Elastic Security 9.5 introduces automatic migration of Microsoft Sentinel detection rules into Elastic. Users export Scheduled and Near Real Time (NRT) analytics rules from Sentinel, upload them to Elastic, and an LLM handles the translation. Watchlists are converted to ES|QL Lookups and severity mappings carry over. The feature supports both rules-first and data-first migration paths, and integrates with Elastic's AI features including Workflows, Agent Builder, and RAG-powered SOC tooling. Available now in Tech Preview.
Table of contents
Which Microsoft Sentinel rule types can be migrated automatically?How to migrate Microsoft Sentinel detection rules to ElasticShould you migrate rules first or data first?What happens after your Sentinel rules are running in ElasticHow Elastic AI fits into a Sentinel-to-Elastic migrationTry automatic detection rule migration74 Impressions