1. Detection in Elastic Security

Multiple failed logins followed by a successful one from a suspicious location trigger Elastic Security rules.
Elastic Security, using Attack Discovery, groups these alerts with related signals: new device fingerprint, abnormal geolocation, and unusual access to sensitive files.
Instead of leaving 50+ separate alerts for analysts, Elastic Security produces a single incident narrative describing a likely credential compromise with lateral movement.

2. Ingestion into Kyndryl SOaaP

The incident is pulled into Kyndryl SOAR via the connector.
The incident is enriched automatically: Threat intel lookups confirm the IP address is on a known malicious list, and user context shows no recent password reset.

3. Case management and collaboration

A case is created in Kyndryl Case Management.
The customer’s policy requires approval before disabling accounts, so the case routes automatically to the customer’s security lead for sign-off.

4. Actioning and remediation

With approval, Kyndryl SOAR executes containment: locks the compromised account, forces a password reset, and isolates the endpoint via EDR, which Elastic provides as part of its Security solution.
Simultaneously, the SOAR queries Elastic Security again for any related activity (pivoting across entities).

5. Reporting and learning

All actions, timing, and approvals are logged in the case record.
KPIs such as MTTR and time-to-containment are pushed into Kyndryl Bridge for CISO dashboards.
The pattern (failed logins + suspicious geo + new device) is marked as a validated high-fidelity use case; next time, much of the workflow can be auto-remediated safely.

Outcome: What would normally take hours of manual correlation across dozens of alerts is compressed into a few minutes — from Elastic Security’s attack narrative to orchestrated response in SOaap — with clear visibility for the customer and measurable efficiency gains for the SOC.

Context engineering

Vector database

Search powered applications

Logs

Threat protection

Workflows

Elasticsearch

Kibana (Discover, Dashboards)

Elastic Agent Builder

AutoOps

Piped query language

Jina AI search models

Elastic Cloud Serverless

Elastic Cloud Hosted

Self-managed Elasticsearch

Ecommerce search

Customer support search

Search-driven apps

Log analytics

Infrastructure monitoring

Digital experience monitoring

App performance monitoring

AIOps

LLM observability

Next-gen SIEM

Agentic SOAR

XDR and endpoint security

AI for security

10x your data's value

Cloud providers

Elastic AI Ecosystem

Search AI Partner Program

AV-Comparatives

Forrester Wave™ XDR

Gartner Magic Quadrant Leader

IDC MarketScape

Search

Security

Observability

Get started

Demo gallery

Downloads

Integrations

Docs

Elasticsearch Labs

Elastic Security Labs

Elastic Observability Labs

Blog

Community

Events

Webinars

Discuss

Training

Support

Consulting

Author

Articles by Richard Robitaille

Director of Security Architecture, Kyndryl

How Elastic Security and Kyndryl deliver faster, smarter managed SOC operations

Sign up for Elastic Cloud free trial