Elastic Agent

What do you like best about the product?

I find Elastic Security to be a great product mainly because of the AI integrations that make it easier for analysts to ask questions and generate queries swiftly during their investigations. The numerous out of the box integrations and connectors for ingesting logs and generating alerts are impressive, and we easily create custom alerts that meet various security framework requirements. The ability to visualize threats is excellent for quick overviews and illustrating value to leadership. I also appreciate the case management features that allow us to tie multiple alerts to a single case and explore the entire chain of events in a timeline view, making it a solid platform for our security team. The setup was smooth, thanks to the elastic serverless platform, and the professional services team from Elastic were extremely helpful. Moreover, the Slack and PagerDuty connectors keep us informed and ready to raise staff for critical alerts. Overall, Elastic Security has been reliable and meets our needs effectively, and I would absolutely recommend it.

What do you dislike about the product?

There have been some minor bugs in the platform that we have run into, but the support teams have been very helpful in triaging the bugs and getting fixes out. In some cases we had fixes deployed within hours.

What problems is the product solving and how is that benefiting you?

Elastic Security centralizes our security logs, providing a single pane of glass for our analysts to investigate and manage events effectively. Its AI, visualizations, custom alerts, and case management streamline operations, helping us correlate events, visualize threats, and retain oversight seamlessly.

What do you like best about the product?

I appreciate the ability to visualize data and turn it into actionable intelligence with Elastic Security. We use it to create dashboards that monitor our security posture, attack surface, and threat landscape. The integration with our incident management system is seamless, and the setup was simple and straightforward. Elastic Security has allowed our team to conduct investigations more efficiently.

What do you dislike about the product?

I find building sequencing rules where multiple events must occur in order over a given time challenging.

What problems is the product solving and how is that benefiting you?

I use Elastic Security to efficiently investigate and detect security incidents. It allows us to visualize data, creating dashboards to monitor our security posture and turn insights into actionable intelligence.

What do you like best about the product?

You can manage the alerts in an easy way. From alerts panel you can have all the information needed for a security investigation. Also, with the cases feature, you can create your own database of alerts

What do you dislike about the product?

Sometimes, charging is slow, and it's difficult to copy fileds and values from timelines

What problems is the product solving and how is that benefiting you?

It's helping us as a SIEM

What do you like best about the product?

Elastic Security stands out for its powerful detection capabilities and deep visibility across endpoints and logs, while still being relatively easy to use once the workflows are understood. Implementation is smooth in environments already using the Elastic stack, and integrations with existing tools are flexible and well-documented. The platform offers a rich set of features for threat detection, hunting, and response that scales well for SOC operations. Customer support and community resources are strong, making troubleshooting manageable. Overall, it’s a feature-dense, frequently used platform that balances advanced capability with practical usability.

What do you dislike about the product?

The learning curve can be steep at the beginning, especially when tuning detections and managing advanced features without prior Elastic experience.

What problems is the product solving and how is that benefiting you?

Elastic Security helps centralize detection by allowing us to create custom rules that identify threats across multiple data sources in one platform. Its ability to ingest logs from tools like CrowdStrike and other security products gives us unified visibility for faster investigations. This reduces tool sprawl and improves our SOC’s efficiency in detecting and responding to incidents.

What do you like best about the product?

Most helpful, which was one of the reason for choosing Elastic Security is pre-build security use-cases ready to use.

What do you dislike about the product?

Upside is, when you migrate from different tool, to learn specifics, eg. IP address stored in multiple fileds for ability to search either by text or regex.

What problems is the product solving and how is that benefiting you?

Primarily we use it as SIEM tool and also as EDR tool.