Elastic Security solution overview
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless Security
Generally available
Stack
Generally available
Elastic Security helps you detect, investigate, and respond to threats across your hosts, cloud services, and networks. It's built on Elasticsearch and Kibana, so you can search, correlate, and visualize your security data in one place. AI features help you get through alert volume, tune noisy rules, and migrate your detection content from another SIEM.
Elastic Security has four main capabilities. You can use them together or start with one.
Elastic Security collects security data from across your environment through hundreds of integrations. It detects threats with Elastic-maintained prebuilt rules, your own rules, and machine learning.
When alerts come in, you can triage and investigate them, and hunt for threats in Timeline and the visual event analyzer. Cases keep a record of each investigation, from the first alert to resolution.
Elastic Defend detects and prevents malware, ransomware, in-memory threats, and malicious behavior on Windows, macOS, and Linux hosts. It runs on the same Elastic Agent that collects your host data, so you deploy one agent for both.
When you confirm an attack, you can contain it by isolating hosts and taking other response actions. You can also take response actions on hosts that run supported third-party EDR tools.
Get started with endpoint security →
Cloud security posture management (CSPM) and Kubernetes security posture management (KSPM) find misconfigurations in your cloud accounts and Kubernetes clusters by checking them against security benchmarks.
A separate feature, cloud native vulnerability management (CNVM), scans your Linux VMs in AWS for known vulnerabilities.
Get started with cloud security posture management →
Elastic Defend also protects your Linux VMs while they run. It's the same integration that protects your other hosts, and it detects and prevents malware, memory threats, and malicious behavior.
It also sends process, file, and network activity to Elastic Security, where prebuilt rules and machine learning can find threats in it.
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Beta This functionality is in beta and is not ready for production usage. For beta features, the design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Beta since 9.3 This functionality is in beta and is not ready for production usage. For beta features, the design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. For Kubernetes containers, Defend for Containers alerts on drift and can block process and file operations that match your policy.
Learn more about cloud workload protection →
Elastic Security also includes AI features that use large language models (LLMs). Depending on your deployment and license, you can use Elastic Managed LLMs through the Elastic Inference Service (EIS) or an LLM from another provider.
With AI features, you can:
- Migrate from another SIEM: Automatic Migration translates your existing detection rules and dashboards into Elastic Security, so you don't rebuild your detection content by hand. Supported SIEMs and asset types vary by deployment type and version. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.1 This functionality is generally available and ready for production usage. Preview in 9.0 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
- Bring in data that has no integration: Automatic Import builds a custom integration from a sample of your logs.
- Write and tune detection rules: Security skills in Elastic Agent Builder draft ES|QL rules from a plain-language description of what you want to detect. Depending on your version, they also suggest prebuilt rules for the integrations you already have, and find out why a rule is noisy. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
- Get through alert volume: Attack Discovery groups related alerts into attacks and maps them to MITRE ATT&CK®, so you triage one attack instead of each alert in it.
- Investigate and respond: Elastic Agent Builder answers questions about your alerts and data, and writes ES|QL queries for you. With Workflows, custom agents can also isolate hosts, create cases, and send notifications, so you can automate routine response steps. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.4 This functionality is generally available and ready for production usage. Preview in 9.3 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
- Keep endpoint protection working: Automatic Troubleshooting finds issues that stop Elastic Defend from protecting your hosts, such as conflicts with third-party antivirus software. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.2 This functionality is generally available and ready for production usage. Preview from 9.0 to 9.1 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
To add AI triage without replacing your current SIEM or EDR/XDR platform, use an Elastic AI SOC Engine (EASE) project. It runs Attack Discovery, Elastic Agent Builder, and cases on the alerts from that platform.
Learn more about AI in Elastic Security →
To try Elastic Security, start a free trial. The features available to your team depend on how you run it. In Elastic Security Serverless, the Security Analytics feature tiers include SIEM, with add-ons for endpoint and cloud protection. In Elastic Stack deployments, features depend on your subscription.
If you run Elastic Security for several customers or teams, you can keep each one's rules, alerts, and cases separate in its own space. To detect threats in data stored elsewhere, detection rules can query other clusters with cross-cluster search in Elastic Stack deployments, or other projects with cross-project search in Serverless.
For a guided walkthrough of one area, use a quickstart.