Recommended Free Tools
A practical Elastic security baseline for a small team starts with one deployment choice, a handful of high-value log sources, and a validation period before any protection is switched on. Elastic’s own getting-started material follows the same order: pick a deployment, begin with data ingestion through integrations, install detection rules that match the data you actually collect, and only then raise prevention. “On a budget” here means keeping operating cost and review workload small. It does not mean the software is free to run.
Scope the first deployment around risk and review capacity
Before you touch a deployment screen, decide which questions the first telemetry set must answer and who will read the output. A SIEM that collects everything but is reviewed by nobody gives a growing team less visibility than a narrow one that someone checks every day.
As an Amazon Associate I earn from qualifying purchases.
A reasonable starting exercise is to map your product’s critical assets and the user and administrator actions that would matter most if misused. From that map, the first set of sources usually falls into a few categories:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Endpoint events from the laptops and servers your staff and services actually run on.
- Identity and administrator audit events, such as sign-ins, role changes, and privileged actions in the identity provider.
- Cloud control-plane activity, such as changes to accounts, networking, storage permissions, and keys.
- Application authentication or security events, where your product already emits them in a usable form.
This list is an editorial starting point, not a checklist published by Elastic. Before enabling a source, confirm three things: someone owns reviewing its alerts, you know what normal activity looks like for it, and you have a response step for its most likely findings. Turning on every available integration in week one usually produces noise that no one triages.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Choose managed or self-managed Elastic
Elastic documents both deployment options. Managed Elastic Security Serverless means you do not run the underlying Elasticsearch cluster or the Kibana instances yourself. Self-managed deployment runs on infrastructure you control, which gives you more say over hosting, sizing, and data location, but also makes you responsible for operating it. Elastic’s getting-started documentation presents managed Serverless as the simpler and faster path for most teams.
Use the following comparison to make the call. Where the sources reviewed did not state a value, the cell says so rather than guessing.
| Factor | Managed Elastic Security Serverless | Self-managed Elastic |
|---|---|---|
| Who operates Elasticsearch and Kibana | Elastic. Per its getting-started guide, you do not manage the underlying cluster or Kibana instances. | Your team. You own installation, upgrades, scaling, and recovery. |
| Infrastructure and data control | Less direct control over where the platform runs. | Greater control over infrastructure and the environment it runs in. |
| Security feature availability | Depends on the current plan. Check the current feature list before committing. | Elastic’s self-managed page lists security alerting, agent management, malware prevention, and case management under its Free and open offering, and places additional security capabilities under paid tiers. Confirm against the current plan list. |
| Source onboarding effort | Integrations and Elastic Agent, as described in the getting-started material. | The same integrations and agent model, plus the work of keeping the stack that receives the data healthy. |
| Retention, storage, and availability | Set by your plan and configuration. Verify current retention options before sizing. | Set by your hardware, storage, and replication design. Not stated in the sources reviewed for a specific sizing. |
| Total cost | Subscription and data-related costs. Current prices were not confirmed for this article; check the pricing page. | Infrastructure, storage, and staff time. Free software licensing does not remove these. |
For a team with no one who can be on call for an Elasticsearch cluster, managed is usually the better fit. Self-managed makes sense when hosting location, data control, or existing platform skills outweigh the operating burden. Elastic also advertises a free 14-day trial on its getting-started page at the time of review in 2026. Treat that as a vendor offer that can change, and confirm its terms before you plan around it.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Onboard data through integrations and Elastic Agent
Elastic’s getting-started guide recommends beginning with data ingestion, and it describes integrations as the straightforward route for onboarding. Its Elastic Agent is a unified collector for logs, metrics, and other host data. The steps below follow the SIEM quickstart’s endpoint path. Menu labels can shift between releases, so use the labels on your own screen as the reference.
- Open the security setup experience in Kibana and choose the integration you want to start with. Elastic’s quickstart states that, before you can use Elastic Security, you need to choose an integration to start collecting and analyzing your data.
- For endpoint telemetry, select Elastic Defend, the endpoint security integration used in the SIEM quickstart.
- Enroll Elastic Agent through Fleet on each host you want covered. Start with a small group of machines you control directly, not your whole fleet.
