Nav shell & component patterns pulled from the real Automatic Migration Figma file ↻ Restart demo
Deployment / Security / Get started
Not live yet
FE
Discover
Dashboards
Rules
Alerts
Attack discovery
Assets
Cases
Explore
Investigations
More
Get Started
Discover
Overview
Manage
Data sources
Get Started
Automatic MigrationAI

Configure AI

Connect an AI provider to power rule translation and security recommendations.

AI provider
This connector powers rule translation for migrating teams and detection recommendations for net-new teams. Configured once, shared across both onboarding tracks.

I'm new to Elastic Security

Set up your SIEM from scratch with AI assisted configuration and prebuilt detection rules.

I'm migrating from another SIEM

Import and translate your Splunk or QRadar rules with AI, then bring your data sources along.

Your answer tailors every remaining step (data sources, rule translation, and the readiness check) to the path you're on. You can change this later from Get Started.
1Upload rules & dashboards

Export from Splunk or QRadar and drop everything here. AI sorts rules from dashboards, so there is no need to separate anything.

Select or drag and drop files, or use the sample export
2Upload macros

Automatic Migration detected 3 macro references in your uploaded rules. Upload your macros file so they can be substituted during translation.

Select or drag and drop file
3Upload lookups

Detected 2 lookup references in your rules. Upload your lookup tables so they can be indexed for translation.

Select or drag and drop file

Analyzing your rules with AI…

Mapping existing logic to prebuilt Elastic rules and generating the rest.

Rules
StatusCount ↓
4
Total rules
Dashboards
StatusCount ↓
4
Dashboards
Rules4
Dashboards4
Reprocessing…
Rows per page: 10  ·  Showing 1-4 of 4 rules
‹123…›
Rule↓Risk scoreSeverityTagsAuthorSourceEnabledEnable all
246 of 247 rules enabled  ·  Showing 1-6 of 247
Coverage
71%
Quality
84%
Continuity
62%
Retention
91%
✓
Setup complete
247 detection rules are running against live data. New alerts will appear in the Alerts view as soon as something needs your attention.
Rules active
247
Integrations connected
6
Data pipelines healthy
3
SIEM readiness score
91%
Get started checklist 1 of 3 complete
Connect your first data integration
6 integrations connected during setup · 12,450 events received in the last hour
Completed
Review auto detected alerts
3 alerts are already waiting for a first look; open one to see how triage works.
In progress
Run your first detection
Trigger a rule against live data and follow it from signal to case.
Up next