Elastic Security
Elastic Security is Elastic’s SIEM and XDR solution for detecting, investigating and responding to threats across endpoints, cloud and security data.
0 upvotes · 0 downvotes
- Category
- Defensive Security & Monitoring
- Pricing
- Freemium
- Platforms
- WebLinuxWindowsmacOS
- Licence
- Open source
- Reviewed
- Last reviewed 1 October 2026
What it is
Elastic Security is the security solution in the Elastic Stack. It combines SIEM-style detection and investigation with extended detection and response (XDR) capabilities, including endpoint and cloud security features depending on deployment. Teams use Elasticsearch, Kibana and related Elastic components to store security data, run detection rules and manage alerts in a unified workflow.
What it helps with
- Ingesting and analysing security logs and telemetry at scale on the Elastic Stack.
- Running SIEM detection rules, timelines and investigations in Kibana.
- Extending into endpoint protection and response with Elastic Defend where enabled.
- Covering cloud and host signals within a broader Elastic Security project or deployment.
- Supporting free self-managed starting points and paid Elastic Cloud or subscription features.
- Integrating with common data shippers and security data sources documented by Elastic.
Who it's for
Security engineers, SOC teams and organisations that want a SIEM/XDR platform built on Elastic, including teams comparing open-core options with commercial SIEM vendors.
Worth knowing
Elastic Security spans free and paid offerings; advanced features, support and cloud hosting typically require Elastic subscriptions. Official docs live under elastic.co. This listing centres on Elastic Security as a SIEM/XDR solution rather than Elasticsearch alone. Attribution: framing from Elastic Security documentation and product pages.