Elastic Security

Cloud On-premises

Detection Incident Response SIEM Threat Hunting XDR

Cloud DNS Endpoint Identity logs Network

Anomaly Detection Behavioral Analytics Machine Learning Rules-Based Signature-Based Threat Intelligence UEBA

KQL Lucene

Yes

No

Alert Triage Automated Response Case Management Investigation Workbench Real-Time Detection Threat Intelligence Integration Timeline Analysis Visualization