Endpoint Security, Prevention, and Host/Network Visibility
Elastic Defend
Elastic Defend is the endpoint integration managed through Fleet. Its policy exposes protection settings - malware, ransomware, memory threat, and behavior protection - each typically switchable between detect and prevent, plus event capture toggles for process, file, network, DNS, registry, security, and authentication events. Detect versus prevent changes whether the malicious action was blocked; it does not change whether an alert is generated, so the same detection can appear with a blocking outcome (event.action/event.outcome reflecting the denial) or as observed-only activity. Event capture categories differ by operating system - Linux, for example, exposes a narrower set than Windows - so cross-platform questions hinge on the support matrix.
Tuning and containment
Trustlists (trusted applications, signers, hashes) and blocklists (hashes, paths) tune endpoint protection without touching detection rules; event filters reduce ingest volume. Host isolation cuts a host off from the network except for the agent's connection to Fleet/Elasticsearch, and host isolation exceptions whitelist specific addresses. All response actions - isolate, release, terminate process, fetch process memory - are recorded in the response actions history, which is the audit trail exam questions point to. Osquery is a separate integration that enables live and scheduled SQL-style queries against hosts; it is not part of Elastic Defend itself.
Visibility and traps
Network visibility comes from both Elastic Defend network/DNS events and network integrations (packetbeat-style flows, firewall, DNS, cloud logs) - endpoint data alone rarely tells the whole story. Common traps: assuming prevention blocks all malware families the vendor lists (protection is signature/behavior dependent, not guaranteed); assuming the trustlist also silences detection alerts (it tunes protection, not rule exceptions); and assuming every OS supports every response action.
Rule of thumb: before enabling prevent mode in production, validate with a benign test (EICAR) and a narrowly scoped trustlist entry, then confirm the block in response actions history and endpoint event data.