Case Study: Chainguard achieves agentic, detection-as-code security operations with Elastic Security

Chainguard manages 1B daily events and 900+ detection rules with Elastic

Chainguard, a provider of hardened open source software, faced the challenge of securing its fast-moving, cloud-native environment with a newly formed cyber resiliency team. The team inherited a fragmented security posture with dozens of log sources and hundreds of daily alerts, lacking a consolidated platform for end-to-end investigations. They needed a vendor-managed solution to standardize operations without managing infrastructure themselves and chose Elastic Security Serverless from vendor Elastic.

The solution implemented by Elastic provided a fully managed platform that ingests roughly one billion events per day from 32 sources, most without custom code. Chainguard now runs over 900 detection rules, managed as code, with Elastic's Entity Analytics providing crucial context. This has enabled the team to automatically resolve about 60% of their 150-200 daily cases within minutes. The results achieved include comprehensive coverage of critical sources and a streamlined, automated security operation built on a strategic platform from Elastic.

Chainguard