The Elastic Container Project for Security Research

This guide walks through deploying a local, containerized Elastic Stack (Elasticsearch, Kibana, Fleet) via Docker Compose, managed by a helper script to stage, start, stop, and destroy components with TLS enabled. It covers configuring credentials and licenses, creating Fleet agent policies, installing Elastic Security integrations, enabling prebuilt detection rules, enrolling an Elastic Agent on endpoints, and validating data/alerting with the EICAR test file. The content is focused on lab and testing workflows rather than describing a specific security incident.