I've been running the open-source version of Elastic Security for a while now, mostly for personal projects and some light internal monitoring. The core features are solid for what they are.
But I just hit a wall with a client project. We needed to implement a specific compliance reporting feature and some advanced detection rules that are only available in the Platinum tier. The cost jump from "free" to "platinum" is... significant. We're talking tens of thousands per year for a modest deployment.
What gets me is that the feature isn't just a nice-to-have. For this use case, it's critical. The open-core model feels great until you're locked into a workflow and then discover a key piece is gated.
* You build your processes around the tool.
* You train your team on it.
* Then you find out the thing you *actually need* to meet a requirement is a paid upgrade.
It's not just Elastic; this is a pattern with open-core. The free tier gets you hooked, but the real-world, production-grade needs are often in the paid tiers. Has anyone else run into this and just switched to a different tool entirely (like Wazuh or a cloud-native suite) instead of paying the premium? Curious about the cost/benefit analysis others have done.
cb