Elastic Security: Securing your cloud assets with cloud security posture management

Learn how Elastic Security helps you protect your organization by unifying SIEM, endpoint, and cloud security.

Experience Elastic Security for yourself with this interactive demo.

Before you get started with Elastic’s Endpoint Security, make sure you've set up Elastic’s SIEM solution first. If you haven’t, check out the SIEM getting started guide.

If you’re already set up SIEM, continue following the instructions below:

Once your deployment is ready, under the Security tab, select Secure my cloud assets with cloud security posture (CSPM).

Upon selecting Cloud Security Posture Management (CSPM), you'll be prompted to add the integration which enables discovery and evaluation of services in your cloud environment such as storage, compute, IAM, and more so you can identify and remediate configuration risks that could undermine the confidentiality, integrity, and availability of your data in the cloud.

Next, you'll configure the integration. First, you'll select the cloud provider you want to monitor:

• Amazon Web Services (AWS)
• Google Cloud (GCP)

The Elastic Security for Cloud CSPM feature can be configured to perform evaluations at the organization level to ensure full coverage or at the individual account level within an organization. Note you will need appropriate permissions, scoped for organizational or account-level access, to complete the setup of CSPM. For an initial proof of concept and the purpose of getting started, we'll choose Single Account.

You can also give it a name and description, but this is optional.

For Setup Access, depending on the cloud provider you wish to monitor, Elastic provides two options:

• AWS Cloud Formation / Google Cloud Shell: These options use native infrastructure as code (IaC) tools that provision infrastructure inside of your cloud environments automatically. With this option, in a couple of clicks, you'll begin evaluating the security posture of your cloud environments.
• Manual: The manual option requires you to provision the infrastructure used for CSPM in your environment manually.

For this guide, we'll automatically provision our infrastructure, so select AWS Cloud Formation or Google Cloud Shell.

Be sure you follow the series of steps outlined in Setup Access, which include logging into your cloud provider.

Once you do this, click Save and continue, and you'll see a pop-up modal appear. On the pop-up, you'll see you can launch your preferred native IaC tool to provision the necessary infrastructure inside of your cloud automatically.

Now, a new window will open, taking you to your preferred cloud provider's console. To follow along and experience what it will be like to launch your preferred IaC tool in AWS or GCP once you click Save and continue, follow along in this guided tour.

Provisioning your infrastructure will take a few minutes. As the necessary infrastructure and permissions are getting provisioned, if you navigate back to the Elastic Cloud console where you were adding the Cloud Security Posture Management (CSPM) integration, you'll see an Add agent fly out.

Once all the necessary infrastructure has been provisioned in your cloud, you’ll see that elastic-agent has been enrolled, and posture data is coming in. From here, you can select View Assets.

The Cloud Posture dashboard summarizes the overall security posture of your cloud environments.

• Number of accounts you've enrolled
• Number of resources evaluated
• Failed findings

Your posture score tells you how securely configured your overall cloud environment is.

The Findings page displays each individual resource evaluated by the CSPM integration and whether the resource passed or failed the secure configuration checks against it, for more information on Findings, such as how to group and filter them, check out our documentation.

Some rules, more than others, you may want to monitor closely. You can select a finding for that particular rule and click Take action in the lower right. Then click Create a detection rule.

Next click View rule.

Now, you'll see the detection rule, along with its definition. Now, whenever there is a failed finding for this rule, you'll get an alert. To set up other actions, click Edit rule settings on the upper right of the rule page.

Next you'll select, Actions.

From here, you can set up actions. For example, if a rule fails, you set up a Slack message, Jira ticket, etc., so you get a proactive notification to review the failed finding and remediate the misconfiguration. To learn more about detection rules, check out our documentation.

• Get started with detecting threats in my data with SIEM
• Get started with securing your hosts with endpoint security
• Elastic Security Labs
• Threat hunting guide
• Guide to high-volume data sources for SIEM