End to end journey

Understanding the onboarding journey

Before proposing the unified system, I mapped how a new team actually reaches its first real detection today, across the three surfaces that own a piece of the journey: Get Started, SIEM Readiness, and Automatic Migration. The friction wasn't inside any one flow: it accumulated in the seams, the re-entered context, the progress that reset between surfaces, and the missing handoff to a natural next step.
Both tracks
Configure AI: one connector powers the whole journey
→
Both tracks
Your Goal: one question branches the path
→
Migrating
Upload & translate rules with the migration wizard
→
Net new
Connect integrations, Automatic Import builds custom ones
→
Both tracks
Activate rules, then readiness scores four dimensions
→
Both tracks
Go live into the Get started checklist

New to Elastic Security, the journey today

8 steps · 5 pain points, across three disconnected surfaces
  • 1Spin up Elastic Security and land on Get Started
  • 2Connect a first data integration
  • 3Hit a custom log source no integration covers: manual pipeline & ECS mappingPain
  • 4Enable prebuilt rules with no guidance on which apply to the stackPain
  • 5Look for a coverage answer in SIEM Readiness, a separate surface with its own progressPain
  • 6Re-enter context each surface already asked forPain
  • 7Finish one pillar with no handoff into the nextPain
  • 8Bounce before the first real detection, the moment it should all build toward
✓5 of 8 steps were pain points. In the proposed track, Automatic Import generates the custom integration from a sample log, readiness is a step instead of a separate product, and Go Live hands into the Get started checklist: connect, review alerts, run a first detection.

Migrating from another SIEM, the journey today

8 steps · 5 pain points, across three disconnected surfaces
  • 1Arrive with hundreds of tuned rules and a contract deadline
  • 2Find Automatic Migration, a third entry point beside Get Started and ReadinessPain
  • 3Upload and translate rules and dashboards with the wizard
  • 4Finish with rules installed but no data flowing to run themPain
  • 5Jump to Get Started to connect sources, progress resets to zeroPain
  • 6Guess which integrations the translated rules depend onPain
  • 7Check coverage in SIEM Readiness, which doesn't know a migration happenedPain
  • 8Go live without a moment that says the setup is complete
✓5 of 8 steps were pain points. The proposed track threads the shipped migration wizard into one journey: integrations recommended from the translated rules, a readiness score that counts the migration, and one continuous progress model from the first question to Go Live.
Both tracks New to Elastic Migrating from a SIEM Select a track to explore its journey