Here's an overview of the flow and its components:
* Data is shipped from your hosts to {es} via beat modules and the Elastic https://www.elastic.co/endpoint-security/[Endpoint Security agent integration]. This integration provides capabilities such as collecting events, detecting and preventing {security-guide}/detection-engine-overview.html#malware-prevention[malicious activity], and artifact delivery. The {fleet-guide}/fleet-overview.html[{fleet}] app is used to
install and manage agents and integrations on your hosts.
+
The Endpoint Security integration ships the following data sets:
are lightweight data shippers. Beat modules provide a way of collecting and
parsing specific data sets from common sources, such as cloud and OS events,
logs, and metrics. Common security-related modules are listed {security-guide}/ingest-data.html#enable-beat-modules[here].
* The {security-app} in {kib} is used to manage the *Detection engine*,
*Cases*, and *Timeline*, as well as administer hosts running Endpoint Security:
** Detection engine: Automatically searches for suspicious host and network
activity via the following:
*** {security-guide}/detection-engine-overview.html#detection-engine-overview[Detection rules]: Periodically search the data
({es} indices) sent from your hosts for suspicious events. When a suspicious
event is discovered, a detection alert is generated. External systems, such as
Slack and email, can be used to send notifications when alerts are generated.
You can create your own rules and make use of our {security-guide}/prebuilt-rules.html[prebuilt ones].
*** {security-guide}/detections-ui-exceptions.html[Exceptions]: Reduce noise and the number of
false positives. Exceptions are associated with rules and prevent alerts when
an exception's conditions are met. *Value lists* contain source event
values that can be used as part of an exception's conditions. When
Elastic {endpoint-sec} is installed on your hosts, you can add malware exceptions
directly to the endpoint from the Security app.
*** {security-guide}/machine-learning.html#included-jobs[{ml-cap} jobs]: Automatic anomaly detection of host and
network events. Anomaly scores are provided per host and can be used with
detection rules.
** {security-guide}/timelines-ui.html[Timeline]: Workspace for investigating alerts and events.
Timelines use queries and filters to drill down into events related to
a specific incident. Timeline templates are attached to rules and use predefined
queries when alerts are investigated. Timelines can be saved and shared with
others, as well as attached to Cases.
** {security-guide}/cases-overview.html[Cases]: An internal system for opening, tracking, and sharing
security issues directly in the Security app. Cases can be integrated with
external ticketing systems.
** {security-guide}/admin-page-ov.html[Administration]: View and manage hosts running {endpoint-sec}.
{security-guide}/ingest-data.html[Ingest data to Elastic Security] and {security-guide}/install-endpoint.html[Configure and install the Elastic Endpoint integration] describe how to ship security-related
data to {es}.
For more background information, see:
* https://www.elastic.co/products/elasticsearch[{es}]: A real-time,
distributed storage, search, and analytics engine. {es} excels at indexing
streams of semi-structured data, such as logs or metrics.
* https://www.elastic.co/products/kibana[{kib}]: An open-source analytics and
visualization platform designed to work with {es}. You use {kib} to search,
view, and interact with data stored in {es} indices. You can easily compile
advanced data analysis and visualize your data in a variety of charts, tables,
and maps.
[discrete]
=== Compatibility with cold tier nodes
Cold tier is a {ref}/data-tiers.html[data tier] that holds time series data that is accessed only occasionally. In {stack} version >=7.11.0, {elastic-sec} supports cold tier data for the following {es} indices:
* Index patterns specified in `securitySolution:defaultIndex`
* Index patterns specified in the definitions of detection rules, except for indicator match rules
* Index patterns specified in the data sources selector on various {security-app} pages
{elastic-sec} does NOT support cold tier data for the following {es} indices:
* Index patterns controlled by {elastic-sec}, including signals and list indices
* Index patterns specified in indicator match rules
Using cold tier data for unsupported indices may result in detection rule timeouts and overall performance degradation.
[discrete]
[[self-protection]]
==== Elastic Endpoint self-protection
Self-protection means that {elastic-endpoint} has guards against users and attackers that may try to interfere with its functionality. This protection feature is consistently enhanced to prevent attackers who may attempt to use newer, more sophisticated tactics to interfere with the {elastic-endpoint}. Self-protection is enabled by default when {elastic-endpoint} installs on supported platforms, listed below.
Self-protection is enabled on the following 64-bit Windows versions:
* Windows 8.1
* Windows 10
* Windows Server 2012 R2
* Windows Server 2016
* Windows Server 2019
And on the following macOS versions:
* macOS 10.15 (Catalina)
* macOS 11 (Big Sur)
NOTE: Other Windows and macOS variants (and all Linux distributions) do not have self-protection.
For {stack} version >= 7.11.0, self-protection defines the following permissions:
* Users -- even Administrator/root -- *cannot* delete {elastic-endpoint} files (located at `c:\Program Files\Elastic\Endpoint` on Windows, and `/Library/Elastic/Endpoint` on macOS).
* Users *cannot* terminate the {elastic-endpoint} program or service.
* Administrator/root users *can* read the endpoint's files. On Windows, the easiest way to read Endpoint files is to start an Administrator `cmd.exe` prompt. On macOS, an Administrator can use the `sudo` command.
* Administrator/root users *can* stop the {elastic-agent}'s service. On Windows, run the `sc stop "Elastic Agent"` command. On macOS, run the `sudo launchctl stop elastic-agent` command.
[discrete]
[[siem-integration]]
=== Integration with other Elastic products
You can use {elastic-sec} with other Elastic products and features to help you
IMPORTANT: {elastic-sec} requires {ecs-ref}[ECS-compliant data]. If you use third-party data collectors to ship data to {es}, the data must be mapped to ECS.
{security-guide}/siem-field-reference.html[Elastic Security ECS field reference] lists ECS fields used in {elastic-sec}.