This thesis analyses the real-world detection capabilities of Elastic Security, an open-source solution that offers a recognized Security Information and Event Management (SIEM) system, against adversary techniques mapped under the MITRE ATT&CK Defense Evasion tactic. This was achieved in a controlled lab environment and by using the Atomic Red Team (ART) framework to execute 69 tests covering 27 MITRE sub-techniques.

The findings suggest that Elastic Security’s default rule-based detection is precise but has limited coverage, inconsistent alert latency, and labeling. The vague alert metadata can lead to challenges for Security Operations Center (SOC) analysts, incident response, and post-incident activities.

Overall, the thesis highlights the gap between theoretical ATT&CK tactic coverage and real-world detection effectiveness, further emphasizing the need for continuous improvement in rule tuning and alert fidelity within SIEM systems.