Detections and alerts
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless Security
Generally available
Stack
Generally available
Elastic Security's detection engine evaluates your data against detection rules and generates alerts when rule criteria are met. Rules can correlate events across all connected data sources to surface threats that no single data stream would reveal on its own. Elastic Security provides several rule types, from field-value matches to event correlation, machine learning anomaly detection, and more.
The detection engine also surfaces alerts from Elastic Defend's endpoint protection (malware, ransomware, memory threats, and malicious behavior) and external alerts from third-party tools like Suricata, giving you a unified view of threats across your security stack.
Kibana Universal Alerting is a separate alerting system that isn't tied to any specific solution. Its rules aren't the same as Elastic Security ES|QL rules. For threat detection, use Elastic Security detection rules. They include security-specific capabilities such as exceptions and alert suppression that Kibana Universal Alerting doesn't provide.
| Your goal | Start here |
|---|---|
| Set up detection for the first time | Setup → Install prebuilt rules |
| Take over or manage an existing deployment | MITRE coverage → Monitor rule executions |
| Build coverage for a specific threat | Choose the right rule type → Build it using the UI |
| Reduce noise from existing rules | Tune detection rules → Exceptions, Suppression, or Snooze |
The following stages represent the suggested path to a functioning detection program. Most deployments move through these stages roughly in order, though the boundaries are not strict: tuning and noise reduction are ongoing rather than a final stage.
- Confirm requirements. Verify infrastructure, privileges, and data availability.
- Assess coverage gaps. Identify which threats matter most to your environment, then use the MITRE coverage page to find gaps in your detection rules.
- Enable prebuilt rules. Activate Elastic's maintained rule library for priority tactics.
- Build custom rules. Fill remaining gaps with rules tailored to your environment.
- Validate before enabling. Test rule logic against historical data before going live.
- Monitor rule health. Confirm rules are executing correctly and generating alerts.
- Reduce noise. Tune, add exceptions, suppress, or snooze as needed.
A minimal viable detection program (prebuilt rules enabled for your highest-priority tactics and techniques, running correctly, with noise managed to an actionable level) is a meaningful outcome at any stage of this workflow. You do not need to complete every stage before your detection program delivers value.