- Wait for data to arrive. The quickstart notes that incoming data may take a few minutes to appear. Treat this as an onboarding expectation, not a guarantee of timing.
- Repeat for the next source only after the first one shows the events you expect in Discover or the relevant security view.
The quickstart also says Elastic Defend’s endpoint detection rule is enabled automatically after installation. That is useful, but it is one rule, not coverage for everything you collect.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Install prebuilt rules that match your data
Elastic ships prebuilt detection rules that you can install and filter by tags, including operating system. The quickstart’s advice is to choose rules that fit the data you collect and the environment you run. Installing every rule in the library is not a baseline; it is a large alert queue.
Before you rely on a rule, check the following:
- The source events the rule needs are arriving. A rule for Windows process activity does nothing on a Linux-only fleet.
- The fields the rule references exist in your data. Missing fields make a rule silent, and a silent rule looks the same as a quiet environment.
- The rule’s operating system and product tags match the hosts actually enrolled.
- Someone knows what a true positive for that rule would look like in your product.
An installed rule without its telemetry does not establish detection coverage. Test coverage by confirming the data path, not by counting enabled rules.
Validate in detect mode before enabling prevention
Elastic’s quickstart recommends starting protection policies in detect mode, then monitoring alert volume and behavior before enabling higher levels of prevention. For a small team this is the most important operational habit in the whole baseline, because prevention changes what happens on a machine, while detection only records it.
- Set the Elastic Defend protection policy to Detect rather than Prevent for the enrolled hosts.
- Review event collection settings and any antivirus settings on the endpoint policy, and confirm they match what you intended to collect.
- Monitor which alerts fire and how often over a period that includes normal work, such as a deployment, a batch job, or a routine admin task. The length of that period is a judgment call; the aim is to see your ordinary activity, not a single quiet day.
- For each noisy rule, decide whether to tune it, exclude a known-good activity with a documented reason, or accept the alert and assign an owner.
- Enable prevention for a narrow group of hosts or rules first, and only when someone is on the hook to respond to what it blocks.
Keep cost and retention under control
The sources reviewed for this article do not provide a scenario-specific monthly estimate, and none is defensible without your assumptions. Build the estimate yourself from five inputs: expected ingest volume per source, retention period, replica or resilience requirements, deployment and compute size, and the staff time needed to review alerts and maintain the stack.
Several decisions have an outsized effect on that estimate:
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
- Source volume. A verbose source that nobody queries costs as much to store as one that drives investigations. Start with sources whose events answer specific questions, and add verbosity only when a question demands it.
- Retention. Choose retention per data type. Identity and administrator audit records often need a longer window than high-volume debug-level application logs. Shorter retention for the noisy data is a common way to contain storage growth.
- Self-managed overhead. Free software still runs on hardware, storage, backups, upgrades, and someone’s time. Compare that against a managed subscription honestly, including the cost of the person who would otherwise be on call for the cluster.
- Rule count. Each enabled rule that produces alerts adds review work. Alert volume is a cost even when the storage line item looks small.
Re-check current deployment and pricing pages before you finalize these numbers, because plan features and prices change.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Expand only when the baseline is trustworthy
Expansion is justified when the current sources are reliably arriving, their rules fire at a volume your reviewers can handle, and someone can explain what each alert means. The next source should answer a question your team cannot answer today, not simply add coverage for its own sake.
- Alerts from the current sources are reviewed on a schedule, with a named owner.
- Each enabled rule has a confirmed data path and a known normal-activity baseline.
- Prevention is enabled only where a response step exists.
- Retention and projected ingest for the next source are written down and within budget.
- The new source has a specific security question it answers, and an owner for its alerts.
Elastic’s SIEM fundamentals training outline dates from 2022. It can help with basic concepts, but it should not be treated as a description of current product capabilities. Use the current documentation for anything feature-specific.
Summary of the sequence
Start with one deployment decision, a few sources that someone will review, Elastic Defend and Elastic Agent for endpoints, rules that match the telemetry you actually have, and a detect-first validation period. Expand after the alerts are owned and understood, and keep retention and volume tied to specific questions. That order keeps the baseline small enough to run and honest about its limits.
Quick Recap
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems
