As cited
Copy frozen at (site build).
cloud saas
One SOC, 100 projects: running centralized alert triage on Elastic Security Serverless
Elastic Security Serverless now supports cross-project search (CPS) to enable centralized security operations across up to 100 isolated projects while maintaining separate data ownership and environments. Detection rules run once on a central origin project and generate alerts into a single queue, allowing analysts to triage and investigate across linked projects without duplication or tenant isolation breaches. The company validated this model under realistic SOC load, publishing guidance on query patterns, sizing, and operational boundaries such as response actions remaining tied to individual projects.
Why it matters: Security operations teams managing multiple environments, regions, or customers can now consolidate alert triage and detection into one queue while preserving data isolation and compliance boundaries, reducing the operational overhead of managing dozens of rule copies and scattered alert contexts.
- Source published
- First seen by Cybersecurity Tracker