- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Elastic Defend
The endpoint agent that is also your log shipper — Elastic Defend is prevention and EDR in the same Elastic Agent, and it scored 100% malware protection in the AV-Comparatives 2026 Business Security Test.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Data residency & processing — answered by deployment
Self-managed
Stored AND processed by you
Runs on your own infrastructure, including fully air-gapped. Both questions answered by definition — the data never leaves.
Elastic Cloud
60 regions — confirm both
If you choose managed, confirm storage AND processing location for your region in writing, as you would with any SaaS.
This is the reason Elastic reaches shortlists the cloud-only SIEMs cannot. Where a mandate rules out SaaS, self-managed sidesteps the storage-versus-processing question entirely — unlike a cloud SIEM that may store in your region while processing elsewhere. See the SIEM guide for which other products can do this.
Quick answer
The Microsoft platform family
This page covers Elastic Defend — the SIEM. The other pillars:
Quick facts
30-second orientation- Product
- Elastic Security (SIEM + endpoint)
- Vendor
- Elastic (NYSE: ESTC)
- Built on
- Elasticsearch — the store your logs may already be in
- Deployment
- Self-managed (incl. air-gapped) · Cloud · Serverless
- Data residency
- Self-managed satisfies it by definition
- Entry point
- Free tier under AGPL — start before procurement
- Priced on
- Subscription tier + resources (not per seat)
- Analyst standing
- Visionary, 2025 Gartner MQ for SIEM (not Leader)
- Endpoint
- 100% malware, AV-Comparatives 2026 Business test
- In India via
- TechBag — tier scoping, GST invoicing
Understand SIEM economics before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
SIEM and endpoint security built on Elasticsearch — detections, hunting and cases on the store your logs are already in, with one agent doing both telemetry and endpoint protection.
A two-copy SIEM architecture vs Elastic’s — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | No / separate AI tool | Elastic Defend |
|---|---|---|
| Data copies | Logs, then a copy in the SIEM | One store, queried three ways |
| Agents | Log shipper + separate EDR agent | One Elastic Agent does both |
| On-premises | Cloud-only SIEMs cannot | Self-managed, including air-gapped |
| Evaluation | Sales cycle, then a PoC | Free tier on real data, no contract |
| Pricing axis | Per GB ingested or per seat | Subscription tier + resources |
| Retention cost | Priced per GB per month | Hot/warm/cold/frozen — your policy |
| Honest caveat | — | Thinner OOTB content; you operate it |
| Best fit | — | On-prem mandates; ELK estates |
The deployment-freedom answer — for the deepest out-of-the-box content, weigh Splunk (TechBag sells it).
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Elasticsearch
Your security data lives in the same engine as your logs and, if you run it, your observability data. One copy, queried three ways — no separate SIEM database to fill, sync or pay for twice.
Elastic Agent
The single agent ships logs AND provides endpoint protection — prevention, EDR telemetry and response actions. Most SIEM deployments need a shipper plus a separate EDR vendor's agent; this is one deployment, one upgrade path.
Detection engine
Prebuilt and custom detection rules with MITRE ATT&CK mapping, plus machine-learning jobs for anomalies. Rules are versioned and shareable, and the prebuilt set updates independently of your cluster version.
Entity & behavioural analytics
Risk scoring across users and hosts, so an alert arrives with the entity's recent history attached rather than as an isolated event. Available in the higher subscription tiers.
Deployment model
Self-managed on your own hardware including fully air-gapped, Elastic Cloud Hosted across 60 regions on resource-based pricing, or Serverless on consumption. This is the choice that decides both your cost model and your residency answer.
One workspace where people meet, make, and share — work moving in one place, not emailed between tools.
Twelve capabilities. Draft, analyse, automate.
Sentinel collects, correlates and stores security telemetry — and the tier each table lands in is what sets your bill. Here are the five pieces that matter. Part of Defender XDR, managed in one portal, with Security Copilot AI.
Elastic Agent — logs and endpoint
The same agent ships telemetry and enforces endpoint protection. One deployment, not two.
Hundreds of data integrations
Cloud providers, network gear, identity, SaaS and custom sources via the Fleet-managed agent.
Self-managed, including air-gapped
Runs with no cloud dependency at all — the option most modern SIEMs simply cannot offer.
Index lifecycle management
Hot, warm, cold and frozen tiers — the main lever on what long retention actually costs you.
Prebuilt & custom rules
Detection rules mapped to MITRE ATT&CK, updated independently of your cluster version.
Anomaly detection jobs
Machine-learning jobs that baseline behaviour and surface what static rules miss.
