Elastic Security solution overview
Elastic Security helps you detect, investigate, and respond to threats across your hosts, cloud services, and networks. It's built on Elasticsearch and Kibana, so you can search, correlate, and visualize your security data in one place. AI features help you get through alert volume, tune noisy rules, and migrate your detection content from another SIEM.
Elastic Security has four main capabilities. You can use them together or start with one.
Elastic Security collects security data from across your environment through hundreds of integrations. It detects threats with Elastic-maintained prebuilt rules, your own rules, and machine learning.
When alerts come in, you can triage and investigate them, and hunt for threats in Timeline and the visual event analyzer. Cases keep a record of each investigation, from the first alert to resolution.
Elastic Defend detects and prevents malware, ransomware, in-memory threats, and malicious behavior on Windows, macOS, and Linux hosts. It runs on the same Elastic Agent that collects your host data, so you deploy one agent for both.
When you confirm an attack, you can contain it by isolating hosts and taking other response actions. You can also take response actions on hosts that run supported third-party EDR tools.
Get started with endpoint security →
Cloud security posture management (CSPM) and Kubernetes security posture management (KSPM) find misconfigurations in your cloud accounts and Kubernetes clusters by checking them against security benchmarks.
A separate feature, cloud native vulnerability management (CNVM), scans your Linux VMs in AWS for known vulnerabilities.
Get started with cloud security posture management →
Elastic Defend also protects your Linux VMs while they run. It's the same integration that protects your other hosts, and it detects and prevents malware, memory threats, and malicious behavior.
It also sends process, file, and network activity to Elastic Security, where prebuilt rules and machine learning can find threats in it.
Learn more about cloud workload protection →
Elastic Security also includes AI features that use large language models (LLMs). Depending on your deployment and license, you can use Elastic Managed LLMs through the Elastic Inference Service (EIS) or an LLM from another provider.
With AI features, you can:
- Migrate from another SIEM: Automatic Migration translates your existing detection rules and dashboards into Elastic Security, so you don't rebuild your detection content by hand. Supported SIEMs and asset types vary by deployment type and version.
- Bring in data that has no integration: Automatic Import builds a custom integration from a sample of your logs.
- Write and tune detection rules: Security skills in Elastic Agent Builder draft ES|QL rules from a plain-language description of what you want to detect. Depending on your version, they also suggest prebuilt rules for the integrations you already have, and find out why a rule is noisy.
- Get through alert volume: Attack Discovery groups related alerts into attacks and maps them to MITRE ATT&CK®, so you triage one attack instead of each alert in it.
- Investigate and respond: Elastic Agent Builder answers questions about your alerts and data, and writes ES|QL queries for you. With Workflows, custom agents can also isolate hosts, create cases, and send notifications, so you can automate routine response steps.
- Keep endpoint protection working: Automatic Troubleshooting finds issues that stop Elastic Defend from protecting your hosts, such as conflicts with third-party antivirus software.
To add AI triage without replacing your current SIEM or EDR/XDR platform, use an Elastic AI SOC Engine (EASE) project. It runs Attack Discovery, Elastic Agent Builder, and cases on the alerts from that platform.
Learn more about AI in Elastic Security →
To try Elastic Security, start a free trial. The features available to your team depend on how you run it. In Elastic Security Serverless, the Security Analytics feature tiers include SIEM, with add-ons for endpoint and cloud protection. In Elastic Stack deployments, features depend on your subscription.
If you run Elastic Security for several customers or teams, you can keep each one's rules, alerts, and cases separate in its own space. To detect threats in data stored elsewhere, detection rules can query other clusters with cross-cluster search in Elastic Stack deployments, or other projects with cross-project search in Serverless.
For a guided walkthrough of one area, use a quickstart.