01
Elastic Security for SIEM
Fortgale detection rules in EQL, ES|QL and KQL, with threshold, new terms and machine learning rules, mapped to MITRE ATT&CK.
Managed SOC on Elastic Security: your data in your cluster, we run the detections.
For teams that chose Elastic to keep control of their data but have nobody to write and maintain the rules, or to act on an alert at night. The Fortgale MDR service runs the detections in your Elastic deployment and contains with Elastic Defend or the EDR you have, at a median TTC of <30 minutes.
Fortgale × Elastic
MDR · live
Elastic sensor activeEndpoint · cloud · identity telemetry
Elastic European SOC 24·7·365L2/L3 analysts · direct interaction
Fortgale Multi-domain AI tier-zeroNoise reduced >90% by day 30
Fortgale Native Elastic responseHost isolation in seconds
Live Proprietary intelligence287 tracked adversary groups and attack tools
Fortgale MDR live, Elastic + Fortgale SOC active
Compliance
ISO/IEC 27001
NIS2 ready
DORA aligned
GDPR · ENISA
Technology partnership
Elastic Security
MITRE ATT&CK aligned
OpenCTI
Coverage
What we cover on Elastic.
The Elastic Security components the SOC operates, on Elastic Cloud Hosted, Serverless or self-managed clusters. If Elastic is not in place yet, licensing and deployment are part of the service.
02
Elastic Defend
Endpoint agent managed with Fleet on Windows, macOS and Linux, with response actions run from the console.
03
Elastic Cloud Security
Cloud and Kubernetes posture (CSPM and KSPM), workload vulnerabilities and runtime protection for VMs and containers, in the same console.
04
Threat intelligence
Fortgale indicators loaded through the threat intelligence integrations and used by indicator match rules.
05
Third-party EDR
Response actions also on CrowdStrike, Microsoft Defender for Endpoint and SentinelOne through their integrations, when the endpoint does not run Elastic Defend.
06
Hunting in ES|QL
Hunting sessions led by Fortgale analysts on silent lateral movement, persistence and data staging that automatic rules miss.
What we add
What Fortgale adds on top of Elastic.
A SIEM collects and correlates; it does not decide. Fortgale brings the detection engineering that turns it into a defence: rules built on 287 tracked adversary groups and attack tools, mapped to MITRE ATT&CK and maintained by the Milan SOC, with every alert enriched by proprietary CTI before it reaches the analyst. The data stays in your environment, under your retention. Noise drops by more than 90% by day 30, and once an alert is confirmed the analyst acts through the tools connected to the platform: median TTD <15 minutes, median TTC <30 minutes.
With Elastic Defend the SIEM does not stop at the alert: the analyst runs isolate, kill-process and suspend-process from the console, retrieves files with get-file, runs scripts and scans on the host and takes a memory dump for forensics. Isolation, kill and suspend can also start automatically from a rule.
Response actions require the right subscription level, usually Enterprise on Hosted and self-managed and Endpoint Protection Complete on Serverless. Without Defend or an integrated EDR, Elastic detects but does not contain, and blocking an account or an address goes through the identity provider or the firewall.
Fortgale rules are detection rules in your deployment that your team can read, and the 34,000 IOCs a week of Fortgale CTI feed the indicator match rules: an event touching attributed infrastructure raises an alert with the actor's context.
Takeover
How we take over your Elastic environment.
Takeover happens on your Elastic deployment: indexes, retention, Fleet policies and integrations stay as they are.
Monitoring starts as soon as Kibana access is live, and technical onboarding closes in one week: roles, Fortgale detection rules, automated response actions and authorisations.
The same week covers subscription and integrations, which decide what the analyst runs in Elastic and what goes through other tools. On your side: a deployment administrator and the escalation list.
From the field
Storming Tide: the signals were in different logs.
In February 2026 the Fortgale incident response team contained Operation Storming Tide at a European logistics company. The attacker had exploited a vulnerable Fortinet firewall, left a persistent VPN tunnel and a compromised service account (forticloud-sync), and stayed dormant for months before moving from unmanaged assets into the internal network with Matanbuchus 3.0, Astarion, SystemBC and RClone pointed at S3 storage. Anomalous internal network scanning started the investigation: no exfiltration, no ransomware.
The article is not about Elastic, but the signals sit in logs a SIEM collects: firewall VPN configuration and sessions, scheduled tasks and anomalous use of a service account, RClone outbound traffic. One by one they are noise; in Elastic an EQL sequence rule, or a new terms rule on the account appearing on a host for the first time, ties them into one alert, and with Elastic Defend the analyst isolates the host from there.
FAQ
What buyers running Elastic actually ask.
Does the data stay in our Elastic?
Yes. Indexes and retention stay in your deployment, on Elastic Cloud in the region you choose or on your own infrastructure. On Elastic Cloud Hosted, European regions include Frankfurt, Paris and Milan; Serverless is currently not available in Milan.
Do we need Elastic Defend to contain?
You need Elastic Defend or an integrated EDR. With Defend, response actions start from the Elastic console; with CrowdStrike, Microsoft Defender for Endpoint or SentinelOne they go through their integrations. With neither, the SOC detects in Elastic and contains on the other tools' consoles.
Do we lose the detection rules we already have?
No. Existing rules stay in the deployment; at onboarding we review them with you, switch off those that only produce noise and add Fortgale detections next to them.
How do we move from another provider without a gap in coverage?
Data, agents and integrations do not move: only roles, active rules and response authorisations change. Fortgale monitoring starts as soon as access is live, and the previous contract can end once technical onboarding is complete, after one week.
Do we buy the Elastic licences, or do you?
Either way: Fortgale operates the subscription you already have, or provides licensing and deployment as part of the service. The level matters, because response actions and machine learning are not in every subscription: at onboarding we check what is active.
See a real runbook
A real runbook on your Elastic.
We walk through an Elastic Security alert step by step: the EQL rule that raised it, the investigation timeline, the response action run with Elastic Defend and the evidence left in the indexes. Alongside it, the Report on the actors most likely to target your sector.