It is a very scalable solution...I didn't face any problem with this scalability part of the solution since we only have a few pieces of equipment in our company.
The tool is huge, and it performs brilliantly. I tested it for malware, and within two weeks of launching, the product alerted me about a network intrusion. This was a tough test for it, but it performed admirably. The alerting system is excellent, and searching through logs is incredibly efficient. What's impressive is that all three products or options are integrated into one solution. This means I don't need separate logging, monitoring, or antivirus solutions.
The tool's most powerful aspect is its search engine capability. It's a highly effective and powerful solution for searching. We use it in professional and student projects at universities, and it delivers promising results.
Engineering at a security firm with 10,001+ employees
May 28, 2024
The detection rules in Elastic Stack are the most valuable feature. The search capabilities are excellent and fast. As we collect logs from workstations and devices, the detection rules run on top of the logs and detect any suspicious activity, raising alerts accordingly. Integration with Elastic Stack depends on the specific integration. Elastic provides some bridging integrations that make it easy, but require custom integration. Most integrations are simple, but customization can be challenging because we need to do some parsing. There's something called Elastic Common Schema, and we need to parse the source logs to match this schema, which can be a bit challenging.
Chief Operating Officer at Integra Micro Software Services, Bangalore
Mar 27, 2024
Elastic Stack is mainly used to monitor servers and APIs. It helps ensure the software's availability and sends notifications at the right time so the system is not down for a long time. The tool's stability and advanced features, such as anomaly detection, are the most valuable features. The benefit of using it is real-time monitoring.
Prior to the latest updates, data lake management was a standout feature. The hybrid capability for on-premise and cloud integration was also crucial. Now, with Elastic Defense, the agent simplifies security monitoring, making it a key asset.
The implementation of dashboards in the solution needs to be made easier...I had some issues with the ports and configuration since it was kind of complex to implement with Docker.
Elastic Stack's search capabilities can be challenging, especially when searching for precise data from past years, such as two or ten years ago. Its indexing performance for exact data retrieval may decrease as the data volume grows. Therefore, I believe there is room for improvement in the product's search functionality. It needs to improve its pricing as well.
Engineering at a security firm with 10,001+ employees
May 28, 2024
Improving integration capabilities, especially with authentication systems, firewalls, and security controls, is a crucial area for improvement in Elastic Stack. Additionally, enhancing functionality to handle large Yara queries more efficiently would be beneficial, as many EDR solutions can run such queries faster than Elastic Stack's current limitations.
Chief Operating Officer at Integra Micro Software Services, Bangalore
Mar 27, 2024
The solution is expensive, particularly the training and certification. If customers want to increase their use of Elastic Stack, they should consider reducing the cost of certification and training.
When people try to move the data from another source to Elastic Stack for visualization, they face challenges when connecting to Elastic Stack from such different sources.
