Elastic Security (Threat Hunting)
by Elastic N.V.
Elastic Security is a leading open-source-based threat hunting tool in cyber security — offering 1,000+ MITRE ATT&CK mapped detection rules, Osquery live endpoint interrogation, EQL (Event Query Language) for structured hunting, and Elastic AI Assistant for natural language hunt investigation across unlimited data ingestion.
Starting Price
Elastic Cloud from $95/month; Security from Platinum tier; enterprise on quote at elastic.co
G2
Gartner
Capterra
Ratings & Reviews
Key Features
- EQL (Event Query Language) — Purpose-Built Threat Hunting Language
- Osquery Integration — Real-Time Endpoint State Interrogation
- 1
- 000+ MITRE ATT&CK Mapped Detection Rules
- Elastic AI Assistant — Natural Language Hunt Investigation
- Attack Discovery AI — Automated Threat Prioritization
- Elastic Defend EDR — Full Telemetry for Hunt Operations
- Timelines — Visual Hunt Investigation Workbench
- Sessions View — Linux Process Tree Visualization
- Prebuilt Hunt Queries — MITRE ATT&CK Technique Coverage
- Unlimited Data Ingestion — No EPS Caps
- Cloud Security Hunting (CSPM + KSPM)
- Self-Managed Deployment for Air-Gapped Hunt Operations
- Fleet Management — Centralized Agent Deployment for Hunt
Pros & Cons
Pros
- +Best open-source threat hunting tool — EQL purpose-built for threat hunting
- +not adapted from log analytics
- +Osquery enables real-time live endpoint interrogation during active hunts — unique capability
- +1
- +000+ MITRE ATT&CK mapped hunt queries out of box — comprehensive coverage
- +Unlimited data ingestion — hunt across all historical data without cost caps
- +Elastic AI Assistant enables natural language hunt investigation
- +Self-managed deployment for classified and air-gapped hunt environments
- +Most developer-friendly — full Kibana customization for custom hunt dashboards
Cons
- −Requires query language expertise (EQL/KQL) — steeper than pure no-code tools
- −Per-GB pricing can escalate for very high data volume hunt operations
- −EDR agent (Elastic Defend) less mature than CrowdStrike or SentinelOne
- −Requires dedicated engineering resources for optimal deployment
- −Less suitable for teams without internal DevOps capability
Best For
Technology-mature security and hunt teams wanting an open-source threat hunting tool with purpose-built EQL query language, unlimited data ingestion, real-time Osquery endpoint interrogation, and the flexibility to build custom hunt workflows without vendor lock-in.
Target Audience
Enterprise, Mid-Market, Technology Companies, MSSPs, Developer-Led Security Teams
Key Integrations
Competitor Tools
Pricing
Model
Consumption-based per GB ingested; Security hunting from Platinum tier (~$0.13/GB/month); enterprise on quote
Starting At
Elastic Cloud from $95/month; Security from Platinum tier; enterprise on quote at elastic.co
Free Trial
Yes — 14-day free Elastic Cloud trial at elastic.co; free tier with limited featuresCompany Info
Founded
2012
Headquarters
San Francisco, CA, USA
Employees
3,800+
Company Size
All sizes — strongest for engineering-driven security and hunt teams
Funding
Public (NYSE: ESTC) — Market Cap ~$12B (January 2026)
Certifications
Awards & Recognition
Gartner Magic Quadrant Challenger — SIEM 2025 | SC Awards Best Open Source Security Tool 2025 | G2 Leader — Log Management 2026 | Forrester Wave Notable Vendor — XDR 2025
Data sourced from G2, Gartner & Capterra · Verified by Firmographic