Hey everyone, junior dev here. My team has been using Elastic Security (the SIEM/security part of the Elastic Stack) for a year now. We're a mid-sized SaaS on AWS. I was tasked with helping manage it because I know a bit of Terraform.
I'm trying to figure out if we should keep it. The price tag is getting noticeable on our cloud bill. 😅
The good: Setting up the agent with Terraform was straightforward. The detection rules are powerful once you get them. I like that it's not a black box.
```hcl
resource "aws_instance" "log_forwarder" {
# ... instance config
user_data = templatefile("elastic-agent.yml.tftpl", {
fleet_url = var.elastic_fleet_url
enrollment_token = var.enrollment_token
})
}
```
The not-so-good: The learning curve is steep. Tuning alerts to avoid noise took months. Also, the cost scales with data ingestion, and we sometimes get surprised by volume spikes from our own apps.
For a team with limited security experts, is it worth it? Or are we better with a more managed service? Curious about your experiences.