Elastic Security
The SIEM your engineers may already be running — Elastic Security puts detections and endpoint protection on the Elasticsearch cluster your logs are already in, and is one of the few modern SIEMs that runs self-managed or fully air-gapped.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Data residency & processing — answered by deployment
Self-managed
Stored AND processed by you
Runs on your own infrastructure, including fully air-gapped. Both questions answered by definition — the data never leaves.
Elastic Cloud
50+ regions — confirm both
If you choose managed, confirm storage AND processing location for your region in writing, as you would with any SaaS.
This is the reason Elastic reaches shortlists the cloud-only SIEMs cannot. Where a mandate rules out SaaS, self-managed sidesteps the storage-versus-processing question entirely — unlike a cloud SIEM that may store in your region while processing elsewhere. See the SIEM guide for which other products can do this.
Quick answer
The Elastic platform family
This page covers Elastic Security — the SIEM and endpoint security layer. The other Elastic products:
Quick facts
30-second orientation- Product
- Elastic Security (SIEM + endpoint)
- Vendor
- Elastic (NYSE: ESTC)
- Built on
- Elasticsearch — the store your logs may already be in
- Deployment
- Self-managed (incl. air-gapped) · Cloud · Serverless
- Data residency
- Self-managed satisfies it by definition
- Entry point
- Free tier under AGPL — start before procurement
- Priced on
- Subscription tier + resources (not per seat)
- Analyst standing
- Visionary, 2025 Gartner MQ for SIEM (not Leader)
- Endpoint
- Elastic Defend, included — your tier sets the protections
- In India via
- TechBag — tier scoping, GST invoicing
Understand SIEM economics before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
SIEM and endpoint security built on Elasticsearch — detections, hunting and cases on the store your logs are already in, with one agent doing both telemetry and endpoint protection.
A two-copy SIEM architecture vs Elastic’s — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Typical SIEM + separate EDR | Elastic Security |
|---|---|---|
| Data copies | Logs, then a copy in the SIEM | One store, queried three ways |
| Agents | Log shipper + separate EDR agent | One Elastic Agent does both |
| On-premises | Cloud-only SIEMs cannot | Self-managed, including air-gapped |
| Evaluation | Sales cycle, then a PoC | Free tier on real data, no contract |
| Pricing axis | Per GB ingested or per seat | Subscription tier + resources |
| Retention cost | Priced per GB per month | Hot/warm/cold/frozen — your policy |
| Honest caveat | — | Thinner OOTB content; you operate it |
| Best fit | — | On-prem mandates; ELK estates |
The deployment-freedom answer — for the deepest out-of-the-box content, weigh Splunk (TechBag sells it).
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Elasticsearch
Your security data lives in the same engine as your logs and, if you run it, your observability data. One copy, queried three ways — no separate SIEM database to fill, sync or pay for twice.
Elastic Agent
One agent ships logs and, through Elastic Defend, protects endpoints with malware, ransomware, memory-threat and behaviour prevention plus EDR telemetry.
Detection engine
Prebuilt and custom detection rules map to MITRE ATT&CK, alongside ML anomaly jobs; prebuilt rules update independently of the cluster.
Entity & behavioural analytics
Risk scoring across users and hosts, so an alert arrives with the entity's recent history attached rather than as an isolated event. Available in the higher subscription tiers.
Deployment model
Self-managed, including air-gapped, Elastic Cloud Hosted in 50+ regions on resource pricing, or Serverless on consumption: this sets cost and residency.
One engine, one agent, one copy of the data — security reads the same indices your logs and observability data already live in.
Twelve capabilities. Collect, detect, respond.
Elastic Security collects through one agent, detects with rules, machine learning and entity risk, and responds from Kibana. Here are the twelve pieces that matter, grouped by where they sit in that loop.
Elastic Agent — logs and endpoint
The same agent ships telemetry and enforces endpoint protection. One deployment, not two.
