Elastic Security

Elastic Security scores 7.60 of 10, second of the 12 profiled, in band A with Microsoft Sentinel. It pairs a detection-rules repository with a CLI, a Rule Monitoring tab, a History view from Elastic Stack 9.5, and a monthly noise and performance score for prebuilt rules. Coverage and testing detail are thinner.

Rubric total

7.60 of 10, second of 14 scored, second of 12 profiled

Matrix score

16.5 of 33 (11 documented, 11 partial, 11 not documented)

Rule health

2 documented, 2 partial of 5 matrix rule-health columns

Ownership

Public company, Elastic N.V. (NYSE: ESTC). Ownership checked on 2026-11-03: no acquisition or rename of Elastic Security found in the vendor newsroom or one news search. Deductive AI completion appears in an aggregator headline for Observability, not Security (unverified, see gaps). sec.gov read 2026-11-03

Website

elastic.co

What Elastic Security is

Elastic Security is a SIEM with endpoint protection, built on Elasticsearch. Detection rules come in rule types that include custom query (KQL or Lucene), event correlation (EQL) and ES|QL (Elastic docs, read 2026-11-03). The public detection-rules repository keeps rules as TOML files and is licensed under the Elastic License v2, which is source-available rather than OSI open source (GitHub, read 2026-11-03).

Elastic calls the repository workflow detections as code and documents it in a separate DaC reference. The CLI is named detection_rules and talks to Kibana through the Detection Engine API. Rule monitoring is a tab on each rule, and the History view needs Elastic Stack 9.5 or later (Elastic docs, read 2026-11-04).

Vendor description: Elastic Security is a SIEM with native endpoint protection, Attack Discovery for grouping alerts into attack chains, built-in workflow automation, and a query language (ES|QL) for hunting. Prebuilt detection rules are published openly on GitHub under the Elastic License v2. elastic.co read 2026-11-03 vendor claim

How Elastic Security scores on the rubric

7.60 of 10 across eight weighted criteria. It sits in band A with Microsoft Sentinel: totals within 0.25 are a band, not a ladder. Each score has its reason and the page it was read from. The rubric explains the bands.

Elastic Security on the eight rubric criteria. Part = weight times score over 100; the parts sum to the total.

The 33 capabilities for Elastic Security

documentedpartialnot documented

Notes and sources for each cell are on the group pages: Languages, Source control and CI, Testing, Coverage analytics, Rule health, Library.

Where Elastic Security is strong

• A Rule Monitoring tab shows failures, execution time, gaps and a duration breakdown, with a monitoring dashboard on top. elastic.co read 2026-11-04
• A monthly pipeline scores 1,781 prebuilt rules on Noise, Performance and Threat over a 30-day telemetry window, and tags 385 as Recommended and 296 as Aggressive. Elastic wrote the post, so the method is a vendor claim. elastic.co read 2026-11-03
• The detection-rules CLI has create-rule, test, validate-all, import-rules-to-repo and export-rules-from-repo, so a rule can leave Kibana, be reviewed in git and go back in. Install needs Python 3.12 or later. github.com read 2026-11-03

Where Elastic Security is behind

• There is no noisy-rule flag and no alert when a field a rule uses stops appearing. The Data Quality dashboard checks ECS mapping of indices, not the fields inside rules. elastic.co read 2026-11-03
• The detection-rules README describes no CI workflow, and the DaC reference calls a CI/CD pipeline optional. A team writes its own pipeline around the CLI. github.com read 2026-11-04
• The prebuilt rule count depends on the page: 1,781 in the scoring post and over 1,300 on the security page, an older figure. The 8.19 docs page for the list is marked no longer updated. elastic.co read 2026-11-03

What only Elastic Security publishes

Elastic's History view, available from Elastic Stack 9.5, shows a timeline of a rule's revisions, compares two of them and restores an earlier state. elastic.co read 2026-11-04

Pricing as published for Elastic Security

Priced on ingest and retention in GB plus add-ons per billable asset and per execution. Per-endpoint fees no longer apply as of 2026-03-23 per the pricing page. Two tiers on Serverless: Security Analytics Essentials and Complete, plus a limited-time EASE tier. elastic.co read 2026-11-03

Published prices, read dates beside each.

Named customers of Elastic Security

Names below are as the source page lists them.

Customers named on public pages. Every name is a vendor claim from the page cited in its row.

Recent releases and news for Elastic Security

• 2026-11-02 Elastic Stack 9.5.6 released. Patch release on the 9.5 line, listed on the Elastic blog releases section. elastic.co read 2026-11-03 vendor claim
• 2026-10-12 Introducing AlertZero: inbox zero for your alert queue. Agentic alert triage layer, listed as coming soon on the security page. elastic.co read 2026-11-03 vendor claim
• 2026-10-05 Behind the tags: Elastic SIEM scores 1,781 prebuilt rules monthly. Monthly scoring of prebuilt rules on noise, performance and threat, with Profile tags Recommended and Aggressive. elastic.co read 2026-11-03 vendor claim
• 2026-09-28 One SOC, 100 projects: centralized alert triage on Elastic Security Serverless. Vendor post on running centralized triage across projects. elastic.co read 2026-11-03 vendor claim
• 2026-03-23 Per-endpoint pricing removed from Elastic Security. Pricing page states per-endpoint fees no longer apply; ingest and retention charges remain. elastic.co read 2026-11-03 vendor claim

Claims Elastic Security makes about itself

Each figure is the vendor's. The evidence grade is defined on the rubric page: A measured by a third party with the method published, B vendor-measured with sample and method, C vendor figure with no method, D figure with no source.

Vendor claims with the evidence grade and who measured.

Shortlist Elastic Security when

• You run Elastic already and want rules in a TOML repository with a CLI.
• You want a published noise, performance and threat score for prebuilt rules before you enable them.
• You need a rule History view with restore, and can run Elastic Stack 9.5 or later.

Verdict on Elastic Security

Second of 12 at 7.60, in band A with Microsoft Sentinel (7.81), and 0.77 clear of Google SecOps (6.83), anchored by rule health at 9.0.

Compare Elastic Security

Alternatives to Elastic Security. Head-to-head diffs: SOC Prime, Anvilogic, Panther, Sigma and pySigma, Detecteam, Splunk Enterprise Security (Cisco), Sekoia.io, Hunters, Google Security Operations, Microsoft Sentinel, Mate Security.