security.md

navigation_title	Security
applies_to	stack serverless preview 9.3, ga 9.4+ ga
description	Use workflows to automate security operations, respond to alerts, and manage detection rules at scale in Elastic Security.
products	id kibana id cloud-serverless id cloud-hosted id cloud-enterprise id cloud-kubernetes id elastic-stack

Security workflows [workflows-security-use-cases]

Security teams use workflows for two broad patterns: automating the response to individual alerts, and running operational tasks across large sets of detection rules. This section covers both.

• Automate security operations: Respond to alerts automatically, create and populate cases, route notifications by severity, enrich alerts with external context, and investigate with AI assistance.
• Manage detection rules at scale: Audit rule health on a schedule, surface and alert on rule errors, report on coverage, and sync rule status to external systems.