Hundreds of data integrations
Cloud providers, network gear, identity, SaaS and custom sources via the Fleet-managed agent.
Self-managed, including air-gapped
Runs with no cloud dependency at all — the option most modern SIEMs simply cannot offer.
Index lifecycle management
Hot, warm, cold and frozen tiers — the main lever on what long retention actually costs you.
Prebuilt & custom rules
Detection rules mapped to MITRE ATT&CK, updated independently of your cluster version.
Anomaly detection jobs
Machine-learning jobs that baseline behaviour and surface what static rules miss.
Entity & behavioural analytics
Risk scores for users and hosts, so alerts arrive with the entity's history attached.
Search-native threat hunting
Hunt across everything in the cluster with the search engine the platform is built on.
Elastic Defend — prevention & EDR
Malware, ransomware, memory-threat and behaviour prevention with EDR telemetry — 100% malware in AV-Comparatives 2026.
Host isolation & response actions
Isolate a host, kill a process or pull a file through the same agent; the full response console is an Enterprise feature.
Case management
Investigations with timelines, attachments and third-party ticketing connectors.
Elastic AI Assistant
Natural-language investigation, rule authoring help and alert summarisation.
Watch Elastic Security in action
Detection, investigation and response, from Elastic’s own channel.
Elastic Security Solutions Overview
The security platform, explained by Elastic.
Elastic Security: End to End Incident Response
Detection through to response, end to end.
Elastic Security: an agentic security operations platform
Where the product is heading.
Want a live, India-context walkthrough for your environment?
Book a guided demo →A SIEM that goes where your data is allowed to be.
The six reasons buyers pick Elastic Security Here’s what genuinely sets Elastic Security apart (and where Splunk or Sentinel may fit better).mdash; including the two caveats that send some of them to Splunk or Sentinel instead.
On-premises and air-gapped — where most modern SIEMs cannot go
Sentinel, Google Security Operations and Cortex XSIAM are all SaaS, so if telemetry may not leave your infrastructure, none qualifies. Elastic Security runs self-managed, even fully air-gapped, satisfying residency for buyers under DPDP or RBI, SEBI or IRDAI. It’s also on Elastic Cloud Hosted in 50+ regions, or Serverless.
One store, one agent, no second copy of your data
Elastic keeps security data in the same Elasticsearch cluster as logs and observability — one copy, queried three ways — and the Elastic Agent that ships telemetry is also the endpoint protection agent. No paying to store events twice, detections can query the whole cluster, and endpoint rollout isn’t a separate project.
A free tier that is genuinely usable — you can start before procurement
Elasticsearch is open source again under AGPL since 2024, and Elastic Security’s free tier is a working SIEM: ingest data, run prebuilt detection rules and investigate with no contract. Teams pilot on real data first, so negotiations start from proof. The catch: a capable free tier hides the operational cost.
Search-native hunting, from the company that builds the search engine
Threat hunting is a search problem, and Elastic Security is built on one of the best search engines, so hunting across the full cluster is native, not costly. Index lifecycle management sets what stays hot, warm, cold or frozen — the main lever on retention cost — and AI retrieval runs on the same engine.
The honest caveat — Visionary, not Leader, and you operate it
Elastic Security was named a Visionary in the 2025 Gartner Magic Quadrant for SIEM, not a Leader: strong vision, but less out-of-the-box content than Splunk, so expect to write more detections. Running Elasticsearch at scale is real engineering, so compare Cloud to Cloud, not a self-managed licence to a managed bill.
The honest positioning
Choose Elastic Security when you need on-premises or air-gapped, already run Elasticsearch, or want to evaluate on real data first. For the deepest out-of-the-box content and talent pool, Splunk; for Microsoft-shaped estates with free first-party log ingest, Sentinel. TechBag sells all three, in INR with GST.
The numbers behind the platform
What your Elastic Security rollout looks like
Find what you already run
Most organisations already run Elasticsearch somewhere, so start there; the question is usually which tier to formalise.
