Elastic Defend

---
name: elastic-defend
description: "Expert agent for Elastic Defend EDR. Covers Elastic Agent Fleet management, malware/ransomware/behavior prevention, detection rules (EQL, KQL, threshold, ML), response actions (isolate, kill process, get file), Osquery integration, and event filters. WHEN: \"Elastic Defend\", \"Elastic Security\", \"Elastic Agent\", \"Fleet\", \"EQL\", \"Elastic EDR\", \"Elastic detection rules\", \"Osquery\", \"Elastic endpoint\"."
license: MIT
---

# Elastic Defend

This skill covers Elastic Defend, the endpoint security component of the Elastic Security platform. It has deep expertise in Elastic Agent deployment via Fleet, prevention capabilities (malware, ransomware, memory threats, behavior), detection rule development (EQL, KQL, threshold, ML), response actions, and Osquery integration.

## How to Approach Tasks

When you receive a request:

1. **Identify the deployment model** — Cloud (Elastic Cloud) vs. self-managed (on-premises Elasticsearch + Kibana). Self-managed allows more customization but requires infrastructure management.

2. **Determine the license tier** — Elastic Basic (free), Gold, Platinum, or Enterprise. Prevention capabilities (ransomware, memory threat, behavioral) require at least Platinum/Enterprise license. Response actions require Platinum+.

3. **Classify the request type:**
   - **Agent deployment** — Fleet server setup and agent enrollment
   - **Prevention policy** — Protection settings configuration
   - **Detection rules** — Rule creation and management
   - **Threat hunting** — KQL/EQL queries in Discover or Security timeline
   - **Response actions** — Host isolation, process kill, file retrieval
   - **Osquery** — Live host querying via Osquery integration

4. **Analyze** — Apply Elastic Defend-specific reasoning. Understand that Elastic Defend is part of the Elastic stack — detections feed into the same index structure used for SIEM, enabling unified hunting.

## Elastic Defend Architecture Overview

**Components:**
- **Elastic Agent** — Unified agent managing Elastic Defend (endpoint), Fleet integration, and log collection
- **Fleet Server** — Management server coordinating agent policies and updates (self-managed) or hosted (Elastic Cloud)
- **Elastic Security** — Kibana application providing SIEM + EDR console
- **Elasticsearch** — Backend storage and search engine for all events and telemetry
- **Detection Engine** — Runs detection rules against incoming events (built into Elasticsearch)

**License tiers for Elastic Defend:**

| Capability | Basic (Free) | Platinum/Enterprise |
|---|---|---|
| Malware prevention | Yes | Yes |
| Ransomware prevention | No | Yes |
| Memory threat prevention | No | Yes |
| Behavior prevention | No | Yes |
| Response actions (isolate, etc.) | No | Yes |
| Osquery integration | Yes (query only) | Yes |
| ML-based detection rules | No | Yes |
| Endpoint artifacts (file, process kill) | No | Yes |

## Elastic Agent Deployment via Fleet

### Fleet Server Setup

For self-managed deployments, Fleet Server must be running before enrolling agents.

```bash
# Install Elastic Agent as Fleet Server
./elastic-agent install \
  --fleet-server-es=https://elasticsearch:9200 \
  --fleet-server-es-ca=/path/to/ca.crt \
  --fleet-server-service-token=<service_token> \
  --fleet-server-policy=fleet-server-policy
```

### Enrolling Agents (Windows)

```powershell
# Download Elastic Agent MSI
# From Kibana: Fleet > Add agent > Select OS > Copy enrollment command

# Install and enroll
.\elastic-agent.exe install `
  --url=https://fleet-server:8220 `
  --enrollment-token=<token_from_fleet>

# Verify enrollment
Get-Service ElasticAgent | Select Status
# Check Kibana: Fleet > Agents > host should appear
```

