We made the switch about four months back, after the last Defender update broke a critical automated report. Management was sold on Elastic's "single pane" promise for our mixed Linux/Windows environment. Here's what I've found so far.
The good:
* Detection engine is solid, especially for Linux. The queries are more transparent than Defender's black box.
* The Kibana interface is powerful for building custom dashboards, once you get past the learning curve.
* Resource usage on endpoints is lighter than I expected, even with all features enabled.
The bad:
* The UI/API changes between minor versions are not backward-compatible. Had to rebuild two key alerting rules last month after an update. Their documentation lagged by a week.
* Mobile app is practically useless for anything beyond basic alert triage. Don't expect to manage policies or run remote scripts.
* Support is slow for anything that isn't a critical outage. Took three weeks to get clarification on a specific API rate limit for our deployment size.
The verdict: It's a powerful tool, but it's not a set-and-forget replacement. You need dedicated analyst time to maintain it. If your team can't handle occasional workflow breaks after updates, stick with something more stable. For us, the visibility trade-off is worth the extra admin overhead—for now.
-- CRM Surfer
Your CRM is lying to you.
I'm a senior SRE at a fintech, we manage about 800 endpoints across three clouds and have both Defender and Elastic Endpoint in production on different teams due to a past acquisition.
* **Integration tax:** The "single pane" promise is real but expensive. You get native correlation with Beats/Agent logs and APM traces, but you must ingest all endpoint data into your Elastic cluster. At our scale, that added ~20% to our existing Elastic licensing costs. Defender's integration with Azure/M365 is zero-config but locks you into that ecosystem.
* **Management overhead:** Elastic's detection rules are transparent YAML, which is great. But you're correct about maintenance. We dedicate about 5-6 analyst hours weekly to tune alerts and adapt to schema changes. Defender's managed rules are truly set-and-forget, but you trade off control for that.
* **Support tier reality:** Their platinum/enterprise support is mandatory for timely help. On a standard support plan, our experience mirrors yours, 10-15 business day waits for non-critical tickets. Microsoft's support is consistently poor, but the community and Premier support channels are more populated.
* **Windows depth vs. Linux parity:** Defender's deep OS integration on Windows gives it an edge on script behavior and attack surface reduction rules. For our Linux servers, Elastic's detection felt more native and queryable. If your estate is >70% Windows, Defender's native hooks are a tangible advantage.
I'd push the team using Defender to move to Elastic only if they already have a mature Elastic Stack team and need deep forensic query capability across OS types. If your team is mostly Windows and can't spare the analyst cycles, switching back might be the pragmatic move. Tell us the size of your SecOps team and the Windows/Linux ratio to make it clear.
alert only when it matters