cyber.hendryadrian.com
Interesting Stuff · elastic.co

Elastic Explains Centralized Security Triage Across 100 Serverless Projects

· Original article ↗

Summary

Elastic describes using Cross-project search to run detection and triage from one Serverless project across 100 linked projects, sharing test results, query guidance, and operational limitations.

Key points

  • Elastic tested one origin project linked to 100 others, running roughly 2,100 prebuilt detection rules against data in the linked projects.
  • Rules on the origin can search linked-project data and send generated alerts to one central queue; the underlying data remains in its project.
  • Analysts can use Timeline and Discover to investigate across projects, while response actions must be performed in the project that owns the data.
  • Elastic recommends projecting needed columns with ES|QL KEEP; its testing found full-source retrieval at depth was much slower.
  • Elastic reports that query cost depends more on per-project data volume and query shape than on the number of linked projects.
  • Linked projects must be in the same Elastic Cloud organization; the default limit is 100, and a rule searches only projects its last editor can access.
  • Cross-project search has functional limits, including no centrally available alerts generated by linked projects themselves and no unified cross-project risk score.

Article Details

Topic
Centralized security alert triage across Elastic Cloud Serverless projects using Cross-project search (CPS)

Vendors

Elasticdetection rules drifting into 12 slightly different copies along the way. Cross-project search (CPS) on Elastic Cloud Serverless is built to end that tradeoff. One Elastic Security project runs detection and triage,

Products

Elastic Cloud Serverlessrules drifting into 12 slightly different copies along the way. Cross-project search (CPS) on Elastic Cloud Serverless is built to end that tradeoff. One Elastic Security project runs detection and triage, alongElastic Securitythe way. Cross-project search (CPS) on Elastic Cloud Serverless is built to end that tradeoff. One Elastic Security project runs detection and triage, along with investigation, across every linked project, and eachElasticsearchThis post covers how the central SOC model works with CPS, the analyst workflow we validated end to end, the Elasticsearch Query Language (ES|QL) patterns we recommend, and the limitations. KibanaAn origin alert whose source event lives in a linked project; kibana.alert.ancestors.index carries the provenance. 

Related Articles