Teams migrating a SIEM aren't just moving rules, they're moving dashboards too, and those had always meant two different tools with two different learning curves.
One landing page on the Security launchpad with two cards, Migrate rules and Migrate dashboards, that both funnel into the same upload, translate, and review pattern.
Rules and dashboards migrate through one front door: 11,000+ rules translated since launch.
A rule export is rarely self-contained: macros, lookups, and reference sets live in separate files a team may not have exported yet.
Automatic Migration detects macro, lookup, and mapping references automatically and prompts for them as optional steps, never blocking the migration if they're skipped.
Missing macros or lookups no longer stall a migration; they resolve automatically or get flagged in the results.
Every translation spends real LLM tokens against a real connector, and matching to Elastic's own rules changes what a user ends up installing. Neither should be invisible.
A single configuration moment before translating: pick the AI connector, and choose whether to match against Elastic's prebuilt library, on by default, since it uses fewer tokens.
87% of migrations ran on the default managed connector, and matched teams inherit rules Elastic keeps maintaining.
Translation is never all-or-nothing. Treating every non-perfect result as a flat failure would send users down the wrong recovery path.
Every rule lands in one of five states, installed, translated, partially translated, not translated, or failed, each with its own status, color, and next action in the table.
Partial success became a workable outcome with a clear next action, not a reason to start over.
A failed or partial translation shouldn't cost a user the whole migration, uploads, macros, and lookups included, just to retry one rule.
Select one or more untranslated rows and Reprocess reopens the same AI configuration modal, letting a user pick a different connector for just those rules.
A failed translation is one click from a second attempt with a different model, uploads intact.
A perfectly translated rule is still useless if the data source it depends on was never connected in Elastic.
After a migration completes, a Missing Integrations count links straight into Elastic's integrations browser, pre-filtered to what the translated rules actually need.
Coverage gaps surface before go live, pointing at the exact integrations to install, not after an alert never fires.