Elastic IR (elastic-agent)

elastic-agent install

Installs the Elastic agent on the endpoint, deploying telemetry (logs, processes, network) to the Elastic Stack for hunting and IR.

Run it when you need endpoint telemetry in Elastic: elastic-agent install deploys the single agent (integrations: System, Windows, data streams) that sends logs and telemetry to the stack. It's Elastic's endpoint visibility piece: events (processes, network, files) centralized for hunting, detections, and IR. In a SOC with Elastic, the agent is the visibility deployment: endpoints with the agent feed detections and investigations. IR uses agent telemetry to reconstruct host activity.

Don't use it without the stack: the agent needs Elasticsearch/Kibana (or Elastic Cloud) to send to — without the stack, installation fails or the agent has no destination. Scale deployment is done with policies (Fleet): elastic-agent install is individual installation; in the fleet, Fleet manages configuration. And watch out for performance and scope: full telemetry (processes, network) generates volume and cost — integrations and data streams are configured with criteria. The agent is telemetry, not detection: Elastic rules (Endpoint Security) complement collection.