Name: Alert Fatigue Therapy: How to Write Detection Rules That Don't Suck
Start: 2025-11-19T16:45:00.000Z
Location: Elasticsearch, Inc.

Merci de penser à libérer vos places minimum la veille de l'évènement, si vous ne pouvez pas venir.

**Agenda**

* Food & drinks
* Ouverture des portes
* Update sur Elastic (5 minutes)
* Talk1: do MORE with stateLESS Elasticsearch par David Pilato (20 minutes)
* Talk2: Un BBQ sur Serverless ? par Stéphane NGO (20 minutes)
* Food & drinks

**do MORE with stateLESS Elasticsearch**
*Par David Pilato, Elastic*

Comment feriez-vous pour créer Elasticsearch si vous commenciez ce projet en 2025 ?

* Découpler le calcul (compute) du stockage (storage)
* Externaliser la gestion de la persistence et la réplication à un blob store comme S3, Google Cloud Storage ou encore Azure Blob Storage
* Dynamiquement ajouter ou supprimer des instances
* Avoir les bonnes valeurs par défaut
* Et un chemin hyper clair et fluide pour les développeurs

C'est exactement ce que nous avons fait avec Elastic Serverless.
Lors de cette session, vous allez découvrir comment nous avons re-conçu Elasticsearch pour lui permettre d'en faire davantage avec une architecture Stateless qui peut exécuter des requêtes sur un espace de stockage froid (cold storage).

**Un BBQ sur Serverless ?**
*Par Stéphane NGO, CEO, k-ai*
KAI est une solution de datacleaning de données non structurées, basé notamment sur la recherche vectorielle d'Elasticsearch et son mode BBQ, récemment lancé.

Stéphane nous expliquera pourquoi il est passé de la solution Cloud Hosted d'Elastic à sa version Serverless et quels sont les observations qu'il peut en tirer.

Elastic FR User Group

David Pilato

Aziz IMGHARNE

Brahim AMAIRI

Maef

Sebastien Tre.

Philippe El ASSAD

Yannick Thebault

Lucian Precup

Jacques

ouchaib jaouad

Lotfi Mohamed

Philippe Gabriel

seddik alaoui ismaili

frpz (Francis Pugnère)

GOKUL

Ahmed Abdelkafi

Jean-Luc Bassereau

Samy

medilinnjoki95

Sebastian YEPES FERNANDEZ

Meetup ElasticFR #99 - Deezer

Deezer

Join us for a meetup at Motorworld on Wednesday November 5th, the eve before ElasticON!

We'll have presentations, networking, pizza and refreshments.

**Address**
Motorworld Munich - Stellwerk 2
[Am Ausbesserungswerk 8 · München, BY](https://maps.app.goo.gl/hGCA7X7FWfQhku4u9)
*When you arrive, please inform your name and that you will go to the meetup at Stellwerk 2.*

**Agenda**
18.00: Doors Open, join us for pizza and a drink

18.20: Talk #1: **Building AI Agents with Elastic Agent Builder and MCP**
**[Tatiana Finamor](https://www.linkedin.com/in/tatianafinamor/)**, Customer Architect at Elastic
**Abstract:** The Model Context Protocol (MCP) creates a bridge between AI models and external tools, allowing them to exchange information in a structured and secure way.
In this session, we will look at how Elastic fits into this new ecosystem.
We will demonstrate how to use Claude Desktop to query Elastic data through MCP using natural language, and how the Elastic Agent Builder can be used within a serverless project to build and deploy intelligent, data-aware agents.
This session is a practical introduction for anyone curious about combining Elastic with modern AI frameworks to simplify data access, automation, and intelligent interaction.

19.00: Talk #2: **Intro to the Elastic Inference Service (EIS)**
**[Max Jakob](https://www.linkedin.com/in/maxjakob/)**, Principal Software Engineer I - Search Experiences at Elastic
**[Tim Grein](https://www.linkedin.com/in/tim-grein/)**, Senior Software Engineer at Elastic
**Abstract:** AI models are everywhere in search these days. In this talk, we will present the Elastic Inference Service (EIS), the new way to apply AI models within the Elastic Stack. This GPU-backed service enables high throughput ingest, low latency search, reranking and LLM chat that all integrate neatly with Elasticsearch and Kibana. Everything is managed by Elastic, no need for users to configure any infrastructure or models. Get started with semantic search and built-in Kibana AI features out-of-the-box! We will demo what's possible today and give an outlook into what's coming in the next months.

