Leveraging Elastic Defend (Agent) for Deep Endpoint Visibility

Wylie Bayes

• 3 min read

When organizations first deploy the Elastic Stack for security, they primarily use it as a SIEM—a giant repository for network logs, firewall traffic, and Windows Event logs. However, Elastic is no longer just a passive observer. With the introduction of Elastic Defend (formerly known as Elastic Endpoint Security/Endgame), Elastic has entered the arena of active Endpoint Detection and Response (EDR).

Elastic Defend is seamlessly bundled into the single Elastic Agent. It doesn't just collect logs; it actively stops malware, kills ransomware, and gives Security Operations Center (SOC) analysts unparalleled visibility into the host operating system.

In this post, we will explore how to leverage Elastic Defend to protect your endpoints and conduct deep investigations.

Deploying Elastic Defend

Enabling EDR capabilities on an endpoint already running the Elastic Agent is remarkably simple.

In Kibana, navigate to your Fleet Policies. Edit the policy applied to your endpoints and click Add Integration. Search for Elastic Defend and add it to the policy.

Within minutes, the Fleet Server pushes the new configuration to your agents, turning on the kernel-level drivers and activating the protection modules. No additional software deployment is required.

Prevention vs. Detection Modes

When configuring the Elastic Defend integration, you have granular control over its behavior. For different types of threats (Malware, Ransomware, Memory Threats, Malicious Behavior), you can choose:

  • Detect: The agent will log the malicious activity and send a high-severity alert to the SIEM, but it will not stop the process from executing. This is ideal for initial pilot deployments (the "Monitor-Only" phase).
  • Prevent: The agent will proactively kill the process, quarantine the malicious file, block the execution, and alert the SIEM.

Behavioral Ransomware Protection

One of the standout features of Elastic Defend is its ransomware protection. Instead of relying purely on static signatures, it monitors the system for the behavior of ransomware—specifically, rapid, bulk encryption of files or the deletion of Volume Shadow Copies. If this behavior is detected, Elastic Defend halts the process instantly, saving the vast majority of the user's data.

Unparalleled Telemetry

To hunt advanced threats, you need deep data. Elastic Defend hooks deeply into the Windows, macOS, and Linux kernels to provide rich, normalized (ECS) telemetry directly to Elasticsearch.

It streams:

  • Process Events: Every process start, stop, and the full command-line arguments used.
  • Network Connections: Every TCP/UDP connection initiated by an executable.
  • File Operations: File creations, modifications, and deletions (vital for tracking malware droppers).
  • Registry Modifications: Changes to Windows run keys or critical OS settings.
  • DNS Queries: The specific domain a process attempted to resolve, unmasking C2 beacons.

Because this data is indexed natively in Elasticsearch, analysts can query millions of endpoint events in milliseconds using KQL.

Active Response and Osquery

If a host is compromised, speed is critical. Elastic Defend allows analysts to respond directly from the Kibana web interface.

1. Host Isolation

If an alert confirms that a workstation is infected with a worm or ransomware, an analyst can click a single button: Isolate Host.

Elastic Defend instantly reconfigures the host's local firewall to block all inbound and outbound network traffic, physically severing the infected machine from the corporate LAN and the internet. The only traffic permitted is the encrypted connection back to the Elastic cluster, allowing the SOC to continue investigating safely.

2. Osquery Integration

Sometimes, analysts need answers to highly specific questions that aren't continuously logged. What local users are currently logged in? Are there any hidden Chrome extensions installed? What kernel modules are loaded?

Elastic Defend integrates Osquery, a powerful tool that allows you to query the operating system as if it were a SQL database. From Kibana, an analyst can push a live SQL query to the isolated endpoint:

SELECT name, path, status FROM services WHERE start_type='DEMAND_START';

The endpoint immediately returns the live data, allowing the Blue Team to hunt for deeply buried persistence mechanisms in real-time.

Conclusion

Elastic Defend bridges the gap between passive log analysis and active threat neutralization. By consolidating log ingestion, EDR telemetry, malware prevention, and active response (Osquery and Host Isolation) into a single agent, Elastic empowers defenders to identify and stop breaches with unprecedented speed.