IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Data views in Elastic Security Configure and install the Endpoint and Cloud Security integration »
Elastic Docs ›Elastic Security Solution [8.3] ›Get started with Elastic Security

Ingest data to Elastic Security

edit

Ingest data to Elastic Security

edit

To ingest data, you can use:

  • The Elastic Agent with the Elastic Endpoint and Cloud Security integration, which protects your hosts and sends logs, metrics, and endpoint security data to Elastic Security. See Configure and install the Endpoint and Cloud Security integration.
  • The Elastic Agent with integrations, which are available in the Elastic Package Registry (EPR). To install an integration that works with Elastic Security, go to the Getting started page and click Add security integrations. Alternatively, go to the Home page and click Add integrations. On the Integrations page, click the Security category filter, then select an integration to view the installation instructions. For more information on integrations, refer to Integrations.
  • Beats shippers installed for each system you want to monitor.
  • The Elastic Agent to send data from Splunk to Elastic Security. See Ingest data from Splunk.
  • Third-party collectors configured to ship ECS-compliant data. Elastic Security ECS field reference provides a list of ECS fields used in Elastic Security.

If you use a third-party collector to ship data to Elastic Security, you must map its fields to the Elastic Common Schema (ECS). Additionally, you must add its index to the Elastic Security indices (open the main menu, then go to Stack Management → Advanced Settings → securitySolution:defaultIndex).

Elastic Security uses the host.name ECS field as the primary key for identifying hosts.

The Elastic Agent with the Endpoint and Cloud Security Integration ships these data sources:

  • Process - Linux, macOS, Windows
  • Network - Linux, macOS, Windows
  • File - Linux, macOS, Windows
  • DNS - Windows
  • Registry - Windows
  • DLL and Driver Load - Windows
  • Security - Windows

Install Beats shippers

edit

To add hosts and populate Elastic Security with network security events, you need to install and configure Beats on the hosts from which you want to ingest security events:

  • Filebeat for forwarding and centralizing logs and files
  • Auditbeat for collecting security events
  • Winlogbeat for centralizing Windows event logs
  • Packetbeat for analyzing network activity

You can install Beats using the Kibana UI guide or directly from the command line.

Install Beats using the Kibana UI guide

edit

When you add integrations that use Beats, you’re guided through the Beats installation process. To begin, go to the Home page, click Add integrations, and then follow the links for the types of data you want to collect.

On the Integrations page, you can select the Beats only filter to only view integrations using Beats.

Shows button to add integrations

Download and install Beats from the command line

edit

To install Beats, see these installation guides:

Enable modules and configuration options

edit

No matter how you installed Beats, you need to enable modules in Auditbeat and Filebeat to populate Elastic Security with data.

For a full list of security-related beat modules, click here.

To populate Hosts data, enable these modules:

To populate Network data, enable Packetbeat protocols and Filebeat modules:

« Data views in Elastic Security Configure and install the Endpoint and Cloud Security integration »