[Website]: Consistent Terminology for "Elastic Defend" vs "Elastic Endpoint"

[stuartMoorhouse]

Type of issue

Inaccurate

What documentation page is affected

https://www.elastic.co/docs/solutions/security/

What happened?

Consistent Terminology for "Elastic Defend" vs "Elastic Endpoint"

Summary

The Core Concepts section on the Security overview page distinguishes between these two terms:

Term	What It Is	Where It Exists
Elastic Defend	A Fleet Integration (policy/configuration)	Fleet UI, Kibana
Elastic Endpoint	The security process that runs on hosts	Host filesystem, process list

A few other pages use these terms interchangeably, which could cause confusion. This issue collects those instances with suggested alternatives.

---

Instances

1. "System requirements to install Elastic Defend"

Locations:

• https://www.elastic.co/docs/solutions/security/get-started/get-started-detect-with-siem
• https://www.elastic.co/docs/solutions/security/get-started/get-started-endpoint-security

Current:

"Ensure you have the minimum system requirements to install Elastic Defend."

Suggested:

"Ensure your hosts meet the minimum system requirements to run Elastic Endpoint."

---

2. "Installing Elastic Defend on macOS"

Location:

• https://www.elastic.co/docs/solutions/security/get-started/get-started-endpoint-security

Current:

"If you're installing Elastic Defend on macOS..."

Suggested:

"If you're deploying Elastic Agent with the Defend integration to macOS hosts..."

---

3. "Elastic Defend generates an alert"

Locations:

• https://www.elastic.co/docs/solutions/security/get-started/get-started-endpoint-security
• https://www.elastic.co/docs/solutions/security/get-started/get-started-detect-with-siem

Current:

"If any of these behaviors are detected, Elastic Defend generates an alert..."

Suggested:

"If any of these behaviors are detected, Elastic Endpoint generates an alert..."

(Some pages already use "Elastic Endpoint" for this context.)

---

4. "Endpoints running Elastic Defend"

Location:

• https://www.elastic.co/docs/solutions/security/manage-elastic-defend/endpoints

Current:

"The Endpoints page allows administrators to view and manage endpoints that are running the Elastic Defend integration."

Suggested:

"The Endpoints page allows administrators to view and manage endpoints protected by the Elastic Defend integration."

---

5. "Elastic Defend requirements" page

Location:

• https://www.elastic.co/docs/solutions/security/configure-elastic-defend/elastic-defend-requirements

The content covers host-level requirements for Elastic Endpoint (OS versions, macOS permissions, etc.). Consider adding a clarifying intro:

"These are the system requirements for hosts to run Elastic Endpoint, the component deployed by the Elastic Defend integration."

---

6. "Install" vs "Add" for integrations

Location:

• https://www.elastic.co/docs/solutions/security/get-started/get-started-detect-with-siem

Current:

"In the Add agent flyout that appears after you install the Elastic Defend integration..."

Suggested:

"In the Add agent flyout that appears after you add the Elastic Defend integration..."

---

7. Mixed terminology in same paragraph

Location:

• https://www.elastic.co/docs/solutions/security/get-started/get-started-endpoint-security

Current:

"...you may require you to grant Elastic Endpoint Full Disk Access... Refer to Elastic Defend requirements"

The sentence uses "Elastic Endpoint" but links to "Elastic Defend requirements."

---

References

• Core Concepts (correct definitions): https://www.elastic.co/docs/solutions/security
• Endpoint command reference (consistent usage): https://www.elastic.co/docs/reference/security/endpoint-command-reference
• Discuss thread with user confusion: https://discuss.elastic.co/t/integration/326744

Additional info

No response

[stuartMoorhouse]

A third meaning for "Elastic Defend" (in addition to "the Elastic Defend Fleet Integration" and "the Elastic Endpoint process running on a host" seems to be "the Elastic Security application features in Kibana that are activated after adding the Elastic Defend Integration", for example on https://www.elastic.co/docs/solutions/security/configure-elastic-defend/elastic-defend-feature-privileges.

These features are not features of the Integration or the host process, so the meaning of Elastic Defend has broadened to include all Elastic Security UI aspects enabled after adding the Defend Integration in this usage.

Perhaps this:
"You can create user roles and define privileges to manage feature access in Elastic Security. This allows you to use the principle of least privilege while managing access to Elastic Defend's features."

Could be changed to:
"You can create user roles and define privileges to manage feature access in Elastic Security. This allows you to use the principle of least privilege while managing access to Elastic Security features."

To avoid further overloading the term "Elastic Defend".