### Enrolling Agents (Linux)

```bash
# Install Elastic Agent
sudo tar -xzf elastic-agent-<version>-linux-x86_64.tar.gz
cd elastic-agent-<version>-linux-x86_64

sudo ./elastic-agent install \
  --url=https://fleet-server:8220 \
  --enrollment-token=<token_from_fleet>

# Verify
sudo systemctl status elastic-agent
```

### macOS Enrollment

```bash
sudo ./elastic-agent install \
  --url=https://fleet-server:8220 \
  --enrollment-token=<token_from_fleet>

# Grant Full Disk Access via MDM profile or System Preferences > Security & Privacy
# Required for full telemetry collection
```

## Agent Policy and Integration Management

### Creating an Elastic Defend Integration Policy

1. Navigate to: Fleet > Agent Policies > Create policy
2. Add Elastic Defend integration to the policy
3. Configure protection settings (see below)
4. Add agents to the policy

### Protection Settings (Prevention)

**Malware protection:**
- `detect` — Alert but do not block
- `prevent` — Block + Alert
- `off` — Disabled

**Ransomware protection (Platinum+):**
- Monitors for mass file encryption patterns + shadow copy deletion
- Actions: Alert / Prevent

**Memory threat protection (Platinum+):**
- Detects memory injection techniques (shellcode injection, reflective DLL loading, process hollowing)
- Actions: Detect / Prevent

**Behavior protection (Platinum+):**
- Rules-based behavioral detection (complements signature-based malware prevention)
- Uses Elastic's built-in behavioral rules
- Actions: Detect / Prevent

### Event Collection Configuration

Control which events are collected (balances telemetry completeness vs. storage cost):

```yaml
# Example policy configuration
windows:
  events:
    process: true      # Process create/terminate
    network: true      # Network connections
    file: true         # File create/modify/delete
    registry: true     # Registry changes
    dns: true          # DNS queries
    security: true     # Windows Security events (logon, etc.)
    system: true       # System events

linux:
  events:
    process: true
    network: true
    file: true
    session_data: true  # TTY session recording (Platinum+)
```

**Storage impact note:** Full event collection on endpoints generates significant data. Tune collection to match storage capacity and hunting requirements. Minimum recommended: process, network, dns.

## Detection Rules

Elastic Security supports multiple rule types for endpoint detection.

### Rule Types

| Type | When to Use | Example |
|---|---|---|
| EQL (Event Query Language) | Sequence detection, process trees | Office app → PowerShell |
| KQL (Kibana Query Language) | Simple event matching | Single event pattern |
| Threshold | Rate-based anomalies | N failed logins in X minutes |
| Machine Learning | Behavioral anomalies | Unusual process activity |
| Indicator Match | IOC matching against threat intel | Hash in threat feed |
| New Terms | Detect first-seen values | New process seen for first time |

### EQL Rules (Most Powerful for EDR)

EQL enables sequence detection across multiple events — the most powerful rule type for behavioral detection.

**EQL syntax:**
```eql
// Single event
process where process.name == "powershell.exe" and
  process.command_line like~ ("*-enc*", "*-encodedcommand*", "*bypass*")

// Sequence (events must occur in order within timeframe)
sequence with maxspan=5m
  [process where process.name in ("winword.exe", "excel.exe", "outlook.exe")]
  [process where process.name in ("cmd.exe", "powershell.exe", "wscript.exe", "mshta.exe")]

// With session tracking (same process tree)
sequence by process.entity_id
  [process where event.type == "start" and process.name == "powershell.exe"]
  [network where network.direction == "outbound"]
```

### Key EQL Fields for Elastic Defend

| Field | Description |
|---|---|
| `process.name` | Process filename |
| `process.command_line` | Full command line |
| `process.parent.name` | Parent process name |
| `process.executable` | Full path of executable |
| `process.hash.sha256` | SHA256 hash |
| `user.name` | Executing username |
| `host.name` | Endpoint hostname |
| `network.direction` | inbound / outbound |
| `destination.ip` | Remote IP |
| `destination.port` | Remote port |
| `dns.question.name` | DNS query |
| `file.path` | File path |
| `file.hash.sha256` | File hash |
| `registry.path` | Registry key path |
| `registry.value` | Registry value |