19.40 Lightning Talk **Evolution of search - from keyword to contextual**
**[Petar Perković](https://www.linkedin.com/in/petar-perkovi%C4%87-661734150/)**, Data Science and DWH Engineering Manager at Njuškalo
**[Nikolina Kosanović](https://www.linkedin.com/in/nikolina-kosanovi%C4%87-79541786/)**, Senior ML Engineer at Njuškalo
**Abstract:** Search technology has come a long way from simple keyword matching to systems that truly understand meaning and context. In this talk, we’ll trace that evolution - from traditional keyword search to semantic and contextual search, and explore how each approach impacts relevance and user experience. Using real-world examples and practical comparisons, we’ll uncover how these techniques work under the hood, where Elastic fits in and how we use it at Njuškalo.

19.55: Networking

20.30: Close

PS: Join ElasticON Munich the next day — a free, full-day conference on search, observability, and security with Elastic, you can register [here](https://www.elastic.co/events/elasticon/munich).

Search Meetup Munich

Elastic Meetup Team

Björn Francescato

Dirk Gómez

Karlheinz Kleinhenz

Jeff Fan

Chris D.

Frank Merwerth 

Hottner Georg

Victor Kazakov

Georg Hottner

Abrar

Robert Haarmeyer

Philip Schmitt

Brad Llewellyn

Jürgen F.

Francesc Fons

Tatiana Finamor

Carles Campos

Diana Jourdan

AI Agents with Elastic Agent Builder & Introduction to Elastic Inference Service

Motorworld Munich

Meet us for talks at Zalando on November 12, 2025!

Doors open at 18.00 with pizza, refreshments, and networking to follow. We wrap up at 20.30.

Please make sure you sign up with your full name.

📅**Date and Time:**
Wednesday, November 12, from 6:00-8:30 PM

📍**Location:**
[Zalando Office BHW](https://maps.app.goo.gl/GELYd8FH7AnqEFNF8)
Berlin Hedwig-Wachenheimstraße 7 (BHW)
The main entrance is on the west-side of the building (towards Uber Arena). Participants should register at the Helpdesk, and will be picked up from there.

📝 **Agenda:**

* **18:00 - Doors Open**
Please have your real name in your profile description because the security team will check if you're registered when you arrive.
* **18:30 - Talk #1** **\- The Performance Paradox: When Slower Code Doesn't Slow You Down**
**[Anderson Queiroz](https://www.linkedin.com/in/andersonq/)** \- Senior Software Engineer at Elastic
**Abstract:** We added on-the-fly gzip decompression to Elastic Filebeat and the Elastic Agent—our log collection tools—to enable the ingestion of gzip archives and rotated logs. A performance drop was expected, so we benchmarked the feature only to find that the performance didn't drop at all. This talk is the story of our hunt for a non-existent bottleneck and how a holistic view of application performance uncovered the surprising truth about where the real costs lie.
* **19:00 - Talk #2 TBC**
* **19:30 - Pizza, drinks and networking**
* **20:30 - Wrap up**

Invite your friends and join our meetup. Special thanks to our hosts **[Zalando.](https://en.zalando.de/?_rfl=de)**

Want to speak at our next meetup? Submit your talk on **[this link](https://sessionize.com/elastic-meetups/)** and we will get in touch with you as soon as possible.

Elasticsearch Berlin

Merhawi Tsegay

Shyju Thankachan

Jazib Humayun

Jon Samwell

likhithakosuri

Teja

Jatinder Singh

Grace Thomas

Cédric Fraboulet

Cem Karakurt

Matthias Prellwitz

Jilles Van Gurp

Victor Gras

kavè

Ayd Asraf

Heramb Nishad

Arunav Konwar

Manash Mandal

Mohamed Essam

Elastic & Zalando: Elastic Filebeat and Agent

Zalando BHW

The Elastic Developer Relations Team welcome you to another community meetup in London and this time, taking place at our office!

Our Lead Developer Advocate **Carly Richmond** will be the host of the night. We'll have presentations from **Elena Stoeva** (Software Engineer II) and **Giorgos** **Bamparopoulos** (Senior Manager Software Engineering), followed by networking, pizza, and refreshments.

