Elastic Security combines the features of a security information and event management (SIEM) system with endpoint protection, allowing organizations to detect, investigate, and respond to threats in real time. This unified approach helps reduce complexity and improve the efficiency of security operations.
| Type | Title | Date | |
|---|---|---|---|
| Category | Log Management | Jun 3, 2025 | Download |
| Product | Reviews, tips, and advice from real users | Jun 3, 2025 | Download |
| Comparison | Elastic Security vs Wazuh | Jun 3, 2025 | Download |
| Comparison | Elastic Security vs Splunk Enterprise Security | Jun 3, 2025 | Download |
| Comparison | Elastic Security vs Datadog | Jun 3, 2025 | Download |
| Title | Rating | Mindshare | Recommending | |
|---|---|---|---|---|
| CrowdStrike Falcon | 4.3 | N/A | 96% | 132 interviewsAdd to research |
| Microsoft Defender for Endpoint | 4.1 | N/A | 94% | 197 interviewsAdd to research |
Additional offerings and benefits:
Finally, Elastic Security benefits from a global community of users who contribute to its threat intelligence, helping to enhance its detection capabilities. This collaborative approach ensures that the solution remains on the cutting edge of cybersecurity, with up-to-date information on the latest threats and vulnerabilities.
Elastic Security was previously known as Elastic SIEM, ELK Logstash.
Texas A&M, U.S. Air Force, NuScale Power, Martin's Point Health Care
Our primary use case of this solution is for application performance monitoring. We are customers of ELK.
This solution enables us to monitor application performance from Elasticsearch and we can predict some behaviors for applications using ELK. This product is distributed and scalable which is good for us.
The troubleshooting or diagnostic tool can be improved to provide a better understanding of internal behavior and how data is stored. It would also be helpful if they were to release the next version as a plugin or an extension, or as a JAR file, for the latest features. When releasing a new version they currently provide a new stack which means everything needs to be removed before the new version is installed.
I've been using this solution for five years.
The solution is generally stable, although with each new upgrade there is an adjustment period. They upgrade versions very regularly and it's hard to keep up. By the time my environment is stable with the previous versions, they are already bringing out a new version.
Scalability is very good with this product.
I'm not satisfied with technical support because whenever you raise a case, it goes to some random support person who asks questions about the architecture. It's a waste of time. I'm a platinum customer so each time I raise a request, it should go to a dedicated customer support representative who knows my case. It's very difficult when you work in a highly secure environment to get all the logs and send the logs to them each time.
The initial setup is easy, but as you begin using the more advanced features like security and authentication with an AM and LM, then it becomes a bit tricky.
Licensing costs are high, they charge based on the nodes and the RAM. If I purchase a license for a 64GB RAM node and then want to have 128GB RAM, I can't because it's not in the contract so I have to pay on top of that. They removed a feature that allows me to provide multiple disks for one node so if I now want to add an extra disk to the volume, I have to buy a license for one extra node. It's very unfair.
I would recommend this solution for an organization that doesn't require a highly secured environment, because they'll have to deal with the issues of VM upgrades and installations. If it's a highly secured environment like a bank, then I suggest ELK cloud instead of on-prem.
I rate this solution a seven out of 10.
