---
title: Ingest data to Elastic Security
description: To ingest data, you can use: The Elastic Agent with the Elastic Defend integration, which protects your hosts and sends logs, metrics, and endpoint security...
url: https://www.elastic.co/elastic/docs-builder/docs/3826/solutions/security/get-started/ingest-data-to-elastic-security
products:
  - Elastic Cloud Serverless
  - Elastic Security
applies_to:
  - Serverless Security projects: Generally available
  - Elastic Stack: Generally available
---

# Ingest data to Elastic Security
To ingest data, you can use:
- The [Elastic Agent](https://www.elastic.co/elastic/docs-builder/docs/3826/reference/fleet) with the **Elastic Defend** integration, which protects your hosts and sends logs, metrics, and endpoint security data to Elastic Security. See [Install Elastic Defend](https://www.elastic.co/elastic/docs-builder/docs/3826/solutions/security/configure-elastic-defend/install-elastic-defend).
- The Elastic Agent with integrations, which are available in the [Elastic Package Registry (EPR)](/elastic/docs-builder/docs/3826/reference/fleet#package-registry-intro). To install an integration that works with Elastic Security, go to the Kibana Home page or navigation menu and click **Add integrations**. On the Integrations page, click the **Security** category filter, then select an integration to view the installation instructions. For more information on integrations, refer to [Integrations](https://docs.elastic.co/en/integrations).
- [Beats](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3826/reference/beats) shippers installed for each system you want to monitor.
- **Logstash**, which dynamically ingests, transforms, and ships your data regardless of format.
- Third-party collectors configured to ship ECS-compliant data. [Elastic Security ECS field reference](https://www.elastic.co/elastic/docs-builder/docs/3826/reference/security/fields-and-object-schemas/siem-field-reference) provides a list of ECS fields used in Elastic Security.

<important>
  If you use a third-party collector—or some Logstash plugins without Elastic Agent or Beats—to ship data to Elastic Security, you must map its fields to the [Elastic Common Schema (ECS)](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3826/reference/ecs). Additionally, you must add its index to the Elastic Security indices (update the `securitySolution:defaultIndex` [advanced setting](/elastic/docs-builder/docs/3826/solutions/security/get-started/configure-advanced-settings#update-sec-indices)).Elastic Security uses the [`host.name`](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3826/reference/ecs/ecs-host) ECS field as the primary key for identifying hosts.
</important>

The Elastic Agent with the [Elastic Defend integration](https://www.elastic.co/products/endpoint-security) ships these data sources:
- Process - Linux, macOS, Windows
- Network - Linux, macOS, Windows
- File - Linux, macOS, Windows
- DNS - Windows
- Registry - Windows
- DLL and Driver Load - Windows
- Security - Windows