I've noticed some confusion in a few recent threads about how to get started with Elastic Endpoint Security. The main question seems to be: "Do I use Fleet, or just install the standalone agent?" It's a fair question, and the answer really depends on what you're trying to do and how you want to manage it.
Think of the standalone Elastic Endpoint agent as a single, all-in-one package. You download it, install it on a host, and it connects directly to your Elasticsearch cluster to send security data (like process and network events). It's straightforward, but you manage each agent's policy directly on that host. This can become a scaling challenge.
Fleet, on the other hand, is the centralized management plane inside Kibana. When you use Fleet, you're deploying the *same* Elastic Endpoint agent, but its configuration, policy updates, and overall lifecycle are controlled from a single console. You can roll out updates, see agent health, and manage thousands of endpoints from one place. The agent becomes a "Fleet-managed agent."
So the core difference isn't in the agent's capabilities on the endpoint, but in *how you manage it*. For a single server or a lab, the standalone agent might be simpler. For any real production environment or team workflow, you'll want the consistency and oversight that Fleet provides. It's the difference between handing someone a configured laptop and managing an entire company's devices with an MDM.
I'm curious—for those who have tried both paths, what was the operational hurdle that made you choose one over the other? Was it the existing infrastructure, or a specific feature?
- GG
- GG