Elastic Security Reviews

Pros

Using Elastic Security for security monitoring has been a really positive experience. The centralized logs and ECS capabilities are extremely valuable and tools like Timeline and Cases help a lot when managing security-related details more efficiently. Getting Elastic Security up and running in the beginning was fairly straightforward which was very convenient.

Cons

One small annoyance is in Timeline: you can't drag columns to rearrange them. Instead, you have to right-click and choose "move to the left" repeatedly in some cases.

Pros

Elastic Security has been an excellent product for our team especially because the AI integrations help analysts ask questions naturally and build queries much faster during investigations. The wide range of out-of-the-box integrations and connectors for ingesting logs and creating alerts has also been a big plus and we're able to build custom alerts that align with different security framework requirements without much trouble. The threat visualization features are fantastic for getting quick insight into what's happening and for showing leadership the value of the platform. Another feature I really appreciate is the case management capability which lets us connect multiple alerts to one case and review the full chain of events in a timeline view. That makes it a very capable platform for our security team. Getting started went well too, largely because of the Elastic serverless platform and Elastic's professional services team was extremely supportive throughout the setup. On top of that, the Slack and PagerDuty connectors help us stay informed and ready to escalate staffing quickly when critical alerts come in. Overall, Elastic Security has been dependable, fits our needs well and I'd absolutely recommend it.

Cons

We have come across a few minor bugs in the platform but the support team has been very responsive in helping triage the issues and push out fixes. In a few instances, those fixes were deployed within hours.

Pros

Being able to turn raw data into actionable intelligence is one of the biggest benefits I've seen with Elastic Security. We rely on it to build dashboards that keep track of our security posture, attack surface and overall threat landscape. The integration with our incident management system works seamlessly, the setup was simple and straightforward and it has helped our team handle investigations much more efficiently.

Cons

Building sequencing rules when multiple events need to happen in a specific order within a certain time frame is one area that's still challenging.

Pros

Managing alerts is very straightforward. The alerts panel gives you all the details you need for a security investigation and the cases feature lets you build your own alert database.

Cons

At times, loading can be slow and copying fields and values from timelines is difficult.

Pros

From the start Elastic Security delivers strong detection capabilities and deep visibility across endpoints and logs and it still feels fairly approachable once you get the hang of the workflows. Deployment goes very well in environments that already use the Elastic stack and the integrations with existing tools are flexible and clearly documented. Threat detection hunting and response come with a broad feature set and it scales effectively for SOC operations. Support from both the vendor and the user community is dependable so troubleshooting is usually manageable. In use it's a feature-rich platform we rely on often and it does a good job of balancing advanced functionality with practical everyday usability.

Cons

Getting started can be challenging especially when it comes to tuning detections and handling more advanced features without previous experience with Elastic.

Pros

Choosing Elastic Security came down mostly to how helpful the prebuilt security use cases are. Ready to use right away they are which adds a lot of value from the start.

Cons

On the flip side, when migrating from another tool, there's a learning curve around some of the specifics. For example, IP addresses can be stored in multiple fields so they can be searched either as plain text or with regex.

Pros

One of the strongest parts of Elastic is the wide collection of prebuilt rules that Elastic provides out of the box.

Cons

Another big plus is how straightforward the parsing and mapping are to understand and put in place especially when there's already an integration available for the technology you want to monitor.

Pros

Having EDR capabilities combined with K8 support and SIEM in one platform is a big plus. It gives great visibility and brings the key security features together in a really useful way.

Cons

The downside is the Elastic Agent can be problematic at times. It occasionally shows up as unhealthy or ends up blocking business actions which can be disruptive.

Pros

Its flexibility really stands out and the preconfigured rules save time. The integrated case management is also very useful for sharing information across the team.

Cons

There's definitely a learning curve at the beginning. Running it on-prem also means dealing with a pretty large, heavy and fairly complex infrastructure to maintain.

Pros

Flexibility and depth across SIEM endpoint and observability all within one platform is what Elastic Security in place gives us. Bringing in just about any data source mapping it to ECS and creating detections that match the way our environment actually operates instead of reshaping our workflows around a rigid tool is what we're able to do. Making it especially valuable for real SOC work and more complex environments is that level of visibility correlation and customization.

Cons

Learning Elastic Security can take time and comes with operational effort especially for teams that are new to the Elastic Stack. To really get strong value from it you need strong knowledge of ECS ingest pipelines and cluster tuning and some advanced use cases still require quite a bit of manual setup. The flexibility is a big strength but without experienced people or thoughtful planning up front it can also feel overwhelming.