Case Study: a major US metropolitan government achieves continuous detection and automated SOC response with Elastic Security

US Metropolitan Government scales Elastic Security across 12,000+ agents

The US Metropolitan Government, a major US city, faced significant challenges with its legacy SIEM, which could not handle the high volume of log data, resulting in dropped logs and security coverage gaps. This made reliable threat detection impossible for the security operations center (SOC) protecting the city's vast digital infrastructure. To address this, the customer turned to the vendor Elastic and migrated to Elastic Security on Elastic Cloud.

The solution involved implementing Elastic Security to continuously monitor over 12,000 agents and approximately 1,000 network devices, with all data normalized to the Elastic Common Schema (ECS). The integration with the automation platform Tines enabled one-click response actions like host isolation and credential reset, while the Elastic AI Agent helped proactively identify system issues. As a result, Elastic provided complete visibility, automated SOC workflows, and consistent, documented responses, making the security operations more efficient and effective.