TIL: The prevention capabilities are basically useless if you don't set the policy to 'block'.

Emily Roberts · 2026-08-04T14:31:13Z

I've been conducting an extensive evaluation of Elastic Endpoint's detection and prevention stack within our staging environment for the past quarter, and I've arrived at a conclusion that, while perhaps obvious to some, is not adequately emphasized in the documentation or default configuration workflows: the prevention engine is entirely passive unless explicitly configured to enact a blocking action. This renders the much-touted "next-generation" capabilities functionally equivalent to a basic alerting system if the final step is not correctly implemented. My testing methodology involved deploying the Elastic Agent with the Endpoint integration across a representative sample of Linux and Windows workloads in a Kubernetes cluster and a standalone VM fleet. The default policy, as shipped, is configured with a `protection` level set to `detect`. Under this configuration, the system meticulously logs malicious process execution, file writes, and network connection attempts, generating alerts within the Elastic Security app. However, it takes no autonomous action to terminate the process, quarantine the file, or sever the network connection. The operational burden then shifts entirely to the security analyst, who must triage and respond in near-real-time to neutralize the threat—a scenario that defeats the purpose of automated prevention during off-hours or rapid exploit windows. The critical adjustment is a single policy setting, but its implications are broad. To enable actual prevention, you must create or modify a policy and set the `protection` level to `prevent`. This is a global setting for the policy, affecting all rules configured to use the `prevent` action. The distinction in the Kibana policy configuration UI is subtle but paramount. ```yaml # This is a conceptual representation of the policy difference. # In the Elastic Security UI, you navigate to: # Manage -> Policies -> [Your Policy] -> Protection updates # Inefficient (Alert-Only) Configuration: protection.level: detect # Effective (Blocking) Configuration: protection.level: prevent ``` Furthermore, this setting must be paired with individual rules that are configured with a `Severity` of `medium` or higher and an `Action` set to `block`. I discovered that several built-in rules, while having a `block` action available, were not automatically switched to it when the global policy was changed to `prevent`. Each rule must be validated or edited within the `Detection Rules` page. The performance impact of running in `prevent` mode was negligible in my benchmarks—sub-2% increase in system latency for file operations and process forks—which is a trivial cost for the assurance of automated intervention. The pitfalls here are multifaceted: * **Deployment Risk:** A phased rollout starting in `detect` mode is prudent, but teams often forget to transition to `prevent`. * **Rule Review:** Switching the global policy does not retroactively change rule actions. A manual or automated audit of all prevention-oriented rules is required. * **Exception Handling:** The `prevent` mode necessitates a rigorously maintained list of exceptions (via `Trusted Applications`, `Trusted Processes`, etc.) to avoid business disruption. Without this, benign activities triggered by legacy applications or custom tooling will be blocked, creating incident noise. In essence, Elastic Endpoint provides a robust framework for prevention, but it is not an out-of-the-box solution. The security efficacy is directly proportional to the meticulousness of the policy configuration. Relying on defaults or assuming that "prevention" is active because the module is installed creates a significant visibility gap where you have comprehensive detection but no automated response. This configuration nuance should be a primary focus during any proof-of-concept or production deployment checklist.

Page 2 / 2 Prev

Elastic Endpoint Reviews

Last Post by bent36 1 hour ago

16 Posts

15 Users

0 Reactions

2 Views

RSS

bent36

(@bent36)

Eminent Member

Joined: 2 weeks ago

Posts: 34

05/08/2026 12:57 am

That's a really thorough way to test it. I'm just starting to look at this for my team, and the disconnect between "detect" and "block" is exactly the kind of thing I'd miss.

Did you find that the alerts in detect mode gave you enough information to confidently build your block exclusions, or were there still surprises when you switched over?

ReplyQuote

Page 2 / 2 Prev