June 2020 Summaries

Elastic Cloud has expanded its availability to Amazon Web Services (AWS) in the Canada Central region, offering users the capabilities of enterprise search, observability, and security. This service allows users to efficiently search through various platforms, monitor applications, and ensure endpoint security, with the flexibility to choose between a managed service or self-management. Elastic Cloud can be deployed on AWS, Google Cloud, or Microsoft Azure and can be orchestrated using any preferred container. Users can select their region and cloud service provider via the Elastic Cloud console, optimizing deployments based on specific requirements. Additionally, AWS customers can subscribe to Elastic Cloud through the AWS Marketplace, benefiting from integrated billing with existing AWS services and the option to deduct charges from prepaid AWS Enterprise Discount Program agreements. A free 14-day trial is available for new users.

Elastic has launched a public GitHub repository, elastic/detection-rules, to enhance its Elastic Security product by collaborating with the community on threat detection rules. This initiative aims to stop threats at scale and support analysts by making detection rules development open-source and community-driven. The repository hosts rules that leverage the Elastic Common Schema, allowing them to function across multiple platforms like Linux, macOS, and Windows, and integrate with various query languages, including Kibana Query Language (KQL) and Lucene. Contributors can add new rules, which are tested for syntax and schema usage before being integrated into the detection engine. This collaborative approach not only enhances the detection capabilities by focusing on adversary behaviors, aligned with MITRE ATT&CK techniques, but also ensures that Elastic users receive the most effective and optimized rules. Elastic encourages community involvement by providing detailed guides and a command-line tool to facilitate rule creation and modification, while also maintaining a focus on performance and accuracy.

Kibana has undergone a significant re-architecture to introduce the Kibana development platform, a project aimed at enhancing the scalability and efficiency of plugin development. Originally built with a simple architecture using familiar JavaScript libraries, Kibana expanded rapidly, leading to challenges in development performance and integration. To address these issues, the new platform emphasizes a consistent architecture across client and server code, isolated plugins with explicit APIs, and framework-agnostic APIs, allowing for flexibility and future growth. The platform adopts a hybrid approach, maintaining a single artifact deployment while promoting encapsulation between components to improve development velocity and stability. Core services provide foundational APIs for plugins, while plugins themselves can register functionalities and integrate with others through explicit contracts, facilitating rapid feature development. The redesign also simplifies the process for developers by unifying lifecycle stages and patterns across server and client environments, resulting in improved navigation speed and enhanced capabilities for Kibana users. As Kibana transitions to this new platform, developers are encouraged to adapt their plugins to ensure compatibility with upcoming versions, with extensive documentation and support available.

In February 2019, Elastic discovered a Linux kernel bug affecting SSD disks during a stability test for Elasticsearch, prompting a collaborative investigation with Google Cloud and Canonical. The investigation revealed that the issue, characterized by index corruption, was linked to the use of SSD drives with the SCSI interface and the multi-queue block layer (blk_mq) feature enabled on certain Linux kernels. Despite initial suspicions, the problem was not related to Elasticsearch's cross-cluster replication or soft deletes features. Google Cloud and Canonical contributed to identifying workarounds, such as increasing memory or disabling the multi-queue SCSI feature, and pinpointing the kernel version where the corruption fixes were first implemented. Canonical's extensive testing confirmed that the corruption did not occur on Ubuntu mainline kernels version 5.0 and above. The collaborative efforts led to the release of updated Ubuntu kernels for various platforms, addressing the issue and improving data reliability when using SSDs with the blk_mq feature enabled.

Elastic Workplace Search allows users to ingest data from various content sources through its Custom Source API, providing a flexible way to integrate organizational data such as CSV files into search results. This process involves configuring a custom source with an access token and key, using a REST API to convert and send data in JSON format to the Workplace Search system. The example given illustrates how to ingest a simple CSV file containing contacts into Workplace Search, enabling these contacts to be searchable alongside data from native integrations like Google Drive and Salesforce. The API supports customization of how results are displayed, enhancing the search experience by ensuring data is presented optimally. The guide includes a practical walk-through using Python and jq for data conversion, and emphasizes the benefits of having integrated search results. Future discussions will cover more complex integrations, such as with Trello, to further explore Workplace Search capabilities.

