New users bounced before reaching their first real detection: three separate surfaces, no shared path, and no way to know how far along they were.
A guided first session checklist that surfaces all three pillars in one place and tracks progress across them, with contextual guidance at every step.
Time to first detection becomes the onboarding metric, not setup steps completed. Users always have exactly one obvious next action.
Net new teams and teams migrating from Splunk or QRadar need very different setups, but both landed on the same generic path.
One early question, what brings you here, splits the journey into a fresh start track and a migration track while both share the same shell, stepper, and destination.
Each team sees only the steps relevant to them, and the system still reads as one product instead of three tools stitched together.
Custom log sources with no prebuilt integration meant manual field mapping, the hardest possible task handed to the newest possible users.
AI parses sample data and generates the integration, mapping fields to Elastic Common Schema, with the user reviewing the result before anything is saved.
A data source without an integration goes from a hard blocker to a reviewable draft produced in minutes.
Migrating teams needed the shipped Automatic Migration flow to feel native to onboarding, not a separate tool they discover later.
Rule translation becomes the Add Data step of the migration track, statuses, review, and reprocess included, reusing the model the shipped product already proved.
The shipped migration flow gains what it always lacked: a next step. Data sources, readiness, and go live follow in the same journey.
Teams about to go live had no way to know whether their coverage was actually enough, so "are we ready" was answered by feel.
A readiness check scoring coverage, quality, continuity, and retention, with detection gaps mapped against MITRE ATT&CK techniques and prioritised recommendations.
Readiness becomes a scored, evidence backed answer, with gaps ranked before the team commits to go live.
Three teams owned three progress indicators, so a user finishing one flow had no natural next step into another and no way to resume where they left off.
One persistent six step pattern, Configure AI, Your Goal, Add Data, Activate Rules, Check Readiness, Go Live, reused identically across both tracks and every pillar.
Progress survives across surfaces and sessions: leave anywhere, resume exactly there, in either track.