Set up Elastic Security
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless Security
Generally available
Stack
Generally available
Deploy the Elastic Security protections that cover your hosts, cloud accounts, and Kubernetes clusters. You do these tasks once for each feature, when you first turn it on.
After setup, each feature sends its data to Elastic Security, where you can review alerts, findings, and risk scores. To tune policies, manage exceptions, and control access after deployment, refer to Manage.
Each protection covers a different part of your environment, so the features you set up depend on what you run:
- Elastic Defend: Protects Windows, macOS, and Linux hosts, including Linux VMs in the cloud. It runs on Elastic Agent, which you install on each host. It can detect or block malware, ransomware, and malicious behavior.
- Cloud security: Checks your cloud accounts and Kubernetes clusters against security best practices, lists your cloud assets, and scans your AWS EC2 Linux workloads for known vulnerabilities.
- Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Beta This functionality is in beta and is not ready for production usage. For beta features, the design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Beta since 9.3 This functionality is in beta and is not ready for production usage. For beta features, the design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Defend for Containers: Detects, and can block, unexpected behavior inside running Kubernetes containers.
| Your goal | Start here |
|---|---|
| Protect hosts from malware, ransomware, and malicious behavior | Configure endpoint protection with Elastic Defend |
| Check your cloud accounts and Kubernetes clusters for misconfigurations and vulnerabilities | Set up cloud security |
| Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Beta This functionality is in beta and is not ready for production usage. For beta features, the design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Beta since 9.3 This functionality is in beta and is not ready for production usage. For beta features, the design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Protect Kubernetes workloads at runtime | Get started with Defend for Containers for Kubernetes |
| Connect AI features to an LLM and grant users access to them | Set up AI features |
| Check what you need for entity risk scoring, asset criticality, and the entity store | Entity analytics requirements |
| Check what you need to run machine learning jobs and rules | Machine learning job and rule requirements |
After you set up your protections, you can:
- Manage Elastic Security to tune policies, manage exceptions, and give users access to each feature.
- Ingest data from third-party security tools and threat intelligence sources.
- Detect and alert on threats with prebuilt and custom detection rules.
- Hunt and assess posture to review findings and risk scores from the features you set up.