The blog post discusses the Australian Cyber Security Centre's advisory on the "copy-paste compromises," a campaign leveraging open-source proof of concept exploits, primarily targeting unpatched or vulnerable web-facing assets and resorting to spear phishing when initial access fails. Elastic Security is highlighted as a robust solution for countering such threats, offering tools like Elastic SIEM and Elastic Endpoint Security to provide comprehensive visibility and detection capabilities using the MITRE ATT&CK framework. It advises organizations to adopt a defense-in-depth strategy, addressing unpatched applications, network segmentation, and other vulnerabilities to mitigate exposure. Emphasizing the importance of threat intelligence and user training, the post also outlines the use of Indicators of Compromise (IoCs) in SIEM detection rules for identifying potential threats. Elastic Security's integrations and consulting services are presented as valuable resources for enhancing an organization's ability to detect, prevent, and respond to cyber threats effectively.

Elastic Enterprise Search is now accessible on Elastic Cloud, offering a seamless and scalable deployment experience across more than 35 geographic regions via platforms like Microsoft Azure, Google Cloud, and AWS. This release includes both Workplace Search and App Search, aiming to enhance enterprise-grade search experiences by simplifying the integration of search tools for users and organizations. App Search refines data into modern search experiences with easy-to-use APIs and user behavior analytics, while Workplace Search provides a unified search experience with prebuilt integrations for tools like Google Drive and Microsoft 365. The Elastic Cloud's resource-based pricing model allows users to only pay for the resources consumed, enhancing the scalability and management of deployments. Additionally, Elastic Enterprise Search can be deployed on personal infrastructure, offering flexibility in management.

Elastic Support frequently requests diagnostic files from users to better understand and troubleshoot issues within Elasticsearch clusters. The Support Diagnostic tool aggregates data from various Elasticsearch APIs, compressing outputs into a single zip file, which aids in identifying performance bottlenecks, configuration issues, and other potential problems. This tool, which runs on any system with a Java Virtual Machine, offers both local and remote execution modes and can handle secure clusters with user authentication and TLS encryption. Privacy is emphasized, as the tool does not collect actual data stored in clusters and offers options to scrub sensitive metadata. Furthermore, it can also diagnose issues in Logstash and Elastic Cloud Enterprise (ECE) environments, providing comprehensive insights into system performance and configuration. The Support Diagnostic is regularly updated to include new features and improvements, enhancing its effectiveness in maintaining optimal cluster performance.

Elastic has expanded its support to include ARM-based architectures for Elasticsearch, reflecting its commitment to meeting users' needs across various platforms. As of version 7.8.0, Elastic provides Linux artifacts for 64-bit ARM architectures (AArch64) and a multi-architecture Docker image, allowing users to run Elasticsearch on ARM similarly to x86-64 systems. Although these ARM artifacts are not yet recommended for production use, Elastic encourages early adopters to test them and provide feedback to enhance future releases. The initiative is part of a broader effort to extend ARM support to Elastic's other product offerings.

The blog post serves as a setup guide for a Kubernetes observability tutorial series, detailing the process of configuring the necessary environment to monitor and analyze Kubernetes clusters effectively. It emphasizes the importance of starting with the first part of the series, which focuses on log monitoring and analysis, before proceeding with the setup described in this post. The tutorial involves deploying a 14-day free trial of the Elasticsearch Service on Elastic Cloud, setting up a Minikube single-node Kubernetes cluster, and deploying a demo application to capture logs, metrics, and application performance data. The post provides detailed instructions on creating a Debian 9 server environment, installing necessary packages, and deploying Beats for data shipping to Elasticsearch, ensuring accurate connectivity with the Elastic Cloud cluster. It also guides users through the deployment of MySQL, a pet clinic app, and an NGINX proxy, verifying that all components are running correctly within the Kubernetes environment.

Square Enix utilizes Elastic's security solutions to enhance the security and efficiency of their videogame development process. Previously reliant on a costly and less scalable third-party service, Square Enix now benefits from Elastic's ability to quickly add new data sources and parse non-standard formats, providing greater visibility and security for corporate and online gaming environments. Their custom security analytics platform, built on the Elastic Stack, allows for rapid integration of data sources, enabling timely detection and response to security threats. The company employs Elastic's SIEM and other features such as Kibana dashboards to monitor and protect their intellectual property and prevent unauthorized access during game development. Additionally, Elastic's capabilities are leveraged to detect and address cheating within games by analyzing telemetry data, ensuring fair gameplay.

