Elastic Security
Ranked #3 of 12 for SIEM software: SIEM on Elasticsearch, billed per gigabyte ingested and retained.
Sebastiaan SmitsFounderSome vendors pay for placement on this site. This profile of Elastic Security is written by us, and vendor links are marked alike: disclosure.
Visit Elastic Security See it in the SIEM software ranking
At a glance
| Headquarters | Netherlands |
|---|---|
| Pricing model | Serverless billed per GB ingested and retained, published; self-managed option; trial offered |
| API | No API details for Elastic Security in our records |
| Deployment | Cloud or hosted |
| Best for | Teams with search skills that want per-gigabyte billing and a self-run exit |
| Free plan | None recorded |
What is Elastic Security?
Elastic Security is the security product of Elastic, the company behind Elasticsearch and Kibana (the site footer names elasticsearch B.V.). It combines SIEM, endpoint protection and, optionally, cloud posture and workload protection on top of the Elasticsearch data store. The vendor now frames it as an agentic security operations platform: detections arrive prebuilt, AI skills handle triage and threat hunting, and a workflow engine takes the response steps that older stacks hand to a separate SOAR tool.
You can run it as Elastic Cloud Serverless, on Elastic Cloud Hosted, or self-managed, including air-gapped sites. The serverless version bills by gigabytes ingested and retained instead of per endpoint. It targets security teams that already live in log search and want detection content, case handling and response in one place, without a per-device fee, and that are comfortable with Elastic's query language, ES|QL.
Elastic Security key features
- Prebuilt detections. When a new data source connects, the vendor says Elastic identifies the data type, maps the schema and recommends detection rules. The rules are written by Elastic Security Labs, mapped to MITRE ATT&CK, and published in a public repository where the community can review and suggest changes.
- Attack Discovery. Attack Discovery correlates alerts into prioritised attack narratives so an analyst starts from a story instead of a queue. The vendor cites California EDD as using it across 80,000 monthly events, a customer claim that we have not checked.
- Entity analytics. Every attribute change on a user or host is stored with a timestamp, risk scores update as context changes, and watchlists feed knowledge into scoring. Entity analytics and UEBA are part of the Complete tier only on the pricing page.
- Elastic Workflows. Native automation that combines scripted playbooks with AI reasoning, used to disable accounts, block IPs and isolate hosts after an analyst approves. The vendor positions it as replacing a separate SOAR licence. Serverless Complete includes 10,000 free executions.
- Federated search. Cross-cluster ES|QL queries cover cloud, on-premises and air-gapped deployments without moving the data, and frozen or long-term data can be searched in the same query as live data. This targets investigations that reach back months.
- Automatic Import and Migration. Automatic Import builds a custom integration from sample logs. Automatic Migration converts existing detection content, and the getting-started docs mention moving Splunk SPL rules to ES|QL. Both aim to cut the effort of leaving an older SIEM.
- Endpoint protection. Elastic Defend covers ransomware, memory and behavior prevention, and is included in both serverless tiers. Complete adds response actions, tamper protection and Device Control. Optional cloud packages add posture management and workload protection billed per asset.
Who Elastic Security suits
- A 12-person SOC replacing a per-endpoint SIEM. Teams that left hosts unmonitored to hold down per-device costs can compare ingest and retention rates instead. Since 23 March 2026 the serverless pages state that per-endpoint fees no longer apply, so adding laptops changes data volume, not licence count.
- An engineering group already running Elasticsearch for logs. The security solution runs on the same stack, so existing Kibana skills carry over. A self-managed install can start locally with the start-local script, and detection rules are open for review, which suits teams that want to read what runs against their data.
- A public-sector or defence team with data residency limits. The vendor says the platform deploys on-premises, in the cloud or in air-gapped environments, with on-premises LLMs supported for AI reasoning. Federated search lets sites keep data local while queries span clusters.
Getting started with Elastic Security
The docs recommend Elastic Security Serverless. New users start a free 14-day trial of Elastic Cloud, with all features included and no setup. Existing customers log in, choose Create project, select the Security panel, name the project, pick a feature tier, then choose a cloud provider and region; creation takes a few minutes and needs the admin role.
Next you add data through the integrations page, where hundreds of ready-made integrations are listed, or use Automatic Import for a source without one. A self-managed Docker install runs through a start-local curl command. Quickstart guides per use case follow the Get Started page. Expect to learn ES|QL for hunting.
Our verdict on Elastic Security
Elastic Security Serverless charges per GB ingested and per GB retained in two feature tiers, and since 23 March 2026 the per-endpoint fee no longer applies.
