Elastic Security

What Elastic Security Is and Why Analysts Use It

• Elastic Security is the SIEM module built on top of the Elastic Stack (Elasticsearch, Kibana, Logstash, Beats/Fleet). It ingests security telemetry — logs, network data, endpoint data — and provides detection, investigation, and response capabilities.
• MITRE ATT&CK maps Elastic Security’s core function to T1654 (Log Enumeration) — the SIEM is the central platform where logs from all sources are stored, indexed, and queried.
• Unlike proprietary SIEMs (Splunk, Sentinel), Elastic is open-source under the Elastic License or SSPL (depending on version). The free tier includes detection rules, case management, and Kibana dashboards.
• Elastic Security integrates natively with Elastic Agent (for endpoint data), Fleet (agent management), and the Elastic Detection Rules repository (1,000+ pre-built rules mapped to MITRE ATT&CK).

Architecture — Elastic Stack for SIEM

Minimum SIEM Deployment

# Docker Compose — single-node Elastic SIEM stack
# elasticsearch.yml
cluster.name: "wyzsec-siem"
network.host: 0.0.0.0
xpack.security.enabled: true
xpack.security.authc.api_key.enabled: true

# Start Elasticsearch and Kibana
docker compose up -d elasticsearch kibana

# Enroll an Elastic Agent from a Windows endpoint
# (download agent from Kibana → Fleet → Add Agent)
elastic-agent.exe enroll --url=https://siem.example.com:8220 \
    --enrollment-token=TOKEN_FROM_FLEET
elastic-agent.exe run

Detection Rules — The Built-In Library

Elastic Security ships with 1,000+ pre-built detection rules mapped to MITRE ATT&CK tactic, technique, and sub-technique.

Rule Types

Key Pre-Built Rule Families

EQL — Event Query Language

EQL is Elastic’s sequence-based query language — it finds patterns across events rather than matching individual events.

Core EQL Patterns

Example — Detect Process Injection via EQL (Sysmon provides the underlying events)

// Detection: Remote thread creation (Sysmon Event 8)
// from an unexpected source process
sequence with maxspan=10s
  [process where event.type == "start" and
   process.name : ("winword.exe", "excel.exe", "powerpnt.exe",
                  "wmiprvse.exe", "rundll32.exe")]
  [process where event.type == "info" and
   event.code == "8"] // Sysmon Event 8 — CreateRemoteThread

Example — Detect Lateral Movement via EQL

// Detection: Lateral movement via PsExec
// Event 4688 (process creation) + Event 5140 (SMB share access)
sequence with maxspan=1m
  [file where event.type == "creation" and
   file.path : "\\\\*\\ADMIN$\\*" and
   file.name : ("PSEXESVC.exe", "psexec.exe")]
  [process where event.type == "start" and
   process.name == "PSEXESVC.exe"]

Kibana Visualization — Building SOC Dashboards

Essential Dashboards for SOC

Creating a Custom Lens (Example — Top Failed Logins)

Index: logs-endpoint-events-*
Metric: count
Breakdown by: source.ip
Filter: event.code: 4625
Time range: Last 24 hours
Sort: Count descending
Limit: 10

Agent Management with Fleet

Fleet is the centralized management console for all Elastic Agents.

Sample Detection Rule — Custom Rule

{
  "author": ["WYZSec"],
  "description": "Detect WMIPrvSE spawning a suspicious child process (LOLBins / lateral movement)",
  "false_positives": ["Legitimate WMI queries for system administration"],
  "from": "now-360m",
  "index": ["logs-endpoint.events.process-*"],
  "language": "kuery",
  "name": "Suspicious WMI Process Child",
  "query": "event.category:process and event.type:start and process.parent.name:WmiPrvSE.exe and (process.name:(powershell.exe or cmd.exe or wscript.exe or cscript.exe or mshta.exe or regsvr32.exe) or process.args:("*-enc*" or "DownloadString"))",
  "risk_score": 73,
  "rule_id": "WYZ-0001",
  "severity": "high",
  "tags": ["T1047", "lateral_movement"],
  "type": "query",
  "version": 1
}

Related

• Azure Sentinel — detection and response for T1654 techniques
• CyberChef — detection and response for T1654 techniques
• EDR Basics — detection and response for T1059, T1003, T1055, T1204, T1562 techniques
• Log Sources Overview — covers the log sources overview concepts
• Living-off-the-Land Binaries — how living-off-the-land binaries attacks work and how to detect them

Sources

• Elastic Security Documentation
• Elastic Detection Rules Repository
• MITRE ATT&CK — T1654 (Log Enumeration)
• EQL Language Guide
• Elastic Security Labs Blog