Kubernetes has become the leading container orchestration technology, integral to the cloud-native movement, offering speed and agility but also increased complexity with numerous microservices and containers. Monitoring such environments is crucial, and Elastic simplifies this task by providing comprehensive observability through a unified platform that combines logs, metrics, and application performance monitoring (APM). This tutorial outlines how to use Elastic's tools to monitor applications in Kubernetes, emphasizing the use of Filebeat for log collection and the Elastic Stack for data analysis and visualization. Filebeat can be deployed as a DaemonSet to collect pod logs, which are enriched with Kubernetes metadata, enabling seamless log ingestion and processing. The tutorial also covers using Kibana for log analysis, leveraging pre-built visualizations, and employing machine learning features to detect anomalies and new log entries. Elastic's approach allows for efficient troubleshooting and monitoring of Kubernetes environments, facilitating a fully observable system.

Elastic machine learning is utilized to train and evaluate a supervised machine learning model aimed at detecting domain generation algorithms (DGAs), which are used by cyber attackers to evade detection by generating a multitude of random-looking domains. This process involves feature extraction from both malicious and benign domains, with a focus on identifying characteristics that distinguish them, such as domain name length and entropy, eventually settling on using n-grams for feature engineering. The model is trained using a labeled dataset, with an 80/20 train/test split to assess its performance through metrics like the confusion matrix, which indicates a 98% true positive rate. Despite this high accuracy, the volume of DNS traffic could still result in a significant number of false positives. In the subsequent part of the series, the deployment of the DGA model into production will be explored, including the creation of inference processors and the use of anomaly detection to mitigate false positive alerts, thereby enhancing network security monitoring.

Elastic Cloud has introduced several new features and enhancements designed to simplify operations and expand its offerings. Users can now manage workloads programmatically through an API and CLI, allowing for automation and integration with CI/CD pipelines. A dedicated coordinating node has been added to improve performance and scalability, while snapshot lifecycle management provides data backup capabilities. Elastic Cloud is now available in 11 additional regions across AWS, Google Cloud, and Microsoft Azure, bringing the total to 35 regions. The service can also be found in the Google Cloud Console, offering flexible purchasing options and enhanced billing transparency. For those using self-managed offerings, Elastic Cloud Enterprise and Elastic Cloud on Kubernetes have also been updated to include these new features, ensuring a smoother deployment experience on various infrastructures.

Kibana 7.8 introduces a variety of new features and enhancements aimed at improving user experience and data analysis capabilities. The update features a redesigned side navigation that simplifies the interface and groups applications by use cases, enhancing efficiency for users dealing with complex data tasks. Key additions include dashboard drilldowns, new chart types in Kibana Lens, and the ability to embed Anomaly Explorer visuals into dashboards for better anomaly detection. The release also enhances Elastic Maps with real user monitoring (RUM) layers and introduces a fit-to-data button for more precise geoanalysis. Furthermore, the update increases the file upload limit to 1GB, simplifies data ingestion with a new ingest node pipeline builder, and offers improved alerting functionalities with pre-configured connectors. Overall, Kibana 7.8 aims to streamline data visualization and analysis processes, offering users more powerful tools to interact with and interpret complex data sets.

Elastic Stack 7.8.0 brings a variety of enhancements to Elasticsearch, Kibana, Logstash, and Beats, as well as to solutions like Elastic Enterprise Search, Elastic Observability, and Elastic Security, with a focus on improving data onboarding, navigation, management, and investigative capabilities. This release introduces improvements in dashboard functionalities with drilldowns in Kibana, enterprise-level search security through SAML-based authentication, and expanded observability with Google Cloud operations integration. Elastic Security benefits from new Jira integrations, interactive UI features, and pre-defined detection rules for Linux threats, while Elastic Cloud simplifies operations with an API, expands deployment options across 35 regions, and introduces new purchasing options through platforms like Google Cloud Marketplace. These features are aimed at providing streamlined workflows, enhanced visibility, and effective threat detection across various environments, making the Elastic Stack and its cloud offerings more robust and user-friendly.

