Comparisons anchored on Elastic Security, the SIEM and endpoint security solution on Elasticsearch and Kibana: against OpenSearch Security Analytics, and between its tiers, hosting models and deployment options.
The SIEM layer on each engine: Elastic's detection engine, prebuilt ELv2 rules, Timeline and Cases against OpenSearch Security Analytics with Sigma rules and correlations under Apache-2.0. Which detections need a paid Elastic tier and what OpenSearch leaves to you.
What self-managed Elastic Security includes in the free Basic tier versus Platinum (detection engine, anomaly detection, cases) and Enterprise (malware and ransomware prevention, host isolation, SSO), and what Platinum no longer being sold to new customers means for buyers.
Elastic's usage-priced Security Serverless tiers against running Elastic Security yourself with node and RAM based licensing: published ingest and retention rates, what is included, data location and operating work, and when self-managed wins.
Running Elastic Agent for Elastic Security under central Fleet management in Kibana versus standalone with local configuration: upgrades, policy changes, Fleet Server needs, air-gapped and locked-down hosts, and why Elastic reserves standalone mode for advanced users.
Deploying a self-managed Elastic Security stack with the ECK operator against packages on virtual machines: what ECK automates, Basic versus Enterprise ECK features, node roles and storage tiers, and the team skills each path assumes.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.