The Elastic Stack wasn't originally designed with the security analytics use case in mind; remember, it was designed to be an efficient data store and search engine. However, it has become apparent that—similar to the logging/metrics/performance use case in IT operations—the Elastic Stack is also a very good platform to use for Security Analytics because of its ability to allow real-time access to high volumes of a variety of data. Let's see why and how the evolution of the Elastic Stack into a viable platform for security analytics has taken place.
Security in the field
The volume and variety of data
Before diving into how to operate against security threats with Elastic ML, let's provide a bit...
