IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Get started with Elastic Security Detections prerequisites and requirements »
Elastic Docs ›Elastic Security Solution [7.11] ›Get started with Elastic Security

Elastic Security system requirements

edit

Elastic Security system requirements

edit

Elastic Security is an inbuilt part of Kibana. To use Elastic Security, you only need an Elastic Stack deployment (an Elasticsearch cluster and Kibana). For information on installing the Elastic Stack, see Getting started with the Elastic Stack.

The Support Matrix page lists officially supported operating systems, platforms, and browsers on which Elasticsearch, Kibana, Beats, and Elastic Endpoint have been tested.

Skip installing Elasticsearch and Kibana locally and try a cloud deployment, available on Azure, AWS, and GCP. You can try it out for free.

Kibana space and index privileges

edit

To use Elastic Security, you must have at least:

  • Read privilege for the Security feature in the Kibana space (see Spaces).
  • Read and view_index_metadata privileges for all Elastic Security indices, such as filebeat-*, packetbeat-*, logs-*, and endgame-* indices.

Configure advanced settings describes how to modify Elastic Security indices.

For more information about index privileges, see Elasticsearch security privileges.

Feature-specific requirements

edit

There are some additional requirements for specific features:

License requirements

edit

All features are available as part of the free Basic plan except:

Elastic Stack subscriptions lists the required subscription plans for all features.

Advanced configuration and UI options

edit

Configure advanced settings describes how to modify advanced settings, such as the Elastic Security indices, default time intervals used in filters, and IP reputation links.

Third-party collectors mapped to ECS

edit

The Elastic Common Schema (ECS) defines a common set of fields to be used for storing event data in Elasticsearch. ECS helps users normalize their event data to better analyze, visualize, and correlate the data represented in their events. Elastic Security can ingest and normalize events from any ECS-compliant data source.

Elastic Security requires ECS-compliant data. If you use third-party data collectors to ship data to Elasticsearch, the data must be mapped to ECS. Elastic Security ECS field reference lists ECS fields used in Elastic Security.

Cross-cluster searches

edit

For information on how to perform cross-cluster searches on Elastic Security indices, see:

« Get started with Elastic Security Detections prerequisites and requirements »