### EQL Rule Examples

**Encoded PowerShell execution:**
```eql
process where host.os.type == "windows" and event.type == "start" and
  process.name : "powershell.exe" and
  process.command_line : ("*-EncodedCommand*", "*-enc *", "*-e *", "*-nop*")
```

**Office spawning scripting engine:**
```eql
sequence with maxspan=30s
  [process where host.os.type == "windows" and event.type == "start" and
    process.name : ("WINWORD.EXE", "EXCEL.EXE", "OUTLOOK.EXE", "POWERPNT.EXE")]
  [process where host.os.type == "windows" and event.type == "start" and
    process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe",
                    "mshta.exe", "regsvr32.exe", "rundll32.exe")]
```

**LSASS memory dumping:**
```eql
process where host.os.type == "windows" and event.type == "start" and
  process.name : ("procdump.exe", "procdump64.exe") and
  process.args : "*lsass*"
```
```eql
// Generic LSASS read via cross-process
process where process.pe.original_file_name == "lsass.exe"
  /* Exclude system processes */
  and not process.parent.name in ("services.exe", "wininit.exe", "csrss.exe")
```

**Persistence via run key:**
```eql
registry where host.os.type == "windows" and
  registry.path : (
    "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
    "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*"
  ) and
  not process.name : ("msiexec.exe", "regini.exe", "setup.exe")
```

**Ransomware mass file rename:**
```eql
sequence by process.entity_id with maxspan=2m
  [file where host.os.type == "windows" and event.action == "rename" and
    file.extension != "" and
    not file.path : ("C:\\Windows\\*", "C:\\Program Files\\*")]  with runs=50
```

### Prebuilt Detection Rules

Elastic provides 500+ prebuilt detection rules:
1. Navigate to: Security > Rules > Detection Rules
2. Click "Add Elastic rules"
3. Import rules by category (Lateral Movement, Credential Access, etc.)
4. Enable rules appropriate for your environment

**Enable rules for MITRE ATT&CK coverage:**
- Filter by: MITRE ATT&CK technique
- Enable all High severity rules initially in Alert-only mode
- Move to Block mode for highest-confidence rules

## Event Filters and Exceptions

### Event Filters (Reduce Noise at Ingestion)

Event filters prevent certain events from being stored — useful for high-volume legitimate processes:

1. Navigate to: Security > Manage > Event Filters
2. Create filter:
   - Process: `svchost.exe`
   - Filter: All network events from svchost.exe (if network monitoring is too noisy)

**Use carefully** — Event filters permanently exclude data from storage; this data will not be available for hunting.

### Exceptions (Rule-Level Suppression)

Exceptions suppress alerts from specific rules for known-good activity:

1. Navigate to: Security > Rules > open a rule
2. Click "Exceptions" tab
3. Add exception:
   - Operator (is, is not, matches, contains)
   - Field value pairs
   - Scope: This rule only, or shared exceptions list

**Endpoint artifact exceptions** (for prevention policy):
1. Navigate to: Security > Manage > Trusted Applications
   - Whitelist specific binaries from all behavioral analysis
2. Navigate to: Security > Manage > Blocklist
   - Block specific hashes globally regardless of prevention policy

## Response Actions (Platinum+)

Elastic Defend supports response actions directly from Security alerts.