Entity & behavioural analytics
Risk scores for users and hosts, so alerts arrive with the entity's history attached.
Search-native threat hunting
Hunt across everything in the cluster with the search engine the platform is built on.
Prevention & EDR
Malware and ransomware prevention with EDR telemetry — 100% malware in AV-Comparatives 2026.
Host isolation & response actions
Isolate a host or run response actions from the console, through the same agent.
Case management
Investigations with timelines, attachments and third-party ticketing connectors.
Elastic AI Assistant
Natural-language investigation, rule authoring help and alert summarisation.
Watch Microsoft Defender in action
Endpoint protection, XDR and Security Copilot.
2 Minute Tutorial: Protect Your Endpoints with Elastic Security
Endpoint protection in two minutes.
Elastic Security Solutions Overview
Where the endpoint fits in the platform.
Elastic Security: End to End Incident Response
From an endpoint alert to a closed case.
Want a live, India-context walkthrough for your environment?
Book a guided demo →AI works best where the work already happens.
Here’s what genuinely sets Elastic Security apart (and where Splunk or Sentinel may fit better).
On-premises and air-gapped — where most modern SIEMs cannot go
This is the argument that wins deals Elastic would otherwise lose, and it is worth being precise about because it is binary rather than a matter of degree. Microsoft Sentinel is SaaS on Azure. Google Security Operations is SaaS on Google Cloud. Cortex XSIAM is SaaS. For a buyer whose regulator, contract or board has ruled that security telemetry may not leave their infrastructure, none of those are candidates at any price, and no feature comparison changes that. Elastic Security runs self-managed on your own hardware, including fully air-gapped with no cloud dependency at all — which satisfies data residency by definition, because the data never goes anywhere. For Indian buyers under DPDP or subject to RBI, SEBI or IRDAI expectations, this reduces a long shortlist to a short one very quickly. And if you do not have that constraint, the same product is available on Elastic Cloud Hosted across 60 regions or Serverless, so the decision does not lock you out of a managed option later.
One store, one agent, no second copy of your data
Most SIEM architectures duplicate: your logs go to a log platform, a copy goes to the SIEM, and a separate EDR vendor's agent sits on every endpoint alongside your log shipper. Elastic collapses that. Security data lives in the same Elasticsearch cluster as your logs and observability data — one copy, queried three ways — and the Elastic Agent that ships telemetry is also the endpoint protection agent, so it is one deployment and one upgrade path rather than two. The practical effects are unglamorous and real: you are not paying to store the same events twice, a detection can query anything in the cluster rather than only what someone remembered to forward to the SIEM, and endpoint rollout is not a separate project. For teams already running ELK for logs, adopting Elastic Security is closer to switching something on than to migrating.
A free tier that is genuinely usable — you can start before procurement
Elasticsearch is open source again under AGPL since 2024, and the free tier of Elastic Security is a working SIEM rather than a crippled trial: you can ingest data, run prebuilt detection rules and investigate, without a contract, a sales call or a purchase order. That changes the shape of adoption entirely. Teams pilot it on real data over a weekend, and by the time anyone talks to a vendor the question has already moved from whether the product works to which subscription tier unlocks the specific things they now need. That is a much better negotiating position than the usual one, and it is why so many Elastic deals are formalisations of something already in production. The honest flip side is in the caveat below — a capable free tier is exactly what makes teams underestimate the operational cost — but as an evaluation route it is close to unmatched.
Search-native hunting, from the company that builds the search engine
A threat hunt is a search problem, and Elastic Security is built directly on one of the best search engines there is — not on a datastore with search bolted on. Hunting across the full cluster is the platform's native operation rather than an expensive special case, which matters because the hunts analysts actually run are the ones they can afford to run. The same engine also carries index lifecycle management, so you decide explicitly what stays hot, warm, cold or frozen as it ages, which is the main lever on what long retention costs. And because Elasticsearch is increasingly a vector database as well, the retrieval patterns behind AI-assisted investigation run on the same infrastructure rather than requiring another system.
The honest caveat — Visionary, not Leader, and you operate it
Being straight, and TechBag sells the Leaders: Elastic Security was named a Visionary in the 2025 Gartner Magic Quadrant for SIEM, not a Leader. That placement is not a technicality — it describes a real trade. The vision and architecture rate highly; the enterprise-scale execution and the depth of out-of-the-box content do not yet match Splunk, which has two decades of accumulated detection content, integrations and a far larger talent pool. Expect to write and tune more of your own detections here than you would on a Leader. The second caveat is the one that follows from the capable free tier: running Elasticsearch well at scale is genuine engineering work — shard strategy, index lifecycle, capacity planning, version upgrades — and teams routinely compare a self-managed licence against a competitor's fully managed bill and call the difference a saving. It is not, unless you have priced your own engineers. Elastic Cloud exists precisely to absorb that work, and comparing Cloud-to-Cloud is the fair comparison.