Elasticsearch 7.8.0 introduces a range of enhancements and new features that enhance its capabilities for data analytics and ingestion. This release, based on Lucene 8.5.1, strengthens the Elastic Stack's geospatial capabilities by enhancing geospatial aggregations, making it easier to analyze geo data without custom code. It also introduces new aggregations for histogram data types, including Sum, ValueCount, and Average, and a t-test metrics aggregation, facilitating statistical analysis and performance monitoring. Additionally, memory consumption during aggregations has been optimized, and ingest processes are simplified with the introduction of an Ingest Manager and a pipeline builder. Users can now upload larger files, up to 1 GB, and benefit from an improved data transformation interface in Kibana, enabling more flexible data manipulation and analysis. The release also includes various other features like the ability to delete multiple snapshots with a single command and streamline ingestion with improved tools, underscoring Elasticsearch's commitment to performance and user-friendly data handling.

Elastic Uptime Monitoring 7.8.0 introduces significant improvements aimed at enhancing TLS certificate monitoring and alerting capabilities, addressing the challenges faced by users managing large server or container deployments. The release includes a dedicated column for certificate expiration on the Monitors Overview page, a new "certificate-focused" view providing comprehensive details of each certificate, and the ability to set custom expiration thresholds to preemptively alert users of impending expirations. These enhancements are crucial as expired certificates can lead to critical service outages, as highlighted by past incidents affecting major organizations. The update emphasizes the importance of proactive certificate management, particularly as systems transition to more complex microservice architectures. Users can experience these new features by accessing the latest version of the Elastic Uptime application through Elasticsearch Service on Elastic Cloud or by downloading the Elastic Stack.

Logstash 7.8.0, released by Elastic, introduces several enhancements aimed at improving security, flexibility, and platform support. This release includes API key authentication for Elasticsearch, allowing more granular permission control by enabling users to authenticate with specific access rights, such as write-only access for Logstash outputs. Additionally, proxy support has been extended to include Logstash monitoring and management, enabling deployments in environments with restricted internet access. The release also marks the deprecation of the Logstash Azure module, with the recommendation to use Filebeat and Metricbeat modules for Azure monitoring, which align with the Elastic Common Schema for better integration. Logstash 7.8.0 expands its platform support to include CentOS/RHEL 8.x and Ubuntu 20.04, and adds compatibility with newer Java Development Kit versions, including Zulu 11, AdoptOpenJDK 11, and Oracle/OpenJDK/AdoptOpenJDK 14. Users are encouraged to download, test, and provide feedback on this latest version.

Elastic Logs 7.8.0 introduces several key features to enhance log management and analysis, including quick alerting, contextual log viewing, and dataset filtering during machine learning job configuration. Users can now filter logs using terms with external context, such as API routes or error texts, and view logs in context to better understand events surrounding specific log lines. The release also supports threshold-based alerting directly in the Logs app, allowing for field-based and numeric alerts, with various connectors for notification. Additionally, machine learning configurations now allow for dataset filtering, offering more precise control over job settings. These features are available for free to all users of the Elastic Stack, either through a download or via the Elasticsearch Service on Elastic Cloud.

Elastic has announced an experimental release of its Elastic Agent and Ingest Manager, designed to simplify data onboarding into the Elastic Stack. The Elastic Agent consolidates various functions into a single, unified agent for easier installation and management, reducing the complexity of deploying multiple Beats and agents across infrastructure. Ingest Manager, a new Kibana application, allows users to quickly add and manage integrations for popular services through a web-based UI, offering out-of-the-box assets like dashboards and visualizations. The release aims to enhance ease of configuration and management at scale, with a focus on automating processes that previously required manual editing of YAML files and use of third-party tools. Although this is an experimental release without a migration path for future iterations, it showcases Elastic's vision for advancing data ingestion, and users are encouraged to test it in dedicated environments to avoid conflicts with future updates.

Elastic Metrics 7.8.0 introduces several enhancements aimed at improving cloud service monitoring and infrastructure management. This release features an improved integration with Google Cloud, allowing users to monitor any service using the Google Cloud operations suite via the stackdriver metricset, which collects metrics with the ListTimeSeries API. Additionally, the update introduces resource-centric threshold alerts for infrastructure monitoring, enabling users to set alerts based on specific resource attributes and create multiple thresholds for precise monitoring. The new preview charts aid in selecting suitable threshold values by providing visual feedback. Moreover, a specialized Linux module is introduced to focus on Linux-specific metrics without cluttering the general system module, including metricsets like pageinfo, ksm, and conntrack. Users can access the latest version of Elastic Metrics through Elasticsearch Service, Elastic Cloud, or by downloading the Elastic Stack.

