As cited
Copy frozen at (site build).
How Elastic Infosec Optimizes Defend for Cost and Performance
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
cloud saas
How Elastic Infosec Optimizes Defend for Cost and Performance
Elastic's internal security team reduced endpoint detection and response (EDR) event volume by 75% percent, from 48,000 to 12,000 events per host per hour, using event filtering and advanced policy tuning in Elastic Defend. The optimization involved identifying noisy processes and benign system activity through queries, applying targeted event filters at the endpoint, and disabling unnecessary hash calculations and enabling event aggregation. The changes yielded 100 terabytes per month in storage savings across their 4,000-host fleet while maintaining security visibility.
Why it matters: Security teams managing large endpoint fleets can reduce EDR costs by thousands of dollars monthly and improve analyst signal-to-noise ratios by applying similar filtering and tuning strategies to their own Elastic Defend deployments.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
cloud saas
How Elastic Infosec Optimizes Defend for Cost and Performance
Elastic's internal security team reduced endpoint detection and response (EDR) event volume by 75% percent, from 48,000 to 12,000 events per host per hour, using event filtering and advanced policy tuning in Elastic Defend. The optimization involved identifying noisy processes and benign system activity through queries, applying targeted event filters at the endpoint, and disabling unnecessary hash calculations and enabling event aggregation. The changes yielded 100 terabytes per month in storage savings across their 4,000-host fleet while maintaining security visibility.
Why it matters: Security teams managing large endpoint fleets can reduce EDR costs by thousands of dollars monthly and improve analyst signal-to-noise ratios by applying similar filtering and tuning strategies to their own Elastic Defend deployments.
- Source published
- First seen by Cybersecurity Tracker