Manage Elastic Security
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless Security
Generally available
Stack
Generally available
After you deploy Elastic Security, you return to these tasks as your environment and team change. Tune protection policies, manage exceptions, control who can use each feature, and decide which data the Elastic Security app shows.
For one-time deployment tasks, such as installing Elastic Defend or connecting your cloud accounts, refer to Set up.
Elastic Security settings apply at different levels, so a change in one place can affect more than one host or user:
- Integration policies control protection on your hosts and workloads. Elastic Defend and Defend for Containers policies are part of Elastic Agent policies, so each change applies to every host that uses that policy.
- Roles control what each user can view and do. Each feature has its own privileges, and you assign them to roles.
- Spaces separate your security content. Detection rules, exceptions, alerts, Timelines, and cases in one Kibana space aren't visible in other spaces. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.1 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. You can also scope Elastic Defend policies, artifacts, and response actions by space.
- Data views control which indices the Elastic Security app reads in each space.
| Your goal | Start here |
|---|---|
| Monitor protected endpoints, tune policies, or reduce false positives from Elastic Defend | Manage Elastic Defend |
| Detect and block threats on Linux VMs and Kubernetes workloads at runtime | Manage cloud workload protection |
| Give users the access they need for each feature | Access control |
| Organize security content into spaces, or change which data the Elastic Security app shows | Configure workspace settings |
After you configure your environment, you can:
- Detect and alert on threats with prebuilt and custom detection rules.
- Respond and contain threats by triaging alerts and isolating hosts.
- Troubleshoot Elastic Defend if you run into installation, connectivity, or policy issues.