Click, Click… Boom! Automating Protections Testing with Detonate

Elastic presents Detonate, an automated sandboxing framework that executes malware samples (via file hashes) in isolated VMs to assess and improve Elastic Security’s protections at scale. It prepares needed artifacts, provisions restricted VMs, runs samples, collects telemetry and alerts, and generates event summaries to support efficacy measurement, regression testing, threat research, and validation of new protections while identifying coverage gaps. The post previews a follow-up with deeper technical implementation details.