# What Can I Do with Elastic SIEM Free Tier? (Capabilities and Limitations)
**URL:** https://discuss.elastic.co/t/what-can-i-do-with-elastic-siem-free-tier-capabilities-and-limitations/383103
**Category:** SIEM
**Tags:** license
**Created:** [October 30, 2025, 1:54pm UTC](https://discuss.elastic.co/t/what-can-i-do-with-elastic-siem-free-tier-capabilities-and-limitations/383103 "2025-10-30T13:54:25Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@cyberfury](https://discuss.elastic.co/u/cyberfury)
#### Post date: [October 30, 2025, 1:54pm UTC](https://discuss.elastic.co/t/what-can-i-do-with-elastic-siem-free-tier-capabilities-and-limitations/383103/1 "2025-10-30T13:54:25Z")
Hi everyone,
I’ve successfully installed on premises **Elasticsearch, Logstash, Kibana, and Elastic Agent/Fleet Server** on my Ubuntu server. I’m now exploring the **SIEM features** in the **Elastic Stack free tier** , but I’m a bit unclear about what capabilities are available and what’s limited compared to the paid (Standard/Enterprise) licenses.
Specifically, I’d like to know:
- What core SIEM functionalities are included in the free tier?
- Which features (like detections, cases, threat intelligence, or rule automation) are restricted?
- Are there any practical use cases I can still implement using the free tier for learning or small-scale monitoring?
Any insights or official documentation links would be really helpful. Thanks in advance!
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 30, 2025, 2:01pm UTC](https://discuss.elastic.co/t/what-can-i-do-with-elastic-siem-free-tier-capabilities-and-limitations/383103/2 "2025-10-30T14:01:42Z")
It is better to start with the subscription page where you have a list of features that are available with the free license and the ones that requires a paid license.
> **[Subscriptions | Elastic Stack Products & Support | Elastic](https://www.elastic.co/subscriptions)**
>
> See subscription levels, pricing, and tiered features for on-prem deployments of the Elastic Stack (Elasticsearch Kibana, Beats, and Logstash), Elastic Cloud, and Elastic Cloud Enterprise....
You can do a lot with the free license, but some of the main limitations is that you cannot send your alerts elsewhere, all Kibana Connectors that send alerts to email, webhook or other external destinations requires a paid license.
But there are workarounds, you can use logstash to read your alerts index and send it to any place you want for example.
Also, AI and machine learning tools requires a Platinum and some cases an Enterprise license.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 27, 2025, 2:02pm UTC](https://discuss.elastic.co/t/what-can-i-do-with-elastic-siem-free-tier-capabilities-and-limitations/383103/3 "2025-11-27T14:02:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.