The repository licence includes an AGPL option, so you can run the code yourself, but then you size Elasticsearch and Kibana too. Entity analytics and the AI Assistant sit only in the dearer Complete tier, and egress beyond a 50 GB allowance is charged.
Elastic Security is entry #3 of 12 in the SIEM software list: it follows Graylog and comes before Exabeam. Top-three spots are set aside for challengers, and Elastic Security holds one of them; read it as a position, not a grade.
Home market: the Netherlands, one of 1 Europe bases among the 12 products here.
The case for and against Elastic Security
- Elastic Security Serverless charges per GB ingested and per GB retained in two feature tiers, and since 23 March 2026 the per-endpoint fee no longer applies.
- Marked in our records as self-managed option.
- Search-based is among the traits we single out for it.
- Strongest for: Teams with search skills that want per-gigabyte billing and a self-run exit.
- Per-GB billing, one of the three traits the catalogue lists for Elastic Security.
- Running the stack yourself means sizing Elasticsearch, while the serverless route bills ingest, retention and egress as three separate meters.
- Poor match for: Buyers who want a fixed annual price per organisation.
- Entity analytics, the AI Assistant and private connectivity sit only in the dearer Complete tier, so the entry rate understates what a full SOC needs.
- The repository licence includes an AGPL option, so you can run the code yourself, but then you size Elasticsearch and Kibana too.
Elastic Security pros and cons in practice
- Pricing is published per gigabyte with no per-endpoint fee, so coverage decisions follow data volume, which is easy to forecast from existing logs.
- Detection rules are open and mapped to MITRE ATT&CK, which lets a team inspect and adapt them instead of trusting a black box.
- The same product runs as serverless, hosted or self-managed, so a regulated team can keep data on its own hardware.
- Native workflows remove the need for a separate SOAR purchase for many response steps.
- Entity analytics, the AI Assistant and private connectivity sit only in the dearer Complete tier, so the headline entry rate does not cover them.
- Egress above 50 GB a month is charged at $0.05 per GB, which matters for teams that move a lot of data out.
- Hunting and tuning assume comfort with ES|QL and Elasticsearch concepts, so analysts from point-and-click tools face a learning curve.
- Self-managed use means you size and operate Elasticsearch and Kibana yourself.
Paying for Elastic Security
Pricing as recorded: Serverless billed per GB ingested and retained, published; self-managed option; trial offered.
Elastic Security Serverless has two tiers, shown in dollars. Security Analytics Essentials starts at $0.09 per ingested GB and $0.017 per retained GB per month. Complete starts at $0.11 per ingested GB and $0.019 per retained GB per month. Both give 50 GB of egress free, then $0.05 per GB. The page says prices take effect 1 November 2025 and per-endpoint fees stopped on 23 March 2026. Optional add-ons include Cloud Protection CSPM from $0.65 per asset per month, Cloud Workload Protection from $0.41 (Essentials) or $0.49 (Complete), Workflows from $0.0108 per execution after 10,000 free, and Elastic Managed LLM at $4.50 per million input tokens and $21 per million output tokens. Self-managed and hosted prices are not on this page.
Read from elastic.co/security when Best SIEM Software in 2026 was last reviewed (5 November 2026).
Elastic Security in practice
Elastic Security is the SIEM layer of the Elastic stack, sold as serverless projects, hosted deployments or self-managed software.
Elastic N.V.
Elastic Security: data and security
With serverless you choose the cloud provider and region when creating a project. The vendor says Elastic Cloud holds PCI DSS, HIPAA, FedRAMP, GDPR and TISAX certifications, with documents in its Trust Center.
Self-managed and air-gapped deployments keep data inside your own perimeter. Complete tier adds private connectivity and IP filtering. Data export formats are not described on the pages we read; the data lives in Elasticsearch, which has its own APIs.
Elastic Security integrations and ecosystem
Integrations the vendor names (12):
- AWS
- Microsoft Azure
- Google Cloud
- Kubernetes
- OpenTelemetry
- Splunk (rule migration)
- Claude (via MCP)
- Cursor (via MCP)
- VS Code (via MCP)
- GitHub Copilot (via MCP)
- Automatic Import (custom sources)
- Docker (local install)
Elastic Security in numbers and labels
| Product | Elastic Security |
|---|---|
| Vendor website | elastic.co/security |
| Head-to-head pages | 2 |
| Alternatives page | No dedicated page |
| Catalogue tags | Per-GB billing, Self-managed option, Search-based |
| Headquarters | Netherlands (Europe) |
| Not in our data | uptime history and customer numbers |
| Price visibility | A price or free offer is shown |
| Rank there | #3 of 12 |
| Primary guide | Best SIEM Software in 2026 |
Also ranked in
| Guide | Position |
|---|---|
| Best SIEM Software in 2026 | #3 of 12 |
Compare Elastic Security
- Elastic Security vs Splunk Enterprise Security: choose Elastic Security if you want published per-GB rates, you have search skills to run Elasticsearch yourself if needed, and you prefer a vendor with a Netherlands address.
