Type to search.

Elastic Endpoint self-protection features

Serverless Security

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Stack

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Elastic Endpoint, the installed component that performs Elastic Defend's threat monitoring and prevention, protects itself against users and attackers that may try to interfere with its functionality. Protection features are consistently enhanced to prevent attackers who may attempt to use newer, more sophisticated tactics to interfere with the Elastic Endpoint. Self-protection is enabled by default when Elastic Endpoint installs on supported platforms, listed below.

Self-protection is enabled on the following 64-bit Windows versions:

  • Windows 8.1
  • Windows 10
  • Windows 11
  • Windows Server 2012 R2
  • Windows Server 2016
  • Windows Server 2019
  • Windows Server 2022

Self-protection is also enabled on the following macOS versions:

  • macOS 10.15 (Catalina)
  • macOS 11 (Big Sur)
  • macOS 12 (Monterey)
Note

Other Windows and macOS variants (and all Linux distributions) do not have self-protection.

For Elastic Stack version >= 7.11.0, self-protection defines the following permissions:

  • Users — even Administrator/root — cannot delete Elastic Endpoint files (located at c:\Program Files\Elastic\Endpoint on Windows, and /Library/Elastic/Endpoint on macOS).
  • Users cannot terminate the Elastic Endpoint program or service.
  • Administrator/root users can read Elastic Endpoint's files. On Windows, the easiest way to read Elastic Endpoint files is to start an Administrator cmd.exe prompt. On macOS, an Administrator can use the sudo command.
  • Administrator/root users can stop the Elastic Agent's service. On Windows, run the sc stop "Elastic Agent" command. On macOS, run the sudo launchctl stop elastic-agent command.