Explore the technical implementation of the Detonate system, including sandbox creation, the supporting technology, telemetry collection, and how to blow stuff up.

Preamble

Architecture

API server

Interacting with the API server - CLI

Interacting with the API server - Web UI

Interacting with the API server - HTTP client

Queues

Workers

Detonations

VM provisioning

Network configuration

Telemetry collection

Running in production

What's next?

A deeper dive into the technical implementations of Detonate

Into The Weeds: How We Run Detonate

To automate this process and test our protections at scale, we built Detonate, a system that is used by security research engineers to measure the efficacy of our Elastic Security solution in an automated fashion.

What is Detonate?

What does it help us with?

Measuring Efficacy

Supporting existing protections

Threat research

Evaluating new protections

What’s next?

Click, Click… Boom! Automating Protections Testing with Detonate

Author

Hez Carty

Articles

Into The Weeds: How We Run Detonate

Click, Click… Boom! Automating Protections Testing with Detonate