Decide deployment, then tier
Choose self-managed, Cloud Hosted or Serverless first; it sets your cost model and residency answer and shapes the tier choice.
Ingest, then lifecycle
Roll out Elastic Agent for logs and endpoint together, and set hot-warm-cold-frozen policy before the cluster fills.
Detections and hunting
Enable prebuilt rules, then write the ones your estate needs, budgeting for plenty of custom content; TechBag supports in INR/GST.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Our mandate ruled out SaaS, removing Sentinel, Google SecOps and XSIAM before any comparison; Elastic was one of few modern SIEMs left.”
“We already ran ELK for logs, so turning on Security was like enabling a feature: no second data store, no second agent.”
“The free tier let us prove it on our own data first, so we knew exactly which tier we needed before talking to a vendor.”
“Honest warning: out-of-the-box content is thinner than Splunk's. We write more of our own detections here, and we budgeted for that going in.”
“One agent doing logs and endpoint removed an entire rollout from our year. That saving never shows up on a feature comparison.”
“Index lifecycle management is where the money is. Set the hot-warm-cold policy before you ingest — retrofitting it to a year of data is painful.”
“Running Elasticsearch at scale is real work we underestimated; comparing costs was only honest once we counted our own engineers.”
“With a data-localisation obligation, self-managed answered residency by definition, and TechBag made that the first conversation.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the SIEM market — tap any vendor to see why it sits where it does.
TechBag SIEM Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Visionary in the 2025 MQ — vision ahead of enterprise execution.
Capability Depth × Deployment Freedom
Out-of-the-box content and capability depth vs where you can run it and what it costs to keep running.
Deployment freedom and cost control — the corner it owns.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Elastic Security vs the field
Where Elastic Security wins is deployment freedom and one agent for logs and endpoint; where Splunk wins is content depth and the size of its talent pool. We sell both, so we say which.
| Dimension | Elastic Security | Splunk Enterprise Security | Microsoft Sentinel | Google Security Operations | Wazuh |
|---|---|---|---|---|---|
| Position | SIEM + endpoint on a search engine | The reference SIEM | SIEM for Microsoft estates | Cloud SIEM + SOAR + intel | Free and open source |
| Deployment | Self-managed, air-gapped, Cloud or Serverless | Cloud, on-prem or hybrid | SaaS only, on Azure | SaaS only, on Google Cloud | Self-managed or Wazuh Cloud |
| Pricing axis | Subscription tier + resources | Ingest or workload — historically costly | Per GB ingested per day | Package against a GB cap | Free; you pay for support/cloud |
| Out-of-the-box content | Prebuilt rules, narrower than the Leaders | Deepest content library | Strong, Microsoft-centric | Curated + Mandiant intel | Community-driven |
| Endpoint included | Yes — same agent, 100% AV-Comparatives | No, bring your own EDR | Defender, licensed separately | No, bring your own EDR | Agent-based monitoring, not full EDR |
| Talent pool | Large for Elasticsearch, smaller for Security | SPL — the largest by far | KQL — widely known | YARA-L — smallest | Community |
| Analyst standing (SIEM MQ 2025) | Visionary — we say so | Leader | Leader | Leader, furthest on Vision | Not evaluated |
| Evaluation route | Free tier on real data, no contract | Trial, then sales | 31-day trial, 10 GB/day | Sales-led | Free permanently |
| Operational burden | You run the cluster (unless Cloud) | Yours, or Splunk Cloud | Fully managed | Fully managed | Yours, or Wazuh Cloud |
| Data residency | Self-managed satisfies it by definition | On-prem available | Stores in India, processes in the US | Google Cloud regions | Self-managed |
| Best fit | On-prem mandates and existing ELK estates | Deepest content, largest talent pool | Microsoft-standardised estates | Retention and search at scale | Smallest budgets, with in-house skills |
Does Elastic Security fit you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Elastic Security if…
- ✓Your mandate requires on-premises or air-gapped — most modern SIEMs are then not candidates at all
- ✓Your engineers already run Elasticsearch, so adoption is closer to enabling than migrating
- ✓You want to evaluate properly on your own data before spending anything
- ✓You want SIEM and endpoint from one agent, on one copy of your data
Choose Splunk if…
- ✓You want the deepest out-of-the-box content and the largest talent pool, and can fund it (TechBag sells it)
Choose Microsoft Sentinel if…
- ✓Your estate is Microsoft-standardised, SaaS is acceptable, and free ingest of first-party Microsoft logs outweighs deployment freedom
Choose Google Security Operations if…
- ✓Retention is your pain and twelve months of hot searchable data solves it
Choose Wazuh if…
- ✓Budget is the binding constraint and you have the in-house skills to run it — with paid support and cloud hosting available when you need them
Elastic Security is one of 36 SIEM & log management products TechBag carries. The SIEM & Log Management guide narrows them to a shortlist and shows the reasoning. →
Self-managed, or managed?
