Into The Weeds: How We Run Detonate

This report outlines the design and operation of Elastic’s Detonate sandbox pipeline, including a FastAPI-based server with CLI/Web/UI/HTTP interfaces, SQS-backed queues, and Python workers that orchestrate detonations across Windows/Linux VMs in GCP and macOS VMs on AWS using Anka. It explains minimal-footprint VM provisioning via startup scripts, locked-down network egress with VPC routes/firewall/security groups and flow logs, and comprehensive telemetry collection using Elastic Agent in detect mode for validation and research. The team reports stable production performance (up to 1,034 detonations/day) and typical task completion under 13 minutes, with ongoing efforts to broaden OS coverage and optimize provisioning.