Case study
Fortune 50 Technology Manufacturer Moves 600 Security Sources and ~50 TB Daily to Elastic SIEM With No Downtime
SquareShift led the migration end to end, moving the security team's SIEM from Splunk to Elastic Security with no monitoring pause.
Book a session →
Client
A technology manufacturer with a Security Operations Center, monitored with Splunk.
Industry
Technology
Services
Stack
Elastic Security · Elasticsearch · Kibana · Cribl Stream · Splunk
How SquareShift delivered it.
Project context
The client's security team monitored with Splunk and chose to move to self-managed Elastic Security. SquareShift led the migration end to end, without disrupting threat visibility, detections or SOC workflows.
Project objectives
Move all 600 sources to Elastic.
Keep 50 TB/day flowing, port all detections and rebuild SOC workflows.
Solution delivery
SquareShift catalogued all 600 sources, detection rules, dashboards and workflows, then grouped them into waves and migrated them over about 12 months.
It used Cribl Stream to parse, normalize and route all data into one standard schema. It fed Splunk and Elastic in parallel, comparing volumes, fields and parsing for each source before cutover.
It ported all custom detections to Elastic, mapped to MITRE ATT&CK and checked against live data. It rebuilt triage, cases, ticketing, playbooks and dashboards, then handed over runbooks and documentation.
The outcome
600 security data sources moved to Elastic. The full SIEM change took about 12 months, with no monitoring pause. About 50 TB of security data is ingested every day.
Threat visibility, detections and SOC workflows have to keep running through the change, and every source is validated before cutover.
Director of Engineering, SquareShift