Elastic APM 7.8.0 introduces significant enhancements to improve application performance monitoring, including smarter service maps integrated with machine learning anomaly detection and customizable deployment tracking via the new Annotation API. The update emphasizes real user monitoring (RUM) by offering a dedicated Observability solution layer in the Maps app, enabling users to visualize website performance geographically. This visualization aids in identifying poorly optimized network connections and unexpected traffic sources. Additionally, the release includes out-of-the-box support for SqlClient in the .NET APM Agent, facilitating better visibility of SQL databases in service maps and distributed traces, crucial for diagnosing performance issues caused by inefficient SQL queries. Users can access Elastic APM 7.8.0 through Elasticsearch Service on Elastic Cloud or download the Elastic Stack to start monitoring applications with APM agents.

Elastic Observability 7.8 introduces several enhancements designed to provide comprehensive monitoring and improved performance analysis for cloud operations. Notable features include expanded integration with Google Cloud's operations suite, offering complete visibility into metrics and logs for efficient troubleshooting and optimization of cloud environments. Elastic Uptime now includes TLS/SSL monitoring to track and alert on expiring security certificates, thereby preventing downtime and reputational risk. Additionally, service maps in Elastic APM are enhanced with machine learning-powered health indicators, allowing users to proactively identify and address performance issues in complex service architectures. These updates aim to streamline monitoring workflows and improve the reliability of operations across various cloud services.

Elastic Enterprise Search 7.8 introduces enhanced management and customization tools for building modern search experiences tailored for both internal and external users. The release emphasizes the importance of administrative capabilities with new features like document-level security management and dynamic interactions with ingested content, allowing users to search, sort, and filter directly within the App Search console. Additionally, the update integrates enterprise authentication mechanisms, such as SSO/SAML, with document-level authorization in Workplace Search, ensuring a secure and personalized search experience. This seamless integration aims to support the needs of large organizations by offering a frictionless and scalable solution. The release also highlights the availability of configurable documents view on various deployment options and the continued unification of App Search and Workplace Search in a single download experience.

Elastic Security 7.8 introduces several key enhancements aimed at improving threat detection and incident response capabilities for security analysts. This release includes a new integration with Atlassian Jira, which streamlines case management by allowing users to open or update Jira incidents directly from the Elastic Security interface, thereby standardizing incident response workflows. The interface itself has been made more intuitive with new aggregation charts and flexible filters that aid in visualizing and analyzing data trends more efficiently. Additionally, Elastic Security 7.8 unveils new out-of-the-box detection rules specifically designed for Linux systems, focusing on preventing evasion techniques used by attackers. The update also enhances data ingestion capabilities with Filebeat modules for network and endpoint monitoring, supporting cross-environment analysis with Elastic Common Schema (ECS)-formatted data. These comprehensive improvements aim to equip security teams with the tools needed to quickly identify and mitigate threats across various platforms and infrastructures.

Elasticsearch Service has launched in the Microsoft Azure Paris region, allowing existing users to access it immediately and offering new users a 14-day free trial. This expansion is part of Elastic's collaboration with Microsoft to enhance the Elastic Stack experience by gradually introducing Elasticsearch Service to more Azure regions, enabling features like machine learning, index lifecycle management, and visualization tools such as Kibana Lens and Canvas. The service aims to simplify deployment and scaling with use case-ready templates, and soon, subscriptions will be available through the Azure Marketplace. Elastic provides resources and support for users migrating their Elasticsearch data to this new region.

Applying an observability strategy in telecommunications using the Elastic Stack enhances the capability to analyze and monitor voice traffic data, offering insights previously unattainable. The Elastic Stack, notably adopted by companies like Deutsche Telekom, provides a comprehensive platform comprising Elasticsearch for data storage and analysis, Beats and Logstash for data ingestion, and Kibana for visualization. This integration allows operators to consolidate traditionally siloed data, enabling a holistic view that correlates customer experience with service quality and system availability. Key performance indicators such as Call Data Records (CDRs), Call Setup Success Ratio (CSSR), and Average Call Duration (ACD) can be efficiently monitored, and machine learning capabilities facilitate anomaly detection in network behaviors. These advancements help operators detect fraud, improve network efficiency, and react swiftly to potential issues, thereby reducing the risk of revenue loss and enhancing customer satisfaction.

