2019-06-17 20:28:52 +02:00
[role="xpack"]
[[xpack-siem]]
2020-08-18 07:25:06 +02:00
= Elastic Security
2019-06-17 20:28:52 +02:00
[partintro]
--
2020-08-18 07:25:06 +02:00
Elastic Security combines SIEM threat detection features with endpoint
prevention and response capabilities in one solution, including:
2019-06-17 20:28:52 +02:00
2020-08-18 07:25:06 +02:00
* A detection engine to identify attacks and system misconfiguration
* A workspace for event triage and investigations
* Interactive visualizations to investigate process relationships
* Embedded case management and automated actions
* Detection of signatureless attacks with prebuilt {ml} anomaly jobs and
detection rules
2019-06-17 20:28:52 +02:00
[role="screenshot"]
2020-08-18 07:25:06 +02:00
image::siem/images/overview-ui.png[Elastic Security in Kibana]
2019-06-17 20:28:52 +02:00
[float]
== Add data
Kibana provides step-by-step instructions to help you add data. The
2020-07-16 18:51:46 +02:00
{security-guide}[Security Guide] is a good source for more
2019-06-17 20:28:52 +02:00
detailed information and instructions.
[float]
2019-11-21 22:46:34 +01:00
=== {Beats}
2019-06-17 20:28:52 +02:00
https://www.elastic.co/products/beats/auditbeat[{auditbeat}],
https://www.elastic.co/products/beats/filebeat[{filebeat}],
https://www.elastic.co/products/beats/winlogbeat[{winlogbeat}], and
https://www.elastic.co/products/beats/packetbeat[{packetbeat}]
send security events and other data to Elasticsearch.
2020-08-18 07:25:06 +02:00
The default index patterns for Elastic Security events are `auditbeat-*`, `winlogbeat-*`,
`filebeat-*`, `packetbeat-*`, `endgame-*`, `logs-*`, and `apm-*-transaction*`. To change the default pattern patterns, go to *Stack Management > Advanced Settings > securitySolution:defaultIndex*.
2019-06-17 20:28:52 +02:00
2019-11-21 22:46:34 +01:00
[float]
2020-08-18 07:25:06 +02:00
=== Elastic Security endpoint agent
2019-11-21 22:46:34 +01:00
2020-08-18 07:25:06 +02:00
The agent detects and protects against malware, and ships host and network
events directly to Elastic Security.
2019-11-21 22:46:34 +01:00
2019-06-17 20:28:52 +02:00
[float]
=== Elastic Common Schema (ECS) for normalizing data
The {ecs-ref}[Elastic Common Schema (ECS)] defines a common set of fields to be
used for storing event data in Elasticsearch. ECS helps users normalize their
event data to better analyze, visualize, and correlate the data represented in
their events.
2020-08-18 07:25:06 +02:00
Elastic Security can ingest and normalize events from ECS-compatible data sources.
2019-06-17 20:28:52 +02:00
--
include::siem-ui.asciidoc[]
2019-08-02 15:28:53 +02:00
include::machine-learning.asciidoc[]