📅**Date and Time:**
Tuesday, November 18, from 6:00-8:30 PM

📍**Location:**
[Elastic Office in London](https://maps.app.goo.gl/JLSuDprMezpfSwtw8)
1st floor - 5 Southampton Street
London WC2E 7HA

📝 **Agenda:**

* 6:00 pm: Doors open, grab a drink, say "Hi"
* 6:30 pm: Talk # 1 - **Introducing Streams for Observability**
**[Elena Stoeva](https://www.linkedin.com/in/elena-stoeva/)** \- Software Enginner II at Elastic
**[Giorgos](https://www.linkedin.com/in/bamparopoulos/)**[ ](https://www.linkedin.com/in/bamparopoulos/)**[Bamparopoulos](https://www.linkedin.com/in/bamparopoulos/)** \- Senior Manager Software Engineering at Elastic
**Abstract:** Streams provides a single, centralized UI within Kibana that streamlines common tasks like extracting fields, setting data retention, and routing data using AI, so you don't need to use multiple applications or manually configure underlying Elasticsearch components.
* 7:10 pm: Talk #2 **TBC**
* 7:40-8:30 pm: **Pizza and** **Networking**

Invite your friends and RSVP on this page!

**⚡️ Interested in giving a talk? ⚡️**
Have you ever considered presenting on your Elastic use case? We welcome 5-10 minute lightning talks, 45-minute deep dives, and everything in between. If you're interested, please submit via our [CFP](https://sessionize.com/elastic-meetups/) or send us an email at [meetups@elastic.co.](http://meetups@elastic.co./)

Elastic London User Group

Lewis James

Jade D.

Jordi Mon Companys

Andrew Hardie

Alam Ahmad

Mesut

Member ID: #124262812

Michael

Norbert D'souza

Tunde

Tauseef Afzal

m.zohaib7938

Tanya Misheva

Robert D

Petter Axby

Ejimofor Nwoye

Neil Andrassy

Manoj Kshirsagar

Introducing Streams for Observability with Elastic

Elastic London Office

Join us for a meetup on **November 19th** in our Elastic office in Amsterdam! Doors open at 17.45 and the presentations begin at 18.00. Food, refreshments, and networking to follow. We wrap up around 20.00.

We are rating our talks as follows:
🟢 = Beginner content
🟡 = Intermediate content
🔵 = Expert content

**Address:** Elastic's office, Keizersgracht 281, 1016 ED Amsterdam

**Agenda:**
17.45: Doors open
18.00: Alert Fatigue Therapy: How to Write Detection Rules That Don’t Suck
18.45: Catching up with the latest Detection Engineering developments in Elastic Security
19.30: Networking, food with drinks
20.00: Wrap up

**Talks:**
**Alert Fatigue Therapy: How to Write Detection Rules That Don’t Suck**
False positives burn out analysts. False negatives burn down businesses. Every detection rule we write lives in the tension between those two extremes.In this talk, we’ll explore what it really means to write great rules; not just technically sound ones, but sustainable ones. We’ll unpack how false positives and false negatives are inseparably linked, why perfect rules don’t exist, and how the smartest SOCs continuously tune, test, and enrich their analytics to reach higher fidelity.You’ll also see how data enrichment, contextual correlation, and thoughtful rule design can transform noisy detections into trusted analytics; improving not only accuracy, but also analyst confidence and overall SOC health. And of course, we’ll showcase some of these capabilities in action with Elastic Security!

***Key Takeaways:***
• Cut the noise: balance false positives and missed detections.
• Use context and enrichment to turn alerts into insights.
• Build rules that analysts trust — tested, tuned, and efficient.

*Speaker: Marvin Ngoma, Principal Solutions Architect, Elastic*

**Catching up with the latest Detection Engineering developments in Elastic Security**
More details to follow soon.

Elastic Netherlands User Group

Alfredo Tomio Jr

Rasim D

msingathi majola

Lloyd Drost

Barend Schut

Evgenii M.

Ketan Patel

Rômulo Farias

Akshat Hegde

Maksim Shevchenko

Oleksii Ustenko

Volodymyr S.

Rick van de Vaart

Riccardo Trivellato

kiran Nreddy

Nathan Deridder

Jasper Hieselaar

Ed Wijk

Hans Heerooms

Alert Fatigue Therapy: How to Write Detection Rules That Don't Suck

Elasticsearch, Inc.

Elastic

Gruppi

{PRO_NETWORK_NAME} fa parte di Meetup Pro con più di {PRO_MEMBER_COUNT} iscritti in {PRO_GROUP_COUNT} Meetup in tutto il mondo. Meetup Pro è lo strumento professionale per organizzare e comunicare in un network di utenti, partner, contributori e partecipanti.

We’re delighted to have you join the Elastic global community!

This group is for anyone interested in making data usable in real-time and at scale for use cases like security, observability, enterprise search, and many more, using our Elasticsearch, Kibana, Logstash, and Beats products (https://www.elastic.co/products/).

Elastic

Elastic Fantastics

Chi siamo

Prossimi eventi

Chi siamo

Gruppi