Deployment / Security launchpad / Automatic migration
FE
Discover
Dashboards
Rules
Alerts
Attack discovery
Assets
Cases
Explore
Investigations
More
Security launchpad
Get started
Value report
Migrations
Automatic migration
Migrate rules
Bring your detection rules to Elastic in minutes. AI maps your existing logic to prebuilt Elastic rules where possible, and generates the rest, macros, lookups, and all, so you can review and install without rewriting a single query.
Migrate dashboards
Bring your dashboards to Elastic in minutes. AI maps your existing panels to Elastic visualizations where possible, and generates the rest, so you can review and install without rebuilding from scratch.
Automatic Migration
Translated rules
Translated dashboards
Splunk vicente.gomezgonzalez@elastic.co's migration Translating ▾
SIEM rules export 1
Rules are being matched against Elastic's prebuilt library and translated. The table view will show once translations are complete.
Translating…
Read more about what makes Elastic SIEM rule translations powered by AI, reliable and accurate. Read AI docs ↗
Automatic Migration
Translated rules
Translated dashboards
Splunk vicente.gomezgonzalez@elastic.co's migration Complete ▾
Missing integrations ↗
Deployment-ready rules
Monitor rule status across translation, integration setup, and detection engine activation
StatusCount ↓
52
Total rules
Migration progress
Rules successfully installed in the detection engine
Migration pipeline
🔍
Reprocessing…
Showing 1–10 of 52 rules
Updated ↓ Name ↓ Status Risk score Severity Author Integrations Actions
Rows per page: 10 ▾
Missing integrations
These data sources are referenced by rules translated in your migration but aren't connected yet. Install them so translated rules can actually run.
🔍
Upload SIEM rules
▾
1
Upload rules
∨
1
Migration name
2
Export rules from your SIEM

Log in to your Splunk admin account, go to the Search and Reporting app and run the following query. Export your results as JSON.

| rest /servicesNS/-/-/saved/searches
| search action.correlationsearch.enabled = "1" OR (eai:acl.app = "Splunk_Security_Essentials" AND is_scheduled=1)
| where disabled=0
| table id, title, search, description, action.escu.eli5, action.correlationsearch.annotations
Upload exported rules
⬆
Select or drag and drop the exported JSON file
2
Upload macros

Automatic Migration detected macro references in your uploaded rules. Upload your macros file so they can be substituted during translation.

⬆
Select or drag and drop file
3
Upload lookups

Detected lookup references in your rules. Upload your lookup tables so they can be indexed for translation.

⬆
Select or drag and drop file