Onboarding System

New Elastic Security customers faced three distinct but related first time experiences: getting basic data flowing (Get Started), assessing their security posture (SIEM Readiness), and migrating detection rules from legacy SIEMs like Splunk or QRadar (Automatic Migration).

As the senior designer on Automatic Migration, I had end to end visibility into how these three flows connected, and proposed a unified onboarding system to close the gaps between them. I designed and prototyped this vision independently; it was in early development discussions with engineering when I was laid off, so the system described below reflects a proposal I built and pitched, not a shipped unification.

This proposal existed because I decided it should. No team owned the space between the three first time experiences, so from my seat on Automatic Migration, the only vantage point with end to end visibility across all of them, I created the mandate myself: mapped the three surfaces and where users fell between them, defined the unified journey and its branching model, and designed and prototyped the entire system independently, from the interactive demo to the six feature mockups. Then I took it up the organization, pitching across design, product, and engineering and building sponsorship level by level, until the Director of Design and the Director of Product Management were in active discussions about bringing it onto the roadmap. That is where it stood, in early development conversations with engineering, when the layoff ended my involvement. My ownership ran from noticing the problem to the edge of delivery.

Onboarding churn in security products is high. The complexity of initial setup, connecting data sources, configuring detection rules, understanding the platform, is enough to stall even experienced security engineers.

The proposal unified three pillars, one of which (Automatic Migration) I owned and shipped, into a single guided path. Get Started is the foundational onboarding step: connect a first data integration, review auto detected alerts, and run a first detection. An AI powered Automatic Import feature parses custom log formats and generates integration configurations, eliminating the need for manual mapping, designed as a checklist with contextual guidance at each step.

SIEM Readiness is a readiness assessment that evaluates security coverage, which data sources are connected, which MITRE ATT&CK techniques are covered by detection rules, and what gaps exist, producing a personalised readiness score with prioritised recommendations. Automatic Migration is the LLM powered tool I designed for teams migrating from Splunk or QRadar: it ingests existing detection rules and translates them to ES|QL, mapping to existing prebuilt rules where possible and generating custom rules for the rest, with a migration wizard that gives analysts visibility and control before anything activates.

Two of the three pillars are directly AI powered. Automatic Import uses AI to parse and configure data sources; Automatic Migration uses an LLM to translate SIEM rules, with the designer's role being to make AI outputs reviewable, correctable, and trustworthy.

Proposing a system nobody asked for is a different discipline from shipping a feature somebody did. This project sharpened how I make a case: not with a vision deck, but with a working prototype grounded in patterns the organization already trusted. It also left me with a conviction that onboarding is a property of the whole system, not a screen you can assign to a single team.