The honest positioning
Elastic Security is the right SIEM when deployment flexibility or cost control decides the purchase: when you need on-premises or air-gapped and the cloud-only SIEMs are therefore not candidates, when your engineering team already runs Elasticsearch and adoption is closer to enabling than migrating, or when you want to evaluate properly on real data before spending anything. It is the wrong choice when you want the deepest out-of-the-box detection content and the largest talent pool — that is Splunk — or when your estate is Microsoft-shaped and free first-party log ingest dominates the economics, which is Sentinel. TechBag sells all three and will tell you which one your situation actually points at, quoted in INR with GST.
The numbers behind the platform
What your Elastic Defend rollout looks like
Find what you already run
Most organisations already have an Elasticsearch cluster somewhere. Start there — the question is usually which tier to formalise, not whether to adopt. TechBag scopes this free.
Decide deployment, then tier
Self-managed, Cloud Hosted or Serverless — this decides both your cost model and your residency answer, and it constrains the tier conversation that follows.
Ingest, then lifecycle
Roll out Elastic Agent for logs and endpoint together, and set the hot-warm-cold-frozen policy BEFORE the cluster fills. Retrofitting it later is the common regret.
Detections and hunting
Enable prebuilt rules, then write the ones your estate needs — budget for more custom content than a Leader would require. TechBag supports and advises, in INR/GST.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Our mandate ruled out SaaS entirely. That took Sentinel, Google SecOps and XSIAM off the table before any feature comparison, and Elastic was one of very few modern SIEMs left standing.”
“We were already running ELK for logs. Turning on Security was closer to enabling a feature than running a migration project — no second data store, no second agent.”
“The free tier let us prove it on our own data before we spent anything. By the time we talked to a vendor we knew exactly which tier we needed and why.”
“Honest warning: out-of-the-box content is thinner than Splunk's. We write more of our own detections here, and we budgeted for that going in.”
“One agent doing logs and endpoint removed an entire rollout from our year. That saving never shows up on a feature comparison.”
“Index lifecycle management is where the money is. Set the hot-warm-cold policy before you ingest — retrofitting it to a year of data is painful.”
“We underestimated the operations. Running Elasticsearch well at scale is a real job, and comparing our self-managed licence to a managed competitor was not the honest comparison until we counted our own engineers.”
“For an Indian entity with a data-localisation obligation, self-managed answered the residency question by definition. TechBag made that the first conversation rather than the fourth.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the endpoint-security (EDR/XDR) market — tap any vendor to see why it sits where it does.
TechBag Endpoint-Security (EDR/XDR) Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Visionary in the 2025 MQ — vision ahead of enterprise execution.
In-App Integration × Estate Breadth
The grid nobody publishes — detection efficacy & agent maturity vs Microsoft-estate fit and TCO.
Deployment freedom and cost control — the corner it owns.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Elastic Defend vs the field
The SIEM field — honest lanes; the edge is deployment freedom and one agent for logs and endpoint. Deepest content and talent pool? Splunk. We say so (and sell it).