- Elastic Security vs Wazuh: choose Elastic Security if you prefer per-GB billing, want prebuilt detection rules and endpoint protection in the entry tier, and like having both a serverless and a self-managed route.
What to look at instead of Elastic Security
These are the nearest neighbours of Elastic Security in the same list, picked on shared traits and price model.
- Wazuh (#1 of 12): Open source SIEM and XDR platform with no licence cost. Best for: Teams with Linux skills that want endpoint-centred detection without any licence fee.
- Exabeam (#4 of 12): Not for: buyers who need public prices before a first conversation. Cloud SIEM or on-premises LogRhythm, both sold through sales. (United States)
- Securonix (#5 of 12): Cloud SIEM that bundles UEBA, SOAR and threat intelligence together. Best for: Mid-size security teams that want UEBA and SOAR bundled rather than bought separately. (United States)
- Sumo Logic (#6 of 12): Log analytics vendor whose Cloud SIEM sits in the Enterprise Suite.
- Microsoft Sentinel (#9 of 12): Azure-native SIEM billed by ingestion, with a separate data lake tier. Best for: Organisations that already run workloads in Azure and use Microsoft security tools. (United States)
Elastic Security: questions
9 answersIs Elastic Security free, or what does it charge?
Our catalogue records Elastic Security’s pricing as: Serverless billed per GB ingested and retained, published; self-managed option; trial offered. On free access, nothing is free to use, as far as we recorded.
What else should I look at besides Elastic Security?
The closest products in the same guide are Wazuh, Exabeam, Securonix, Sumo Logic and Microsoft Sentinel. You will find each one reviewed in the SIEM software ranking.
Is Elastic Security one of the top SIEM software?
In our SIEM software list Elastic Security stands at place 3 of 12.
Who is Elastic Security best for?
Teams with search skills that want per-gigabyte billing and a self-run exit. Think twice if you are in this group: buyers who want a fixed annual price per organisation.
Which country is Elastic Security from?
The vendor is based in the Netherlands (Europe). Country here means the contracting company, which can differ from where servers run.
Does Elastic Security charge per endpoint?
Not any more on serverless. The pricing page states that as of 23 March 2026 per-endpoint fees no longer apply, and that ingest and retention charges still do. Endpoint protection (Elastic Defend) is now included in both feature tiers, with response actions only in Complete.
What is the difference between Essentials and Complete?
Essentials covers traditional SIEM: prebuilt rules, triage, hunting, threat intelligence integration and basic endpoint protection. Complete adds entity analytics and UEBA, threat intelligence management, the Elastic AI Assistant, advanced endpoint protection, workflow automation and private connectivity, at a higher per-gigabyte rate.
Can it run without the cloud?
Yes. The vendor says Elastic deploys on-premises, in the cloud or in air-gapped environments, and that AI reasoning can use on-premises LLMs. Self-managed users run Elasticsearch and Kibana themselves. A Docker-based local install is available through a start-local script.
How do I move from another SIEM?
Automatic Migration maps and converts existing detection content, and the docs say Splunk SPL rules can be migrated to ES|QL. Data arrives through integrations or Automatic Import. The vendor lists 400+ prebuilt integrations and says up to 1,000 sources are supported.
Elastic Security: sources
Read from the vendor’s own pages on 5 November 2026.
- elastic.co/pricing/serverless-security: tiers, per-GB rates, egress, add-ons, per-endpoint change
- elastic.co/security/siem: features, Workflows, federated search, certifications, deployment options, FAQ
- elastic.co/docs/solutions/security/get-started: serverless setup, 14-day trial, ingest steps, start-local, SPL migration
- elastic.co/security: product overview
- elastic.co/security/endpoint-security: endpoint protection scope
How we rank
We test for four things rather than for features: setup time, price in practice, exit and audience. That puts Elastic Security at #3 of 12. Read the editorial process for the method and where paid visibility fits in.