AI-driven security analytics for threat detection and response
Grade: C — Score: 60/100
Elastic Security combines SIEM, endpoint security, and native automation in one open security operations platform. Agents work across the full lifecycle from ingestion through response, with a unified data model and one query language.
The workflow is designed to reduce tool fragmentation and preserve context across detection, investigation, and response. Attack Discovery correlates alerts into attack chains, while analysts can set confidence thresholds, review evidence-backed findings, and approve decisions. The platform also includes built-in SOAR automation, proactive threat hunting, and open detection rules.
Key risks called out on the page include tool fragmentation, the need for an audit trail for agent decisions, and the inability to wait for archived data to rehydrate during incidents. The page also notes that AI agents can create volume and velocity challenges during attacks.
Elastic Security on Elastic Cloud Serverless: Usage-based pricing, pay as you go monthly or prepaid
Elastic Security on Elastic Cloud Hosted: Resource-based pricing, pay as you go monthly or prepaid
Elastic Security Self-managed: License-based pricing based on number of nodes and used RAM
Yes. Elastic Security runs across cloud, on-premises, hybrid, and air-gapped environments without requiring data to move to a vendor cloud. If you want to keep deployment control yourself, the self-managed option is the clearest fit because it is licensed by nodes and used RAM.
Elastic Security is priced on compute and storage, not per endpoint. The cloud options use usage-based or resource-based pricing with pay as you go monthly or prepaid, while self-managed uses license-based pricing based on number of nodes and used RAM. Elastic also says pricing details depend on your environment, so there is no public per-endpoint SIEM amount on the reviewed pages.
Yes. Elastic Security includes SIEM, endpoint security, and native automation in one platform. Elastic Defend protects Linux, macOS, and Windows, and the documentation says it can work offline with behavioral protections.
Yes. Elastic Security includes native automation for alert triage, enrichment, and response. When an analyst approves, the platform can disable accounts, block IPs, and isolate hosts.
Yes. Elastic Security says it has over 400 open detection rules that are continuously tuned and available on GitHub. The platform also emphasizes transparent reasoning, so analysts can see how conclusions were reached rather than treating detections as a black box.
Yes. Elastic Security says every integration normalizes your data and includes prebuilt dashboards, so your team can investigate a new source without writing parsers. That makes onboarding new sources faster, although the exact integration coverage still depends on the source you connect.
Yes. Elastic Security supports using your data with the LLM of your choice, including frontier or on-premise models. The vendor also says AI-driven features show their reasoning instead of operating as a black box.
Elastic Security's privacy statement says you can request portability of personal data in a structured, commonly used, machine-readable format and request deletion of personal data held by Elastic. It also says Elastic retains information collected in connection with the properties for as long as necessary for the stated purposes or another ongoing legitimate business need. The vendor separately says it does not use or allow personal data to train any generative AI model.