How Doctolib Built an In-House SOC with Elastic Security, Cutting False Positives by 50%

Doctolib operates as the dominant digital health platform in Europe, serving 90 million patients and 400,000 healthcare professionals across France, Germany, Italy, and the Netherlands. As a platform handling sensitive patient data under strict healthcare regulations, the security demands are acute—and the consequences of a breach extend beyond financial loss into patient safety.

For years, Doctolib’s security operations relied on an outsourced SOC built on OpenSearch. The arrangement created structural problems: frequent false positives consumed analyst capacity, response times were slow, and data retention was limited to one month—insufficient for meaningful forensic investigation. The platform’s rapid growth, particularly through the COVID-19 pandemic, exposed just how brittle this model was at scale.

Doctolib moved its security operations in-house by deploying Elastic Security as the core of its SIEM environment. The team centralized logging, monitoring, and alerting across Google Drive, Jira, and internal applications into a single platform running on AWS. Machine learning capabilities within Elastic took over the routine alerting workload, filtering noise before it reached analysts.

The results were immediate and measurable. False positives dropped by 50%, allowing the security team to redirect attention from alert triage to genuine threat investigation. Data retention grew from one month to one year—Doctolib now ingests 2TB of logs per day, managing 12 times its previous data volume. While total costs doubled, the cost per terabyte fell by 83%, making the expanded scale economically viable. Mean time to detect fell due to automated ML alerting, while the team’s focus shifted to reducing mean time to investigate and resolve incidents.

Elastic also extended beyond the security function—Doctolib’s development teams gained access to their own application logs for the first time, accelerating debugging and improving cross-team visibility. Looking ahead, Doctolib plans to deepen its use of Elastic’s AI capabilities to move from reactive threat detection to proactive threat prevention.