What it does
Elastic Security combines SIEM, endpoint-security and automation capabilities within a shared security-operations platform.
Elastic Security is relevant when investigations need to search security events and endpoint information together. Its current page describes a shared data model and query language across those workflows. Decide what evidence must be retained and which analyst will act on it before collecting more sources. The reviewed page labels the AlertZero agentic layer as coming soon, so it should not be treated as a delivered feature in an evaluation of today's investigation workflow.
Strengths
- SIEM and endpoint workflows in a shared platform
Watch out for
- The reviewed page labels AlertZero as coming soon
Best for
- Security teams correlating event and endpoint evidence