- Kibana Guide: other versions:
- What is Kibana?
- What’s new in 7.12
- Kibana concepts
- Quick start
- Set up
- Install Kibana
- Configure Kibana
- Alerting and action settings
- APM settings
- Banners settings
- Development tools settings
- Graph settings
- Fleet settings
- i18n settings
- Logs settings
- Metrics settings
- Machine learning settings
- Monitoring settings
- Reporting settings
- Secure settings
- Search sessions settings
- Security settings
- Spaces settings
- Task Manager settings
- Telemetry settings
- Start and stop Kibana
- Access Kibana
- Securing access to Kibana
- Add data
- Upgrade Kibana
- Embed Kibana content in a web page
- Configure monitoring
- Configure security
- Production considerations
- Discover
- Dashboard
- Canvas
- Maps
- Machine learning
- Graph
- Observability
- APM
- Elastic Security
- Dev Tools
- Stack Monitoring
- Stack Management
- Fleet
- Reporting
- Alerting and Actions
- REST API
- Kibana plugins
- Accessibility
- Release notes
- Developer guide
Elastic Security
editElastic Security
editElastic Security combines SIEM threat detection features with endpoint prevention and response capabilities in one solution, including:
- A detection engine to identify attacks and system misconfiguration
- A workspace for event triage and investigations
- Interactive visualizations to investigate process relationships
- Embedded case management and automated actions
- Detection of signatureless attacks with prebuilt machine learning anomaly jobs and detection rules

Add data
editKibana provides step-by-step instructions to help you add data. The Security Guide is a good source for more detailed information and instructions.
Beats
editAuditbeat, Filebeat, Winlogbeat, and Packetbeat send security events and other data to Elasticsearch.
The default index patterns for Elastic Security events are auditbeat-*
, winlogbeat-*
,
filebeat-*
, packetbeat-*
, endgame-*
, logs-*
, and apm-*-transaction*
. To change the default pattern patterns, go to Stack Management > Advanced Settings > securitySolution:defaultIndex.
Elastic Security endpoint agent
editThe agent detects and protects against malware, and ships host and network events directly to Elastic Security.
Elastic Common Schema (ECS) for normalizing data
editThe Elastic Common Schema (ECS) defines a common set of fields to be used for storing event data in Elasticsearch. ECS helps users normalize their event data to better analyze, visualize, and correlate the data represented in their events.
Elastic Security can ingest and normalize events from ECS-compatible data sources.
On this page