Elastic is priced on deployment and subscription tier, not on gigabytes ingested — so the question that decides your bill is whether running the cluster yourself costs less than letting Elastic run it. The engine is free under AGPL; what is not free is your engineers’ time on shard strategy, index lifecycle, capacity and upgrades. Drag both sliders. Illustrative, at ₹12,000 per fully-loaded engineer-day and ~₹84/USD.
Engineer-days means real time on shard strategy, index lifecycle, capacity planning and version upgrades — not incident response. If you put 0, you are assuming the cluster runs itself, which is the assumption this calculator exists to question. Illustrative: your TechBag quote models your real tier and resources.
Three ways to consume it
Elastic is priced on your DEPLOYMENT plus a subscription tier — not per seat and not per GB ingested, which changes the arithmetic against volume-metered SIEMs at scale. The engine itself is free and open source under AGPL, so the real question is which features you need above the free tier, and who runs the cluster. Figures below are Elastic’s listed “as low as” entry rates and scale with what you provision. TechBag scopes tier and deployment and quotes in INR with GST.
Self-managed
Best for on-prem and air-gapped
- Engine free and open source — pay for a tier above it
- Runs fully air-gapped; residency answered by definition
- You operate the cluster — price your engineers’ time
Elastic Cloud Hosted
Best if you want it managed
- Listed from $99/mo Standard to $184/mo Enterprise at entry size
- Priced on provisioned resources, not per seat or per GB
- 50+ regions; support charged as a % of consumption above Standard
Serverless
Best for variable volume
- Security Analytics Essentials from $0.09/GB ingested; retention from $0.017/GB/month
- Complete from $0.11/GB ingested; endpoint protection included since March 2026
- No cluster to size — consumption-based, closest to the cloud SIEM model
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every SIEM vendor
Take this into your next vendor call — including ours.
Self-managed, Cloud Hosted or Serverless? This decides your cost model AND your residency answer — settle it before comparing tiers.
If your mandate rules out SaaS, which SIEMs on your list can run self-managed and so meet residency by definition?
Which features do you need above the free tier? That is where the negotiable money is, and vendors won’t talk you down.
Who runs the cluster — shard strategy, lifecycle, capacity, upgrades? Have you priced their time, or only the licence?
Out-of-the-box detection content is narrower than the Leaders. Who writes and tunes your custom rules?
Have you designed hot/warm/cold/frozen before ingesting? It is the main retention cost lever and painful to retrofit.
Are you replacing a separate EDR agent? One agent for logs and endpoint removes a rollout — count that saving.
Elastic bills in USD — have you modelled the tier and resources in INR with GST?
Questions buyers ask
Ready to evaluate Elastic Security?
Find out what you already run, work out which tier you actually need above the free one, or get an honest Elastic-vs-Splunk comparison — in INR/GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.