﻿---
title: Manage Elastic Defend
description: Manage Elastic Defend endpoints, policies, exceptions, and protection settings. Configure trusted applications, event filters, blocklists, and more.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend
products:
  - Elastic Cloud Serverless
  - Elastic Security
applies_to:
  - Serverless Security projects: Generally available
  - Elastic Stack: Generally available
---

# Manage Elastic Defend
After deploying Elastic Defend, you can manage your protected endpoints, tune policies, and create exceptions to reduce false positives — all from within Elastic Security. These management tools give you centralized control over endpoint protection across your environment.
Elastic Security provides dedicated pages for each management area. Find them in the navigation menu or by using the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/explore-analyze/find-and-organize/find-apps-and-objects). Use them to monitor endpoint health, adjust protection policies, and define exceptions that keep Elastic Defend running smoothly alongside your existing software and workflows.

## Where to start


| Your goal                                                    | Start here                                                                                                                                                                                                                                                                                                  |
|--------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| View and monitor protected endpoints                         | [Endpoints](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/endpoints)                                                                                                                                                                          |
| Adjust protection settings or event collection               | [Policies](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/policies)                                                                                                                                                                            |
| Reduce false positives from known software                   | [Trusted applications](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/trusted-applications) → [Event filters](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/event-filters)       |
| Suppress false positive Elastic Endpoint alerts              | [Elastic Endpoint exceptions](/elastic/docs-content/pull/5669/solutions/security/detect-and-alert/add-manage-exceptions#endpoint-rule-exceptions)                                                                                                                                                           |
| Block known malicious applications                           | [Blocklist](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/blocklist)                                                                                                                                                                          |
| Understand different Elastic Endpoint configuration settings | [Optimize Elastic Defend](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/optimize-elastic-defend)                                                                                                                                              |
| Diagnose problems with Elastic Defend                        | [Automatic troubleshooting](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/automatic-troubleshooting) → [Troubleshoot Elastic Defend](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/troubleshoot/security/elastic-defend) |


## Endpoints and policies

The [Endpoints](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/endpoints) page shows every host running Elastic Defend, including its status, policy assignment, and operating system. Use it to verify that endpoints are healthy, check which policy each host is using, and drill into individual endpoint details.
The [Policies](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/policies) page lists all Elastic Defend integration policies. From here, you can open a policy to adjust its protection levels, event collection settings, and advanced options.

## Exceptions and filters

Exceptions and filters let you tailor Elastic Defend behavior to your environment, reducing noise without weakening protection.
- [Trusted applications](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/trusted-applications): Exclude known-good applications (such as other security tools) from Elastic Defend monitoring to prevent performance issues and incompatibilities.
- [Trusted devices](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/trusted-devices): Allow specific external storage devices to connect to protected hosts, overriding device control settings.
- [Event filters](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/event-filters): Prevent high-volume or low-value endpoint events from being stored in Elasticsearch, reducing storage costs.
- [Host isolation exceptions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/host-isolation-exceptions): Allow isolated hosts to communicate with specific IP addresses while remaining blocked from the rest of the network.
- [Blocklist](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/blocklist): Prevent specified applications from running on protected hosts, extending Elastic Defend's list of known-malicious processes.
- [Elastic Endpoint exceptions](/elastic/docs-content/pull/5669/solutions/security/detect-and-alert/add-manage-exceptions#endpoint-rule-exceptions): Reduce false positives from [endpoint protection rules](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/endpoint-protection-rules) by preventing Elastic Endpoint from generating alerts.


## Protection and security

Elastic Defend includes built-in protection features and prebuilt detection rules that help secure your endpoints and prevent tampering.
- [Endpoint protection rules](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/endpoint-protection-rules): Prebuilt detection rules that help you manage and respond to alerts generated by Elastic Endpoint, including rules for malware, ransomware, memory threats, and malicious behavior.
- [Elastic Endpoint self-protection](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/elastic-endpoint-self-protection-features): Built-in tamper protection that prevents users and attackers from interfering with Elastic Endpoint functionality.
- [Allowlist Elastic Endpoint in third-party antivirus apps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/allowlist-elastic-endpoint-in-third-party-antivirus-apps): Add Elastic Endpoint's digital signatures and file paths to your antivirus software's allowlist to prevent conflicts.


## Performance and troubleshooting

Use these tools to diagnose issues, reduce resource usage, and understand how Elastic Defend collects event data.
- [Optimize Elastic Defend](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/optimize-elastic-defend): Resolve performance issues like excessive CPU usage, high storage consumption, or software incompatibilities by tuning endpoint artifacts and exceptions.
- [Automatic troubleshooting](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/automatic-troubleshooting): Identify and resolve common issues that could prevent Elastic Defend from working as intended, including policy response errors and third-party antivirus conflicts.
- [Event capture and Elastic Defend](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/manage-elastic-defend/event-capture-elastic-defend): Understand how Elastic Defend collects, aggregates, and deduplicates system event data to balance threat detection with storage and performance overhead.
- [Troubleshoot Elastic Defend](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/troubleshoot/security/elastic-defend): Resolve common issues such as Elastic Agent connectivity problems, policy failures, and malware prevention errors.


## Related pages

- [Configure endpoint protection with Elastic Defend](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/configure-elastic-defend): Install Elastic Defend and set up integration policies.
- [Endpoint response actions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5669/solutions/security/endpoint-response-actions): Isolate hosts, run commands, and take other response actions on protected endpoints.