any generative AI tools prior to use. 

Elastic, Elasticsearch,and associated marks are trademarks, logos or registered trademarks of Elasticsearch N.V. in the United States and other countries. Splunk and other related marks are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. Microsoft and other related marks are trademarks of the Microsoft group of companies. Crowdstrike is a trademark of Crowdstrike, Inc. SentinelOne is a registered trademark of SentinelOne, Inc. All other company and product names are trademarks, logos or registered trademarks of their respective owners.