Start Elatsic Security and Observability

Elastic Security
1

I am working on building Elastic Security for my company. I want to monitor user login activity and receive alerts when suspicious login behavior occurs. Which Elastic product should I use for this purpose?

From what I understand, Elastic Observability is used to collect logs and other telemetry data, while Elastic Security is focused on threat detection and alerting. Should I implement Elastic Observability to gather the login logs and then use Elastic Security to detect suspicious activity and generate alerts?

I am a bit confused about how these products work together. Could you please clarify their roles and recommend study materials to better understand how to set this up? Thank you!

2

Elastic Security has specific mechanisms for collecting the relevant logs (Fleet). If you are only interested in security, you don't need to install Elastic Observability.

3

Thanks . Do I need to deploy agents to monitor if my servers have Apache Carbon , Tomcat , or application logs .. etc,.

4

You only need to install one agent on your host. You'll be able to manage them with Fleet.
I hope this solves your doubts:

The blog post:

Docs:

Cheers