Elastic Details Security Platform and AI Deployment for Defence Cyber Marvel 2026
Summary
Elastic says its platform supported Defence Cyber Marvel 2026 with a multi-tenant deployment for 40 Blue Teams, testing across 6,000 agents, peak ingestion of 800,000 events per second, and guarded, audited AWS Bedrock AI services.
Key points
- Elastic says it deployed one Elastic Cloud environment for up to 40 Blue Teams, isolating team data and access with Kibana Spaces and data-stream namespaces; Red Teams and the exercise security operations centre had separate deployments.
- Before the exercise, Elastic tested multi-tenancy with 50 spaces and 6,000 agents. It reports no observed cross-team data leakage, Fleet updates within 60 seconds, and resilience during simulated availability-zone failures.
- During the exercise, the Blue Team deployment reportedly reached 800,000 events per second. The five-day exercise involved more than 2,500 personnel from 29 countries and over 5,000 virtual systems.
- Elastic says Elastic Defend initially ran in detect-only mode, with prevention enabled later in the exercise to allow Red Teams to establish a foothold.
- The on-range AWS Bedrock service used guardrails for content, personal information, and classified-operation topics. Elastic says API invocations and guardrail events were logged for NSOC oversight, with access scoped by team.
- Three custom agents—GrantPT, REDRock, and RefPT—served participants, Red Teams, and exercise referees. Their access to data was scoped through Elasticsearch security controls, according to Elastic.
- Terraform managed the platform configuration, while Catapult supported agent installation and enrollment across range systems.
Article Details
- Topic
- Elastic's multi-tenant security monitoring and guarded AI platform for the Defence Cyber Marvel 2026 cyber exercise.
Vendors
Amazon Web Servicesdeployments, large-scale automation with Terraform/Catapult, and a guarded on-range AI service backed by AWS Bedrock.Clarified SecurityThe Red Teams used Tuoni as their C2, which is a framework developed by Clarified Security for red teaming.ElasticElastic recounts its role as the core defensive platform provider for Defence Cyber Marvel 2026 (DCM26), delivering a single, space-based multi-tenanted Elastic Cloud deployment for 40 Blue Teams, separate Red Team andEndaceEPS), supported custom AI agents (GrantPT, REDRock, RefPT), extensive partner integrations (Tuoni, Tines, Endace, AWS), and strict audit/guardrail controls.TinesEPS), supported custom AI agents (GrantPT, REDRock, RefPT), extensive partner integrations (Tuoni, Tines, Endace, AWS), and strict audit/guardrail controls.
Products
Attack DiscoveryElastic delivered an on-range, UK-tenanted AWS Bedrock AI service with strict guardrails, RBAC-aware AI features (AI Assistant, Attack Discovery), and full audit logging (CloudWatch) for traceability.AWS Bedrocklarge-scale automation with Terraform/Catapult, and a guarded on-range AI service backed by AWS Bedrock.Elastic Agent BuilderThe custom AI agents: Elastic Agent BuilderElastic AI AssistantElastic AI Assistant for SecurityElastic Cloudprovider for Defence Cyber Marvel 2026 (DCM26), delivering a single, space-based multi-tenanted Elastic Cloud deployment for 40 Blue Teams, separate Red Team and NSOC deployments, large-scale automation withElastic Defenddefault integration policies were simple by design. Each team received: System for core OS telemetry, Elastic Defend for Endpoint Detection and Response, Windows event forwarding, Auditd for Linux audit logging, andElastic SecurityActivities span changing default passwords and hardening firewalls through to deploying enterprise-grade, AI-powered cyber defence with Elastic Security.ElasticsearchAuthentication was handled via Keycloak SSO, with Elasticsearch role mappings connecting Keycloak groups to Kibana roles:KibanaElastic provided a single multi-tenanted Elastic Cloud deployment for 40 Blue Teams, isolating teams via Kibana Spaces and datastream namespaces while managing 120 Fleet policies and 400+ integration policies as code.TinesEPS), supported custom AI agents (GrantPT, REDRock, RefPT), extensive partner integrations (Tuoni, Tines, Endace, AWS), and strict audit/guardrail controls.
Tools
Catapultfor 40 Blue Teams, separate Red Team and NSOC deployments, large-scale automation with Terraform/Catapult, and a guarded on-range AI service backed by AWS Bedrock.HashiCorp Vaultfor Tines access, Tines action connectors per team space, detection service accounts stored in HashiCorp Vault, and per-space Security Solution default index configuration. All state was stored in an encrypted S3TerraformCloud deployment for 40 Blue Teams, separate Red Team and NSOC deployments, large-scale automation with Terraform/Catapult, and a guarded on-range AI service backed by AWS Bedrock.Tuoniup to 800,000 EPS), supported custom AI agents (GrantPT, REDRock, RefPT), extensive partner integrations (Tuoni, Tines, Endace, AWS), and strict audit/guardrail controls.
Countries
SingaporeAs the British High Commissioner to Singapore noted, the exercise demonstrates the deep cooperation between the UK and trusted partners, a reminder of the strength of shared strategic partnerships in an increasinglyUnited KingdomElastic delivered an on-range, UK-tenanted AWS Bedrock AI service with strict guardrails, RBAC-aware AI features (AI Assistant, Attack Discovery), and full audit logging (CloudWatch) for traceability.