Getting Started with Elastic Security: A Complete Setup Guide

Wylie Bayes

• 3 min read

The Elastic Stack (formerly ELK—Elasticsearch, Logstash, Kibana) has long been the open-source backbone of log management. In recent years, Elastic has aggressively evolved the platform beyond simple log aggregation, transforming it into a full-fledged Security Information and Event Management (SIEM) and Endpoint Security solution: Elastic Security.

Whether you are building a home lab to practice threat hunting or deploying a scalable SIEM for a Fortune 500 enterprise, Elastic Security is a dominant force. In this post, we will walk through the core architecture of the platform and the practical steps to deploy your first environment.

The Modern Elastic Architecture

Before we deploy, it’s critical to understand the modern components of the Elastic Stack, as the architecture has shifted significantly from the old "Logstash and Beats" model.

  1. Elasticsearch: The heart of the stack. It is a highly scalable, distributed search and analytics engine where all your security telemetry (logs, metrics, events) is stored and indexed.
  2. Kibana: The visualization layer and administrative user interface. This is where analysts spend 100% of their time—building dashboards, writing detection rules, and utilizing the Elastic Security app.
  3. Fleet: A centralized management application built directly into Kibana. It allows administrators to manage and update thousands of endpoint agents simultaneously without ever touching the command line.
  4. Elastic Agent: The unified, single agent that replaces the old ecosystem of disparate Beats (Winlogbeat, Filebeat, Metricbeat). It handles log collection, metric gathering, and active Endpoint Detection and Response (EDR) capabilities.

Step 1: Deploying the Elastic Stack

You have two options for deployment: On-Premise (self-managed) or Elastic Cloud (managed service).

For a production SOC or a rapid proof-of-concept, Elastic Cloud is highly recommended. It abstracts away the massive overhead of managing Elasticsearch Java heap sizes, shard routing, and cluster node scaling.

  1. Sign up for an Elastic Cloud trial.
  2. Create a new deployment and select the Security template.
  3. Choose your cloud provider (AWS, GCP, Azure) and region.
  4. Click Create deployment. Within five minutes, your entire backend infrastructure (Elasticsearch, Kibana, and a Fleet server) is provisioned and secured with TLS by default.

Step 2: Enabling the Elastic Security App

Once your cluster is spun up, navigate to Kibana. In the left-hand navigation menu, you will see a dedicated section for Security.

The Elastic Security App is a unified workspace designed specifically for Security Operations Centers (SOCs). It features:

  • Overview Dashboards: High-level metrics on active alerts and host health.
  • Alerts: The queue where your SIEM detection rules will generate tickets.
  • Timelines: A collaborative threat-hunting tool that allows analysts to drag and drop suspicious events to build a narrative of an attack.
  • Rules: Hundreds of out-of-the-box detection rules mapped directly to the MITRE ATT&CK framework.

Step 3: Setting Up Fleet and Ingesting Data

An empty SIEM is useless. We need to feed it data. In the modern Elastic paradigm, we do this using Fleet and Integrations.

  1. In Kibana, navigate to Management -> Fleet.
  2. Click Add Agent.
  3. Kibana will generate a single, pre-configured command (for Windows, Linux, or macOS).

Run that command in an administrative terminal on your target endpoint (e.g., a Windows Server). The command will download the Elastic Agent, install it as a service, and immediately register it back to your Fleet Server.

Step 4: Applying Integration Policies

Now that the Elastic Agent is installed on your Windows Server, you need to tell it what to collect.

Instead of manually writing YAML configuration files, you use Integrations in Kibana.

  1. Navigate to Integrations and search for Windows.
  2. Click Add Windows.
  3. Assign this integration to the Agent Policy associated with your server.
  4. Configure the settings via the GUI to collect Security, System, Application, and PowerShell event logs.

When you click "Save," Fleet automatically compiles the configuration and pushes it down to the Elastic Agent over the network. Within seconds, rich Windows Event data will begin flowing into Elasticsearch and populating your Security dashboards.

Conclusion

Getting started with Elastic Security has never been easier. By leveraging Elastic Cloud and the unified Fleet architecture, security teams can bypass days of tedious infrastructure configuration and immediately begin ingesting telemetry.