Elastic Security: Detect and respond to threats with SIEM

Learn how Elastic Security helps you protect your organization by unifying SIEM, endpoint, and cloud security.

Experience Elastic Security for yourself with this interactive demo.

Get started with a 14-day trial. Create an account on cloud.elastic.co and create a deployment.

Choose a Cloud provider and then a Region. Make sure to select a Hardware profile of Storage optimized or Storage optimized (dense)

Open Advanced settings to optimize your cluster for security use cases.

After selecting these settings, click Create deployment

Once your deployment is ready, under the Security tab, select Detect threats in my data with SIEM and then Start.

You'll be brought to the integration overview for Elastic Defend, which (together with the System integration) equips Elastic Agent to collect rich host data. Get started with this guided tour or follow the instructions below:

Select Add Elastic Defend. You'll be prompted to install Elastic Agent on a host.

Click Install Elastic Agent, select the appropriate operating system, and run the commands to install and start Elastic Agent on your host.

Once you've installed Elastic Agent, the page will confirm that it has been enrolled successfully.

On the following page, select the Confirm incoming data button.

You'll see a preview of incoming data. Select View Assets.

You'll see a list of the assets that are included with the  Elastic Defend integration.

From here, navigate to Management and select Integrations, where you can discover and install integrations with other data sources to centralize within your SIEM.

Let’s start exploring what’s happening in your environment. After installing Elastic Defend you’ll be brought to the page below. Expand the upper-left menu and navigate to Dashboards under Security.

Next, open the Security overview page to take a broad view of your environment. You can also visualize system data in Host view, explore network data in Network view, and more.

Next, activate out-of-the-box detection rules:

• Install and manage prebuilt rules

• Manage detection rules

• View Detection and Response dashboard

Perform investigations — from triaging alerts to closing cases — with the following resources:

• View alert details

• Incorporate threat intelligence

• Open and manage cases

• Invoke response actions on an endpoint

• Connect workflows with third-party systems

For guidance with investigating and responding to threats, configure Elastic AI Assistant.

• Elastic Security Labs
• Threat hunting guide
• Guide to high-volume data sources for SIEM