Elastic Security now tracks every detection rule change with one-click rollback and makes case data queryable out of the box, so SOC teams get audit trails and reporting without configuring anything.

Detection rule change history with one-click rollback

SOC case management: templates and case analytics

Investigation-specific case templates with custom fields

Queryable case analytics on every deployment

Get started with detection rule history and case analytics

Elastic Security adds queryable SOC case management with auto-provisioned analytics and immutable detection rule history with one-click rollback.

Author

Melissa Burpo

Articles

SOC case management and detection rule history in Elastic Security