Fixed Priced Deliverable

Security Review: Basic, Standard, and Advanced

Basic

Overview

A fixed-price, time-boxed expert assessment of one (1) Elastic Security SIEM deployment on Elastic Cloud Hosted (ECH) or Serverless. Elastic consultants benchmark the customer's current security operations — evaluating platform health, data quality, detection rule performance, and supporting components — and deliver a findings report with prioritized, actionable recommendations. This engagement is limited to one (1) cluster. Additional clusters or deployments are expressly out of scope unless otherwise agreed in a mutually executed change order.

Scope

  • Health Check Scoping & Planning — finalize review areas and prioritize based on pain points
  • Platform & Infrastructure Review — cluster configuration, alert index schema, asset customizations, RBAC, Kibana high availability, topology, node sizing, and ingest architecture
  • Data Ingestion & Quality Validation — ECS compliance, rule-field gap analysis, ingestion coverage and quality
  • Rule Performance & Tuning Analysis — identification of worst-performing and noisiest rules, assessment of suppression and exception opportunities
  • Review of Supporting Components — Data Enrichment, Threat Intelligence Platform, SIEM Backup/Restore procedures, and RBAC configuration
  • Health Check Report Generation — comprehensive findings report with prioritized, actionable recommendations
  • Knowledge Transfer Workshop — interactive session for the customer's security team covering findings and recommendations

Out of scope

This engagement does not include:

  • Review of more than one (1) Elastic Security cluster or deployment
  • Self-managed deployments (including ECK and ECE) — see Advanced tier
  • Serverless deployments not running SIEM
  • XDR / Elastic Defend endpoint review — see Standard or Advanced tier
  • Machine learning job review — see Advanced tier
  • Risk score or AI Assistant validation — see Advanced tier
  • Active remediation, configuration changes, or implementation of recommendations
  • Ongoing managed services, post-engagement monitoring, or support
  • Custom detection rule development

Any work outside the scope above requires a mutually executed change order and may result in additional fees, revised assumptions, and schedule changes.

Engagement timeline

  • Scheduled to commence approximately 6–8 weeks after purchase, subject to resource availability and Customer readiness
  • Delivered by an Elastic Consultant or a certified partner resource under Elastic oversight
  • Unless otherwise agreed in writing, the services will be delivered remotely
  • Delivery is expected to occur over contiguous business days or contiguous calendar weeks, as scheduled by Elastic
  • If delivery is delayed, interrupted, or rescheduled due to Customer availability, access issues, environment readiness, or other Customer dependencies, Elastic may reassign resources, adjust the schedule, or require an Order Form (change order)
  • Time scheduled for the engagement that cannot be used due to Customer delay, unavailability, failure to meet dependencies, or inability to provide required access will count against the total consulting days

Fixed-price conditions and assumptions

  • Customer provides read-only access to cluster management APIs and Kibana before the kickoff call
  • Customer designates a single point of contact and ensures appropriate technical stakeholders are available and responsive throughout the engagement
  • Customer provides information on custom log sources, parsing configurations, and Threat Intelligence feed details upon request
  • Customer reviews and approves technical documentation produced during the engagement
  • Engagement covers one (1) SIEM cluster on ECH or Serverless; additional clusters require a change order
  • No active remediation or configuration changes are included in this scope; recommendations are delivered in writing

If any of the above assumptions are not met, Elastic may adjust the schedule, limit the services performed to fit the fixed-price scope, count impacted time against the allocated consulting days, or require a change order.

Deliverables

  • Health Check Scoping & Planning output (areas of review confirmed and prioritized)
  • Platform & Infrastructure Review findings
  • Data Ingestion & Quality Validation findings
  • Rule Performance & Tuning Analysis findings
  • Supporting Components Review findings
  • Health Check Report with prioritized, actionable recommendations
  • Knowledge Transfer Workshop (interactive session)

Completion

The engagement will be considered complete upon delivery of the Engagement Report and completion of the Knowledge Transfer Workshop. The engagement may also be deemed complete if Customer delays, is unavailable, fails to meet required dependencies, or is otherwise unable to participate after Elastic has made commercially reasonable efforts to schedule and deliver the services within the agreed scope.

General terms

Capitalized terms used but not defined in this package description have the meanings given to them in the Order Form, the applicable Service Description, or the Elastic Services Agreement.

No formal Customer signoff and no milestone or deliverable acceptance process applies to this fixed-price Services Package. Each Service is deemed accepted upon Completion.