| Dimension | Elastic Security | Splunk Enterprise Security | Microsoft Sentinel | Google Security Operations | Wazuh |
|---|---|---|---|---|---|
| Position | SIEM + endpoint on a search engine | The reference SIEM | SIEM for Microsoft estates | Cloud SIEM + SOAR + intel | Free and open source |
| Deployment | Self-managed, air-gapped, Cloud or Serverless | Cloud, on-prem or hybrid | SaaS only, on Azure | SaaS only, on Google Cloud | Self-managed or Wazuh Cloud |
| Pricing axis | Subscription tier + resources | Ingest or workload — historically costly | Per GB ingested per day | Package against a GB cap | Free; you pay for support/cloud |
| Out-of-the-box content | Prebuilt rules, narrower than the Leaders | Deepest content library | Strong, Microsoft-centric | Curated + Mandiant intel | Community-driven |
| Endpoint included | Yes — same agent, 100% AV-Comparatives | No, bring your own EDR | Defender, licensed separately | No, bring your own EDR | Agent-based monitoring, not full EDR |
| Talent pool | Large for Elasticsearch, smaller for Security | SPL — the largest by far | KQL — widely known | YARA-L — smallest | Community |
| Analyst standing (SIEM MQ 2025) | Visionary — we say so | Leader | Leader | Leader, furthest on Vision | Not evaluated |
| Evaluation route | Free tier on real data, no contract | Trial, then sales | 31-day trial, 10 GB/day | Sales-led | Free permanently |
| Operational burden | You run the cluster (unless Cloud) | Yours, or Splunk Cloud | Fully managed | Fully managed | Yours, or Wazuh Cloud |
| Data residency | Self-managed satisfies it by definition | On-prem available | Stores in India, processes in the US | Google Cloud regions | Self-managed |
| Best fit | On-prem mandates and existing ELK estates | Deepest content, largest talent pool | Microsoft-standardised estates | Retention and search at scale | Smallest budgets, with in-house skills |
Does Elastic Defend fit you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Elastic Security if…
- ✓Your mandate requires on-premises or air-gapped — most modern SIEMs are then not candidates at all
- ✓Your engineers already run Elasticsearch, so adoption is closer to enabling than migrating
- ✓You want to evaluate properly on your own data before spending anything
- ✓You want SIEM and endpoint from one agent, on one copy of your data
Choose Splunk if…
- ✓You want the deepest out-of-the-box content and the largest talent pool, and can fund it (TechBag sells it)
Choose Microsoft Sentinel if…
- ✓Your estate is Microsoft — first-party logs ingest free and SIEM shares the Defender incident queue
Choose Google Security Operations if…
- ✓Retention is your pain and twelve months of hot searchable data solves it
Choose Wazuh if…
- ✓Budget is the binding constraint and you have the in-house skills to run it — with paid support and cloud hosting available when you need them
Elastic Defend is one of 36 endpoint protection products TechBag carries. The Endpoint Protection guide narrows them to a shortlist and shows the reasoning. →
Self-managed, or managed?
Elastic is priced on deployment and subscription tier, not on gigabytes ingested — so the question that decides your bill is whether running the cluster yourself costs less than letting Elastic run it. The engine is free under AGPL; what is not free is your engineers’ time on shard strategy, index lifecycle, capacity and upgrades. Drag both sliders. Illustrative, at ₹12,000 per fully-loaded engineer-day and ~₹84/USD.
Engineer-days means real time on shard strategy, index lifecycle, capacity planning and version upgrades — not incident response. If you put 0, you are assuming the cluster runs itself, which is the assumption this calculator exists to question. Illustrative: your TechBag quote models your real tier and resources.
Three ways to consume it
Elastic is priced on your DEPLOYMENT plus a subscription tier — not per seat and not per GB ingested, which changes the arithmetic against volume-metered SIEMs at scale. The engine itself is free and open source under AGPL, so the real question is which features you need above the free tier, and who runs the cluster. Figures below are reported entry rates and scale with what you provision. TechBag scopes tier and deployment and quotes in INR with GST.
Self-managed
Best for on-prem and air-gapped
- Engine free and open source — pay for a tier above it
- Runs fully air-gapped; residency answered by definition
- You operate the cluster — price your engineers’ time
Elastic Cloud Hosted
Best if you want it managed
- Reported ~$99/mo Standard to ~$184/mo Enterprise at entry size
- Priced on provisioned resources, not per seat or per GB
- 60 regions; support charged as a % of consumption above Standard
Serverless
Best for variable volume
- Reported from ~$0.50/GB ingested plus storage per GB/month
- No cluster to size and no monthly minimum
- Consumption-based — closest to the cloud SIEM model
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every SIEM vendor
Take this into your next vendor call — including ours.
Self-managed, Cloud Hosted or Serverless? This decides your cost model AND your residency answer — settle it before comparing tiers.
If your mandate rules out SaaS, note that self-managed satisfies residency by definition. Which SIEMs on your list can actually meet that?
Which specific features do you need above the free tier? That is where the negotiable money is — and where a vendor has no incentive to talk you down.
Who runs the cluster — shard strategy, lifecycle, capacity, upgrades? Have you priced their time, or only the licence?
Out-of-the-box detection content is narrower than the Leaders. Who writes and tunes your custom rules?
Have you designed hot/warm/cold/frozen before ingesting? It is the main retention cost lever and painful to retrofit.
Are you replacing a separate EDR agent? One agent for logs and endpoint removes a rollout — count that saving.
Elastic bills in USD — have you modelled the tier and resources in INR with GST?
Questions buyers ask
Ready to evaluate Elastic Defend?
Find out what you already run, work out which tier you actually need above the free one, or get an honest Elastic-vs-Splunk comparison — in INR/GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.