# Elastic Defend Licensing

**URL:** <https://discuss.elastic.co/t/elastic-defend-licensing/366405>\
**Category:** Endpoint Security\
**Created:** [September 11, 2024, 11:09am UTC](https://discuss.elastic.co/t/elastic-defend-licensing/366405 "2024-09-11T11:09:36Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mike123](https://avatars.discourse-cdn.com/v4/letter/m/ecc23a/32.png) [@mike123](https://discuss.elastic.co/u/mike123)\
**Post date:** [September 11, 2024, 11:09am UTC](https://discuss.elastic.co/t/elastic-defend-licensing/366405/1 "2024-09-11T11:09:37Z")

</div>

Hi team, We are analyzing Elastic stack for our security needs. we are testing Elastic defend for forwarding logs.

```auto
After the Elastic Agent is installed with the Elastic Defend integration, several protections features — including preventions against malware, ransomware, memory threats, and malicious behavior — are automatically enabled on protected hosts (some features require a Platinum or Enterprise license). I

```

The above para is from [documentation](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). In that it is mentioned that platinum / enterprise license is required for enabling Protection features. If so basic license is enough for log collection right? Can someone confirm this?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [September 11, 2024, 3:21pm UTC](https://discuss.elastic.co/t/elastic-defend-licensing/366405/2 "2024-09-11T15:21:20Z")

</div>

From #Elastic Agent to #Endpoint Security

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [September 11, 2024, 3:25pm UTC](https://discuss.elastic.co/t/elastic-defend-licensing/366405/3 "2024-09-11T15:25:11Z")

</div>

Hi @mike123 Welcome to the community!

First think I would do is look at this page to get an undersanding of the Licensing Levels - Note there is Slight Difference with Self managed and Cloud

> **[Subscriptions | Elastic Stack Products & Support | Elastic](https://www.elastic.co/subscriptions)**
>
> See subscription levels, pricing, and tiered features for on-prem deployments of the Elastic Stack (Elasticsearch Kibana, Beats, and Logstash), Elastic Cloud, and Elastic Cloud Enterprise....

> [@mike123](#):
>
> If so basic license is enough for log collection right? Can someone confirm this?

Absolutely Log Collection is Basic... for most integrations ... there are a couple that are licensed... Do you have a specific integration / question?

---

<div class="post-metadata">

**Author:** ![caitlinbetz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/caitlinbetz/32/74246_2.png) [@caitlinbetz](https://discuss.elastic.co/u/caitlinbetz)\
**Post date:** [September 11, 2024, 4:12pm UTC](https://discuss.elastic.co/t/elastic-defend-licensing/366405/4 "2024-09-11T16:12:17Z")

</div>

Hi @mike123 . Thanks for taking a look at Elastic Security.

Correct - the Basic license is sufficient for telemetry /event collection with Elastic Defend. The basic license also includes Malware protection via Elastic Defend.

The additional protections available through Defend (Ransomware, memory threat, malicious behavior) require at least the Platinum license. The link Stephen provided above - [Subscriptions | Elastic Stack Products & Support | Elastic](https://www.elastic.co/subscriptions) - contains those details (scroll down to the Elastic Security section!)

---

<div class="post-metadata">

**Author:** ![mike123](https://avatars.discourse-cdn.com/v4/letter/m/ecc23a/32.png) [@mike123](https://discuss.elastic.co/u/mike123)\
**Post date:** [September 12, 2024, 3:45am UTC](https://discuss.elastic.co/t/elastic-defend-licensing/366405/5 "2024-09-12T03:45:53Z")

</div>

Thanks for the swift response. Will evaluate Elastic defend and get license if needed.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 10, 2024, 3:46am UTC](https://discuss.elastic.co/t/elastic-defend-licensing/366405/6 "2024-10-10T03:46:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.