"Completion" means, with respect to a Service, the point at which Elastic has performed the activities within the scope of this Services Package, including (where applicable) delivery of any written report, materials, or knowledge transfer session described in this package's scope, or the expiry of the time-boxed engagement period for this package, whichever occurs first. Completion does not require Customer signoff or acceptance of any deliverable.

Customer is solely responsible for the backup, maintenance, and security of its environment, systems, and data. Elastic is not responsible for any configuration changes, data loss, downtime, or other impact to Customer's environment arising from or in connection with the Service.

This engagement delivers a configured net-new, self-managed Elastic document search solution, including search use case analysis, data modeling and ingestion, advanced example query implementation, advanced RBAC configuration, infrastructure provisioning, and a final report, within the defined fixed-price scope. Elastic does not guarantee any specific performance, cost, operational, or business outcome beyond the deliverables defined above. Customer remains solely responsible for ongoing operations, configuration changes made outside the engagement scope, and all post-engagement activities related to its environment.

References in this package to validation, testing, acceptance tests or acceptance test harnesses, golden queries, launch readiness, or go-live describe activities performed, demonstrated, or delivered by Elastic and do not create any Customer acceptance, signoff, testing, or payment condition. Completion occurs as defined in this package regardless of any such activity, and no portion of the fees is withheld or deferred pending any test result, validation, or go-live event.

Standard

Overview

A fixed-price, time-boxed expert assessment of one (1) Elastic Security SIEM + EDR deployment on Elastic Cloud Hosted (ECH) or Serverless. In addition to the full Basic scope, this tier includes review of Elastic Defend endpoint integration and policies, and host inspection and response actions. Elastic consultants deliver a findings report with prioritized, actionable recommendations across all reviewed areas. This engagement is limited to one (1) cluster. Additional clusters or deployments are expressly out of scope unless otherwise agreed in a mutually executed change order.

Scope

  • Health Check Scoping & Planning — finalize review areas and prioritize based on pain points
  • Platform & Infrastructure Review — cluster configuration, alert index schema, asset customizations, RBAC, Kibana high availability, topology, node sizing, and ingest architecture
  • Data Ingestion & Quality Validation — ECS compliance, rule-field gap analysis, ingestion coverage and quality
  • Rule Performance & Tuning Analysis — identification of worst-performing and noisiest rules, assessment of suppression and exception opportunities
  • Review of Supporting Components — Data Enrichment, Threat Intelligence Platform, SIEM Backup/Restore procedures, and RBAC configuration
  • Health Check Report Generation — comprehensive findings report with prioritized, actionable recommendations
  • Knowledge Transfer Workshop — interactive session for the customer's security team covering findings and recommendations
  • Elastic Defend Integration & Policy Review — assessment of endpoint protection policies against malware, ransomware, and memory threats
  • Host Inspection & Response Actions Review — evaluation of Osquery for host inspection and review of host isolation and response action configuration

Out of scope

This engagement does not include:

  • Review of more than one (1) Elastic Security cluster or deployment
  • Self-managed deployments (including ECK and ECE) — see Advanced tier
  • Machine learning job review — see Advanced tier
  • Risk score or AI Assistant validation — see Advanced tier
  • Active remediation, configuration changes, or implementation of recommendations
  • Ongoing managed services, post-engagement monitoring, or support
  • Custom detection rule development

Any work outside the scope above requires a mutually executed change order and may result in additional fees, revised assumptions, and schedule changes.

Engagement timeline

  • Scheduled to commence approximately 6–8 weeks after purchase, subject to resource availability and Customer readiness
  • Delivered by an Elastic Consultant or a certified partner resource under Elastic oversight
  • Unless otherwise agreed in writing, the services will be delivered remotely
  • Delivery is expected to occur over contiguous business days or contiguous calendar weeks, as scheduled by Elastic
  • If delivery is delayed, interrupted, or rescheduled due to Customer availability, access issues, environment readiness, or other Customer dependencies, Elastic may reassign resources, adjust the schedule, or require an Order Form (change order)
  • Time scheduled for the engagement that cannot be used due to Customer delay, unavailability, failure to meet dependencies, or inability to provide required access will count against the total consulting days

Fixed-price conditions and assumptions

  • Customer provides read-only access to cluster management APIs and Kibana before the kickoff call
  • Customer provides access to Elastic Defend policies and endpoint configurations upon request
  • Customer designates a single point of contact and ensures appropriate technical stakeholders are available and responsive throughout the engagement
  • Customer provides information on custom log sources, parsing configurations, and Threat Intelligence feed details upon request
  • Customer reviews and approves technical documentation produced during the engagement
  • Engagement covers one (1) SIEM + EDR cluster on ECH or Serverless; additional clusters require a change order
  • No active remediation or configuration changes are included in this scope

If any of the above assumptions are not met, Elastic may adjust the schedule, limit the services performed to fit the fixed-price scope, count impacted time against the allocated consulting days, or require a change order.

