Case Study: Everforth improves SecOps efficiency and threat detection with ECS and Elastic Security

Everforth cuts threat alerts by 93% with ECS

Everforth ECS, a managed security service provider, faced a challenge where their Elastic Security (SIEM) platform was generating an overwhelming volume of approximately 287,000 alerts per month for a sample of their customers. This flood of duplicate and noisy alerts reduced SecOps efficiency, making it difficult to identify real threats and also threatened to degrade the performance of their security orchestration, automation, and response (SOAR) solution.

To address this, ECS assembled a specialized team that performed advanced tuning of over 100 threat detection rules over three weeks. The solution involved a meticulous process of reviewing rule logic, analyzing logs, and adjusting exceptions and filters. This work by ECS yielded a dramatic 93% reduction in monthly alerts, down to about 21,000, which restored SOAR performance and allowed customer teams to operate more efficiently against genuine threats. ECS also institutionalized the gains by implementing weekly audits and integrating threat intelligence for continuous improvement.

Everforth