Endpoint protection visibility for Elastic Security
This Kibana dashboard helps security teams review Elastic Defend endpoint protection status from one operational view. Use it when you need a quick overview of protected endpoints, non-reporting agents, isolated hosts, prevention activity, open alerts, and critical/high severity findings.
The dashboard is designed for SOC analysts, endpoint security engineers, and Elastic Security administrators who want a reusable starting point for monitoring EDR, antivirus, and anti-malware coverage. It turns endpoint telemetry into practical review panels that can support daily health checks, incident triage, and control validation.
What is included
- Elastic Defend – Endpoint Protection Overview: a Kibana dashboard for endpoint posture, prevention activity, alert severity, affected endpoints, behavior rules, MITRE ATT&CK techniques, operating systems, agent versions, policies, and telemetry volume.
- A Kibana saved-object NDJSON export packaged in a ZIP for import through Kibana Saved Objects or the Elastic Content Share deployment flow.
- A dashboard-view thumbnail captured from Elastic to make the download easier to recognize in the catalog.
When to use it
Use this dashboard when you want to review whether Elastic Defend coverage is healthy, identify endpoints that need attention, and understand which prevention or detection signals are most active. It can help teams spot policy gaps, noisy behaviors, high-risk hosts, and endpoint telemetry changes before they become operational blind spots.
After import, validate the expected data views and fields against your Elastic Security deployment. The dashboard assumes Elastic Defend endpoint and alert telemetry is available in Elasticsearch. Review index names, policy labels, and time ranges before using it for production reporting or security operations decisions.
Compatibility and source
This package was exported from the Elastic Content Share Kibana 9.4.3 test deployment and contains an unmanaged Kibana saved object. The NDJSON file reports a Kibana core migration version of 8.8.0, and the download is tagged for Elastic Stack 9.4.3.
Source: creator-submitted Kibana saved-object export from the Elastic Content Share 9.4.3 test cluster. Dashboard ID: elastic-defend-endpoint-protection-overview.
Related collections: browse more Elastic Security downloads and Kibana dashboard examples.
| Tested versions | 9.4.3 |
| ECS compliant | Ready for publishing review |
| Tested versions |
You must log in to submit a review.