Deliverables

  • Health Check Scoping & Planning output
  • Platform & Infrastructure Review findings
  • Data Ingestion & Quality Validation findings
  • Rule Performance & Tuning Analysis findings
  • Elastic Defend Integration & Policy Review findings
  • Host Inspection & Response Actions Review findings
  • Supporting Components Review findings
  • Health Check Report with prioritized, actionable recommendations
  • Knowledge Transfer Workshop (interactive session)

Completion

The engagement will be considered complete upon delivery of the Engagement Report and completion of the Knowledge Transfer Workshop. The engagement may also be deemed complete if Customer delays, is unavailable, fails to meet required dependencies, or is otherwise unable to participate after Elastic has made commercially reasonable efforts to schedule and deliver the services within the agreed scope.

General terms

Capitalized terms used but not defined in this package description have the meanings given to them in the Order Form, the applicable Service Description, or the Elastic Services Agreement.

No formal Customer signoff and no milestone or deliverable acceptance process applies to this fixed-price Services Package. Each Service is deemed accepted upon Completion.

"Completion" means, with respect to a Service, the point at which Elastic has performed the activities within the scope of this Services Package, including (where applicable) delivery of any written report, materials, or knowledge transfer session described in this package's scope, or the expiry of the time-boxed engagement period for this package, whichever occurs first. Completion does not require Customer signoff or acceptance of any deliverable.

Customer is solely responsible for the backup, maintenance, and security of its environment, systems, and data. Elastic is not responsible for any configuration changes, data loss, downtime, or other impact to Customer's environment arising from or in connection with the Service.

This engagement delivers a configured net-new, self-managed Elastic document search solution, including search use case analysis, data modeling and ingestion, advanced example query implementation, advanced RBAC configuration, infrastructure provisioning, and a final report, within the defined fixed-price scope. Elastic does not guarantee any specific performance, cost, operational, or business outcome beyond the deliverables defined above. Customer remains solely responsible for ongoing operations, configuration changes made outside the engagement scope, and all post-engagement activities related to its environment.

References in this package to validation, testing, acceptance tests or acceptance test harnesses, golden queries, launch readiness, or go-live describe activities performed, demonstrated, or delivered by Elastic and do not create any Customer acceptance, signoff, testing, or payment condition. Completion occurs as defined in this package regardless of any such activity, and no portion of the fees is withheld or deferred pending any test result, validation, or go-live event.

Advanced

Overview

A fixed-price, time-boxed expert assessment of one (1) Elastic Security SIEM, EDR, and ML deployment on a self-managed platform (including ECK). In addition to the full Standard scope, this tier includes machine learning job review and configuration, and risk score and AI Assistant validation. Elastic consultants deliver a findings report with prioritized, actionable recommendations across all reviewed areas. This engagement is limited to one (1) cluster. Additional clusters or deployments are expressly out of scope unless otherwise agreed in a mutually executed change order.

Scope

  • Health Check Scoping & Planning — finalize review areas and prioritize based on pain points
  • Platform & Infrastructure Review — cluster configuration, alert index schema, asset customizations, RBAC, Kibana high availability, topology, node sizing, and ingest architecture
  • Data Ingestion & Quality Validation — ECS compliance, rule-field gap analysis, ingestion coverage and quality
  • Rule Performance & Tuning Analysis — identification of worst-performing and noisiest rules, assessment of suppression and exception opportunities
  • Review of Supporting Components — Data Enrichment, Threat Intelligence Platform, SIEM Backup/Restore procedures, and RBAC configuration
  • Health Check Report Generation — comprehensive findings report with prioritized, actionable recommendations
  • Knowledge Transfer Workshop — interactive session for the customer's security team covering findings and recommendations
  • Elastic Defend Integration & Policy Review — assessment of endpoint protection policies against malware, ransomware, and memory threats
  • Host Inspection & Response Actions Review — evaluation of Osquery for host inspection and review of host isolation and response action configuration
  • ML Job Review & Configuration — review of prebuilt security ML jobs; assessment of custom jobs for data exfiltration, DGA detection, and lateral movement
  • Risk Score & AI Assistant Validation — verification of entity and asset risk scoring configuration; confirmation of AI Assistant setup for attack detection and threat discovery

Out of scope

This engagement does not include:

  • Review of more than one (1) Elastic Security cluster or deployment
  • ECH or Serverless deployments — see Basic or Standard tier
  • Active remediation, configuration changes, or implementation of recommendations
  • Custom ML model development
  • Ongoing managed services, post-engagement monitoring, or support
  • Custom detection rule development

Any work outside the scope above requires a mutually executed change order and may result in additional fees, revised assumptions, and schedule changes.

