--- title: Elastic Security solution overview description: Elastic Security brings SIEM, endpoint protection, and cloud security together, with AI features that help you detect, investigate, and respond to threats. url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security products: - Elastic Cloud Serverless - Elastic Documentation - Elastic Security - Kibana applies_to: - Serverless Security projects: Generally available - Elastic Stack: Generally available --- # Elastic Security solution overview Elastic Security helps you detect, investigate, and respond to threats across your hosts, cloud services, and networks. It's built on Elasticsearch and Kibana, so you can search, correlate, and visualize your security data in one place. AI features help you get through alert volume, tune noisy rules, and migrate your detection content from another SIEM. ## Elastic Security capabilities Elastic Security has four main capabilities. You can use them together or start with one. ### SIEM Elastic Security collects security data from across your environment through hundreds of [integrations](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/get-started/ingest-data-to-elastic-security). It detects threats with Elastic-maintained prebuilt rules, your own rules, and machine learning. When alerts come in, you can triage and investigate them, and hunt for threats in Timeline and the visual event analyzer. Cases keep a record of each investigation, from the first alert to resolution. [Get started with SIEM →](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/get-started/get-started-detect-with-siem) ### Endpoint security Elastic Defend detects and prevents malware, ransomware, in-memory threats, and malicious behavior on Windows, macOS, and Linux hosts. It runs on the same Elastic Agent that collects your host data, so you deploy one agent for both. When you confirm an attack, you can contain it by isolating hosts and taking other response actions. You can also take response actions on hosts that run supported third-party EDR tools. [Get started with endpoint security →](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/get-started/get-started-endpoint-security) ### Cloud posture and vulnerability management Cloud security posture management (CSPM) and Kubernetes security posture management (KSPM) find misconfigurations in your cloud accounts and Kubernetes clusters by checking them against security benchmarks. A separate feature, cloud native vulnerability management (CNVM), scans your Linux VMs in AWS for known vulnerabilities. [Get started with cloud security posture management →](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/get-started/get-started-cloud-security) ### Cloud workload protection Elastic Defend also protects your Linux VMs while they run. It's the same integration that protects your other hosts, and it detects and prevents malware, memory threats, and malicious behavior. It also sends process, file, and network activity to Elastic Security, where prebuilt rules and machine learning can find threats in it. Elastic Cloud Serverless: Beta Elastic Stack: Beta since 9.3 For Kubernetes containers, Defend for Containers alerts on drift and can block process and file operations that match your policy. [Learn more about cloud workload protection →](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/manage/manage-cloud-workload-protection) ## AI in Elastic Security Elastic Security also includes AI features that use large language models (LLMs). Depending on your deployment and license, you can use Elastic Managed LLMs through the [Elastic Inference Service (EIS)](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/explore-analyze/elastic-inference/eis) or an LLM from another provider. With AI features, you can: - **Migrate from another SIEM:** [Automatic Migration](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/get-started/automatic-migration) translates your existing detection rules and dashboards into Elastic Security, so you don't rebuild your detection content by hand. Supported SIEMs and asset types vary by deployment type and version. Elastic Cloud Serverless: Generally available Elastic Stack: Generally available since 9.1, Elastic Stack: Preview in 9.0 - **Bring in data that has no integration:** [Automatic Import](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/explore-analyze/ai-features/automatic-import) builds a custom integration from a sample of your logs. - **Write and tune detection rules:** [Security skills](/elastic/docs-content/pull/9157/explore-analyze/ai-features/agent-builder/builtin-skills-reference#security-skills) in Elastic Agent Builder draft ES|QL rules from a plain-language description of what you want to detect. Depending on your version, they also suggest prebuilt rules for the integrations you already have, and find out why a rule is noisy. Elastic Cloud Serverless: Generally available Elastic Stack: Generally available since 9.4 - **Get through alert volume:** [Attack Discovery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/ai/attack-discovery) groups related alerts into attacks and maps them to MITRE ATT&CK®, so you triage one attack instead of each alert in it. - **Investigate and respond:** [Elastic Agent Builder](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/ai/agent-builder/agent-builder) answers questions about your alerts and data, and writes ES|QL queries for you. With [Workflows](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/explore-analyze/workflows), custom agents can also isolate hosts, create cases, and send notifications, so you can automate routine response steps. Elastic Cloud Serverless: Generally available Elastic Stack: Generally available since 9.4, Elastic Stack: Preview in 9.3 - **Keep endpoint protection working:** [Automatic Troubleshooting](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/manage-elastic-defend/automatic-troubleshooting) finds issues that stop Elastic Defend from protecting your hosts, such as conflicts with third-party antivirus software. Elastic Cloud Serverless: Generally available Elastic Stack: Generally available since 9.2, Elastic Stack: Preview from 9.0 to 9.1 To add AI triage without replacing your current SIEM or EDR/XDR platform, use an [Elastic AI SOC Engine (EASE)](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/ai/ease/ease-intro) project. It runs Attack Discovery, Elastic Agent Builder, and cases on the alerts from that platform. [Learn more about AI in Elastic Security →](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/ai) ## Start using Elastic Security To try Elastic Security, [start a free trial](https://cloud.elastic.co/serverless-registration). The features available to your team depend on how you run it. In Elastic Security Serverless, the Security Analytics [feature tiers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/security-serverless-feature-tiers) include SIEM, with add-ons for endpoint and cloud protection. In Elastic Stack deployments, features depend on your [subscription](https://www.elastic.co/pricing). If you run Elastic Security for several customers or teams, you can keep each one's rules, alerts, and cases separate in its own [space](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/get-started/spaces-elastic-security). To detect threats in data stored elsewhere, detection rules can query other clusters with [cross-cluster search](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/detect-and-alert/cross-cluster-search-detection-rules) in Elastic Stack deployments, or other projects with [cross-project search](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/detect-and-alert/cross-project-search-detection-rules) in Serverless. For a guided walkthrough of one area, use a [quickstart](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/get-started/quickstarts). [Get started with Elastic Security →](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/get-started) ## Related reference - [Elastic Security reference documentation](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/reference/security) - [Elastic Security API documentation](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/apis) - [Fleet and Elastic Agent](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/reference/fleet) - [Elastic Security release notes](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/release-notes/elastic-security)