### Available Actions

| Action | Description |
|---|---|
| Isolate host | Cut off all network except Elasticsearch/Fleet communication |
| Release host | Remove network isolation |
| Kill process | Terminate a running process by PID or entity ID |
| Suspend process | Suspend (pause) a process for investigation |
| Get file | Retrieve a file from endpoint to Kibana |
| Run Osquery | Execute an Osquery query against the endpoint |
| Execute script | Run a shell command (requires additional configuration) |

### Initiating Response Actions

**From an alert:**
1. Navigate to: Security > Alerts > click alert
2. Click "Respond" button
3. Select action type
4. Confirm action

**From Endpoints:**
1. Navigate to: Security > Manage > Endpoints
2. Click endpoint
3. Actions menu

**Via API:**
```python
# Isolate an endpoint via Elasticsearch API
import requests

headers = {
    "kbn-xsrf": "true",
    "Content-Type": "application/json",
    "Authorization": "ApiKey <api_key>"
}

# Isolate host
response = requests.post(
    "https://kibana:5601/api/endpoint/action/isolate",
    headers=headers,
    json={"endpoint_ids": ["endpoint_id_here"]}
)
```

### Response Console (Beta/Preview)

For direct shell-like interaction with endpoints:
1. Navigate to: Security > Manage > Endpoints > click endpoint
2. Click "Respond" button > "Response Console"
3. Available commands:
   ```
   isolate
   release
   kill-process --pid 1234
   suspend-process --pid 1234
   get-file --path "C:\Windows\Temp\suspicious.exe"
   status  (check action status)
   ```

## Osquery Integration

Osquery enables live SQL queries against endpoint state — powerful for investigation and compliance.

### Osquery Query Examples

**Run ad-hoc Osquery from Kibana:**
1. Navigate to: Security > Osquery > Live Queries
2. Select target host(s) or groups
3. Enter Osquery SQL and execute

**Useful investigation queries:**

```sql
-- List running processes with full path
SELECT pid, name, path, cmdline, uid FROM processes ORDER BY start_time DESC LIMIT 100;

-- List network connections
SELECT pid, local_address, local_port, remote_address, remote_port, state, p.name
FROM process_open_sockets JOIN processes p USING (pid)
WHERE state = 'ESTABLISHED' ORDER BY p.name;

-- Check startup items
SELECT name, path, status, source FROM startup_items;

-- List scheduled tasks (Windows)
SELECT name, action, path, enabled, hidden FROM scheduled_tasks WHERE enabled = 1;

-- Check installed software
SELECT name, version, install_date FROM programs ORDER BY install_date DESC LIMIT 50;

-- Recent login events
SELECT username, type, tty, host, time, pid FROM last ORDER BY time DESC LIMIT 50;

-- Check for LSASS dumps
SELECT path, size, mtime FROM file
WHERE path LIKE 'C:\%' AND filename LIKE '%lsass%' AND filename LIKE '%.dmp';
```

### Osquery Scheduled Packs

Configure recurring Osquery queries to run on a schedule (for continuous monitoring):

1. Navigate to: Fleet > Agent Policies > select policy
2. Elastic Defend integration > Osquery Manager
3. Add query pack with schedule (cron expression)
4. Results flow into Elasticsearch and are visible in Kibana

## Key Considerations for Elastic Defend

### Cost Awareness

Elastic Defend telemetry can generate significant Elasticsearch storage costs:
- Process events: ~1-2GB/endpoint/day (varies by activity)
- Full event collection (all categories): ~5-10GB/endpoint/day
- Implement Index Lifecycle Management (ILM) to automatically tier and delete old data

**Cost optimization:**
- Use event filters to reduce high-volume, low-value events
- Configure ILM hot/warm/cold/delete phases for endpoint data index
- Consider shorter retention for raw events (7-14 days hot) vs. alerts (90+ days)

### Open-Source Core

Elastic Defend's core detection rules and agent code are available on GitHub:
- Detection rules: `github.com/elastic/detection-rules`
- Elastic Agent: `github.com/elastic/elastic-agent`
- Protections artifacts: `github.com/elastic/protections-artifacts`

This allows:
- Reviewing exactly what detection rules do
- Contributing custom rules back to the community
- Running the stack without vendor lock-in (Elastic License 2.0 for most components)

Note: Some features (ML rules, some response actions) require a paid license even with self-managed deployment.