Engagement timeline

  • Scheduled to commence approximately 6–8 weeks after purchase, subject to resource availability and Customer readiness
  • Delivered by an Elastic Consultant or a certified partner resource under Elastic oversight
  • Unless otherwise agreed in writing, the services will be delivered remotely
  • Delivery is expected to occur over contiguous business days or contiguous calendar weeks, as scheduled by Elastic
  • If delivery is delayed, interrupted, or rescheduled due to Customer availability, access issues, environment readiness, or other Customer dependencies, Elastic may reassign resources, adjust the schedule, or require an Order Form (change order)
  • Time scheduled for the engagement that cannot be used due to Customer delay, unavailability, failure to meet dependencies, or inability to provide required access will count against the total consulting days

Fixed-price conditions and assumptions

  • Customer provides read-only access to cluster management APIs and Kibana before the kickoff call
  • Customer provides access to Elastic Defend policies, endpoint configurations, and ML job configurations upon request
  • Customer provides details on specific anomalous behaviors to monitor for custom ML jobs
  • Customer designates a single point of contact and ensures appropriate technical stakeholders are available and responsive throughout the engagement
  • Customer reviews and approves technical documentation produced during the engagement
  • Engagement covers one (1) self-managed SIEM + EDR + ML cluster; additional clusters require a change order
  • No active remediation or configuration changes are included in this scope

If any of the above assumptions are not met, Elastic may adjust the schedule, limit the services performed to fit the fixed-price scope, count impacted time against the allocated consulting days, or require a change order.

Deliverables

  • Health Check Scoping & Planning output
  • Platform & Infrastructure Review findings
  • Data Ingestion & Quality Validation findings
  • Rule Performance & Tuning Analysis findings
  • Elastic Defend Integration & Policy Review findings
  • Host Inspection & Response Actions Review findings
  • ML Job Review & Configuration findings
  • Risk Score & AI Assistant Validation findings
  • Supporting Components Review findings
  • Health Check Report with prioritized, actionable recommendations
  • Knowledge Transfer Workshop (interactive session)

Completion

The engagement will be considered complete upon delivery of the Engagement Report and completion of the Knowledge Transfer Workshop. The engagement may also be deemed complete if Customer delays, is unavailable, fails to meet required dependencies, or is otherwise unable to participate after Elastic has made commercially reasonable efforts to schedule and deliver the services within the agreed scope.

General terms

Capitalized terms used but not defined in this package description have the meanings given to them in the Order Form, the applicable Service Description, or the Elastic Services Agreement.

No formal Customer signoff and no milestone or deliverable acceptance process applies to this fixed-price Services Package. Each Service is deemed accepted upon Completion.

"Completion" means, with respect to a Service, the point at which Elastic has performed the activities within the scope of this Services Package, including (where applicable) delivery of any written report, materials, or knowledge transfer session described in this package's scope, or the expiry of the time-boxed engagement period for this package, whichever occurs first. Completion does not require Customer signoff or acceptance of any deliverable.

Customer is solely responsible for the backup, maintenance, and security of its environment, systems, and data. Elastic is not responsible for any configuration changes, data loss, downtime, or other impact to Customer's environment arising from or in connection with the Service.

This engagement delivers a configured net-new, self-managed Elastic document search solution, including search use case analysis, data modeling and ingestion, advanced example query implementation, advanced RBAC configuration, infrastructure provisioning, and a final report, within the defined fixed-price scope. Elastic does not guarantee any specific performance, cost, operational, or business outcome beyond the deliverables defined above. Customer remains solely responsible for ongoing operations, configuration changes made outside the engagement scope, and all post-engagement activities related to its environment.

References in this package to validation, testing, acceptance tests or acceptance test harnesses, golden queries, launch readiness, or go-live describe activities performed, demonstrated, or delivered by Elastic and do not create any Customer acceptance, signoff, testing, or payment condition. Completion occurs as defined in this package regardless of any such activity, and no portion of the fees is withheld or deferred pending any test result, validation, or go-live event.