I am working on building Elastic Security for my company. I want to monitor user login activity and receive alerts when suspicious login behavior occurs. Which Elastic product should I use for this purpose? From what I understand, Elastic Observability is used to collect logs and other telemetry da…

Thanks . Do I need to deploy agents to monitor if my servers have Apache Carbon , Tomcat , or application logs .. etc,.

You only need to install one agent on your host. You'll be able to manage them with Fleet. I hope this solves your doubts: [image] Elastic Agent | Elastic Elastic Agent delivers endpoint security and remediation, and simpler and faster telemetry collection, with secure centralized agent…

Start Elatsic Security and Observability

Elastic Security

Sergi_Massaneda_Dona (Sergi Massaneda) May 27, 2025, 8:47am 2

Elastic Security has specific mechanisms for collecting the relevant logs (Fleet). If you are only interested in security, you don't need to install Elastic Observability.

Topic		Replies	Views
Fleet and Suricata for Elastic Security SIEM fleet	2	1282	February 23, 2022
Elastic Serverless: Agent deployment when using both Observability and Security Elastic Agent	0	28	January 21, 2026
No data/log from elastic agent on Security onion Elastic Agent	4	58	May 6, 2026
Best Way to Set Up Elastic Security for Threat Detection and Monitoring? Elastic Security	2	184	October 29, 2024
Elastic Security Endpoint Security Elastic Security	1	321	August 24, 2022

Start Elatsic Security and Observability

Related topics