---
title: Elastic Security feature tiers
description: Elastic Security Serverless projects are available in the following tiers, each with a carefully selected set of features to enable security operations:...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5400/solutions/security/security-serverless-feature-tiers
products:
  - Elastic Security
applies_to:
  - Elastic Cloud Serverless: Generally available
---

# Elastic Security feature tiers
Elastic Security Serverless projects are available in the following tiers, each with a carefully selected set of features to enable security operations:
- **Elastic AI SOC Engine (EASE)**: Use Elastic's AI-powered threat hunting and alert triage capabilities to complement a third-party SIEM deployment.
- **Security Analytics Essentials**: Everything most organizations need to operationalize traditional SIEM.
- **Security Analytics Complete**: All the capabilities included in **Security Analytics Essentials**, plus additional features that provide a more complete toolset.

Both of the **Security Analytics** tiers have **Add-on options** for endpoint protection and cloud protection.
Refer to the [feature comparison table](#sec-subscription-features) for a more detailed comparison between the tiers.

## Feature tier pricing

For pricing information, refer to [Elastic Security Serverless pricing](https://www.elastic.co/pricing/serverless-security).

## Security Analytics feature comparison

The following table compares features available in each feature tier:

| **Feature Name**                                                                                                                                                                                                                                                                                                                | **Security Analytics Complete** | **Security Analytics Essentials** | **EASE** |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------|-----------------------------------|----------|
| **[Cases](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5400/solutions/security/investigate/security-cases) (collect and share information)**                                                                                                                                                                   | ✅                               | ✅                                 | ✅        |
| **[Native integrations](https://www.elastic.co/docs/reference/integrations) with third-party SIEM and EDR platforms**                                                                                                                                                                                                           | ✅                               | ✅                                 | ✅        |
| **Out of the box [dashboards](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5400/solutions/security/dashboards)**                                                                                                                                                                                               | ✅                               | ✅                                 | ❌        |
| **Prebuilt and custom [detection rules](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5400/solutions/security/detect-and-alert)**                                                                                                                                                                               | ✅                               | ✅                                 | ❌        |
| **[Machine learning](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5400/solutions/security/advanced-entity-analytics/anomaly-detection)**                                                                                                                                                                       | ✅                               | ✅                                 | ❌        |
| **[Triage](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5400/solutions/security/detect-and-alert/manage-detection-alerts), [investigation](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5400/solutions/security/investigate), and [hunting](https://www.elastic.co/security/threat-hunting)** | ✅                               | ✅                                 | ❌        |
| **[Threat intelligence integration](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5400/solutions/security/get-started/enable-threat-intelligence-integrations)**                                                                                                                                                | ✅                               | ✅                                 | ❌        |
| **[AI Assistant](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5400/solutions/security/ai/ai-assistant) with custom knowledge support**                                                                                                                                                                         | ✅                               | ❌                                 | ✅        |
| **[Attack Discovery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5400/solutions/security/ai/attack-discovery) (AI-powered alert correlation)**                                                                                                                                                                | ✅                               | ❌                                 | ✅        |
| **[Automatic Import](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5400/solutions/security/get-started/automatic-import) (AI-powered custom integrations)**                                                                                                                                                     | ✅                               | ❌                                 | ❌        |
| **[Entity analytics / UEBA](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5400/solutions/security/advanced-entity-analytics)**                                                                                                                                                                                  | ✅                               | ❌                                 | ❌        |
| **Extended security content**                                                                                                                                                                                                                                                                                                   | ✅                               | ❌                                 | ❌        |
| **Threat intelligence management**                                                                                                                                                                                                                                                                                              | ✅                               | ❌                                 | ❌        |
| **[Serverless Plus add-on](/elastic/docs-content/pull/5400/deploy-manage/deploy/elastic-cloud/project-settings#serverless-plus)**                                                                                                                                                                                               | ✅                               | ❌                                 | ❌        |


## Add-on options

Both the **Security Analytics Complete** and **Security Analytics Essentials** feature tiers have optional add-ons for **Endpoint protection** and **Cloud protection**. The features included in each add on vary by feature tier, as follows:
**Endpoint protection add-on:**

| Feature Name                                                                                                                                                                                                                                                                                                                                 | Complete | Essentials |
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|------------|
| **[Malware prevention](/elastic/docs-content/pull/5400/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend#malware-protection)**                                                                                                                                                                  | ✅        | ✅          |
| **[Ransomware protection](/elastic/docs-content/pull/5400/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend#ransomware-protection)**                                                                                                                                                            | ✅        | ✅          |
| **[Memory](/elastic/docs-content/pull/5400/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend#memory-protection) and [behavior prevention](/elastic/docs-content/pull/5400/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend#behavior-protection)** | ✅        | ✅          |
| **[Endpoint response actions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5400/solutions/security/endpoint-response-actions)**                                                                                                                                                                                             | ✅        | ❌          |
| **Advanced [endpoint policy management](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5400/solutions/security/manage-elastic-defend/endpoints)**                                                                                                                                                                             | ✅        | ❌          |

**Cloud protection add-on:**

| Feature Name                                                                                                                                                                                            | Complete | Essentials |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|------------|
| **[Workload runtime protection](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5400/solutions/security/cloud/cloud-workload-protection-for-vms)**                                        | ✅        | ✅          |
| **[Cloud native posture management](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5400/solutions/security/cloud/security-posture-management-overview) for Kubernetes, AWS, GCP & more** | ✅        | ✅          |
| **[Response actions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5400/solutions/security/endpoint-response-actions)**                                                                 | ✅        | ❌          |

The [Serverless Plus add-on](/elastic/docs-content/pull/5400/deploy-manage/deploy/elastic-cloud/project-settings#serverless-plus) is automatically included with the **Security Analytics Complete** feature tier at no additional charge.

## Upgrade to a higher feature tier

<warning>
  Upgrading a project to a higher feature tier cannot always be efficiently reversed: downgrading to a lower tier immediately makes some features unavailable, and data associated with those features can be permanently deleted.
</warning>

To access the additional features available in a higher feature tier:
1. From the [Elastic Cloud Console](https://cloud.elastic.co), select **Manage** next to the Serverless project you want to upgrade.
2. Next to **Project features**, select **Edit**.
3. Select your desired feature tier.
4. Select **Save** to complete the upgrade.