Cutting digital forensics from weeks to days: How LEITWERK's CYBER FOX scaled a managed SOC to 30 customers on Elastic Security

LEITWERK AG's CYBER FOX team replaced a single-agent security tool with a self-hosted Elastic Security deployment, onboarding 30 managed-SOC customers in nine months and cutting digital forensics from three to four weeks to three to four days.

LEITWERK AG's CYBER FOX team runs managed security operations for organizations across Germany, from 10-seat businesses to enterprises of more than 2,000 seats in energy, healthcare, and defense. Its previous tool locked the team into a single agent on a single platform, blocked integration of firewall and other IT-layer data, and offered little visibility into raw log detail. CYBER FOX moved to a self-hosted Elastic Security deployment, testing on Elastic Cloud and then building a cluster in its own data centers running SIEM and Elastic Defend. In its first nine months, the team onboarded 30 customers and gained full visibility into raw log data from any source, and its digital forensics now take three to four days instead of three to four weeks.

LEITWERK's CYBER FOX team now completes digital forensics on a compromised environment in three to four days, work that used to take three to four weeks. CYBER FOX is the cybersecurity arm of LEITWERK AG. From its base in Baden-Württemberg in southern Germany, the team runs IT operations and managed security for customers that range from 10-seat businesses to enterprises with a couple of thousand seats, spanning energy, healthcare, and defense. Most customers are regional, with others served Germany-wide.

That breadth is exactly what the team's previous tooling could not support.

Digital forensics accelerated from three to four weeks to three to four days because the data is already in place.

As a managed security provider serving banking and public sector customers, CYBER FOX operates under strict compliance requirements, including GDPR and DORA. Two requirements drove the search for a new platform: open source, and the ability to self-host in the team's own data centers rather than depend on a public cloud outside its control. The previous solution was delivered as SaaS hosted in a public cloud outside Germany, which did not fit the data-residency and compliance needs of regulated customers.

Before Elastic, CYBER FOX was tied to a single kind of agent on a single platform. Onboarding a new customer meant a long sales cycle, because the team first had to convince each customer to replace their existing antivirus or EDR with the one agent the old tool supported. Firewall data and other IT-layer sources could not be integrated at all, so the team could not offer customers full visibility into their own infrastructure. And with limited access to granular log detail, analysts could not always see the raw data they most needed during an investigation.

The result was friction at both ends: harder sales conversations up front, and constrained investigative capability once a customer was live.

CYBER FOX began on Elastic Cloud, which let the team stand up a deployment quickly and test with two initial customers. Impressed by the feature set, the team then built a cluster in its own data centers, working with Elastic solution architects to size and architect it for the managed-SOC workload, and expanded capacity as its customer base grew.

Data flows into the cluster from two broad sources. The majority, roughly 70%–80%, comes from customer endpoints (clients and servers) collected via Elastic Agent. The remaining 20%–30% comes from firewalls of any vendor, Microsoft 365, Entra ID, and other software layers, the integration breadth the previous tool lacked. On top of that data, the team runs SIEM and Elastic Defend, Elastic's EDR, with investigation carried out in Timeline, Event Analyzer, and Cases.

Technical highlights

• Pipeline: customer endpoints, firewalls, and cloud services to Elastic Agent to a self-hosted Elasticsearch cluster
• Initial deployment on Elastic Cloud, then a self-hosted cluster in LEITWERK's own data centers
• Endpoint data (clients and servers) via Elastic Agent, roughly 70%–80% of ingest
• Firewall (any vendor), Microsoft 365, and Entra ID data making up the remaining 20%–30%
• Elastic Defend (EDR) deployed across customer endpoints
• Investigation via Timeline and Event Analyzer down to connections, processes, and registry changes
• Cases used for analyst-to-customer collaboration and shared visibility

Full visibility into raw log data

The single biggest change is what analysts can now see. With the previous tool, the team was restricted to a limited view and could not always inspect the underlying data. With Elastic, analysts work directly with granular log detail: which IP address a connection reached; which processes ran; which registry entries a program created, modified, or deleted; and the parent process and arguments behind each action. Event Analyzer surfaces this in a single view, so an analyst can follow what a program actually did rather than infer it. That depth is what makes fast, confident triage, and distinguishing true positives from false positives, possible.

Any source, full infrastructure transparency

Because Elastic ingests data from any firewall vendor and other IT layers, CYBER FOX can now offer customers transparency across their whole infrastructure, not just their endpoints. That breadth also changed the commercial motion: The team no longer has to require customers to rip out an existing EDR before onboarding, which removes a major point of friction from the sales cycle.

Collaboration and trust through Cases

CYBER FOX uses Cases to work directly with customers. Analysts triage alerts, add their interpretation and risk scoring, and share that work with the customer, who can see exactly what the SOC is doing to protect them each day. That transparency has changed the customer relationship, giving customers a new level of insight into, and trust in, the team's work.

Because Elastic Defend continuously collects endpoint data into CYBER FOX's own cluster, the data an investigation needs is already in place before an investigation ever starts. When an endpoint is compromised, for example in a ransomware attack, the analyst does not have to wait to gather and ship data before work can begin. They can open the full history immediately and reconstruct what happened, from the point of entry to the actions the attacker took. That head start is why digital forensics that had typically taken three to four weeks now take three to four days, with the analyst making the judgment calls throughout.

CYBER FOX today runs SIEM and Elastic Defend as its foundation. The roadmap is agentic. The team is testing Elastic Attack Discovery in a lab environment to speed Tier 1 triage and is evaluating Elastic Agent Builder and Elastic Workflows. A key open decision is whether to run a dedicated large language model cluster in the team's own data centers or use a public model, the same model-choice flexibility that drew the team to an open platform in the first place. As AI takes on more of the routine triage load, the traditional analyst pyramid becomes a diamond: fewer analysts operating at higher altitude, with more impact per person. The team plans to onboard at least 30 more customers next year.

Whether you are protecting a single 10-seat business or scaling a managed SOC to thousands of endpoints across energy, healthcare, and defense, the principle is the same: Own your data, see it in full, and put analysts on top of the investigation. That is what LEITWERK's CYBER FOX built on Elastic Security.

See how Elastic Security's searchable data tiers keep years of security data available for investigations without adding cost, or start now with a free trial.