Alex Marquardt discusses the importance of calculating ingest lag and storing ingest time in Elasticsearch to enhance data observability and reliability. By storing an ingest timestamp for each document and calculating the difference between the event's occurrence and its arrival at Elasticsearch, users can identify delays and potential issues with remote system clocks or the ingest process itself. The blog outlines how to implement an ingest pipeline using Elasticsearch's set and script processors to add an ingest timestamp and calculate lag, which can be used in visualizations, monitoring, and alerting. Marquardt emphasizes the benefits of using the ingest timestamp over remote-generated timestamps, such as ensuring recent events are considered in visualizations and alerts, and avoiding issues from incorrect or malicious timestamp settings on remote systems. The approach enhances data accuracy and ensures that events are not missed due to ingest delays, offering a more reliable basis for monitoring and analysis.

Léargas Security, a company specializing in providing actionable insights through data correlation from cyber and physical security controls, transitioned from using Splunk to the Elastic Stack to combat COVID-19-related cyber threats more effectively. The Léargas platform, visualized through Kibana, leverages Elastic's capabilities to process over 6TB of log data daily, enabling the detection of multi-contextual and multi-dimensional threats, including phishing and credential reuse attacks. This transition has reduced operational costs and improved performance by integrating data from various sources and utilizing natural language processing and sentiment analysis to identify potential threats. During the COVID-19 pandemic, Léargas used Elastic to track phishing campaigns targeting healthcare and pharmaceutical companies and to prevent identity theft by cybercriminals. These efforts are supported by public threat feeds and resources provided by Léargas to strengthen organizational defenses globally.

In this final installment of a series on monitoring system metrics with the Elastic Stack, the focus is on ingesting metrics securely using role-based access control (RBAC). The process involves setting up specific roles and users with minimum necessary permissions, rather than using a superuser, to enhance security. Two roles, metricbeat_setup and metricbeat_writer, are created, each with different permissions for setup and data writing tasks. Corresponding users are assigned these roles, ensuring they only have access to the permissions required for their tasks. The use of a keystore is recommended for securely storing credentials, avoiding plain text exposure, and allowing for flexible deployment configurations. The article encourages users to get started by signing up for a free trial of Elasticsearch Service or downloading the Elastic Stack for self-hosting, offering further support through forums for any queries or challenges.

Tyler Langlois discusses the development and functionality of Beefheart, a Haskell-based tool created by the Elastic Stack's Infra team to enhance real-time monitoring of Fastly metrics. The tool leverages Fastly's real-time metrics API to collect data and indexes it into Elasticsearch, allowing for custom dashboards in Kibana to track CDN performance globally. Beefheart is designed to auto-discover Fastly services, incorporates retry logic for network stability, and manages data lifecycle for efficient storage. Haskell's strong type system and concurrency capabilities were explored during the development, resulting in a tool that performs tasks concurrently using the async package and STM for thread-safe operations. The project reflects Elastic's "Space, Time" principle by experimenting with Haskell to build a production-ready service, and it encourages contributions and feedback from the community on GitHub.

In a detailed account, STRABAG outlines their integration process of Azure single sign-on (SSO) with Elastic Cloud Enterprise (ECE) to enhance security and streamline user authentication within their on-premises web applications. The integration, primarily aimed at managing search operations and processing over 25,000 log entries per minute, involved setting up a highly secure authentication system using Azure Active Directory's (Azure AD) SAML protocol. The process is described in three steps: creating an enterprise application on Azure to serve as the authentication entity, configuring a SAML provider on the ECE platform, and testing the setup. By leveraging Azure AD's capacity for managing corporate identities, STRABAG successfully implemented a secure SSO solution, allowing users seamless access to ECE, with a fallback option available through admin accounts for added security.

Elastic's blog explores how Elastic App Search analytics can enhance user experiences by leveraging data insights from query analytics, click analytics, and recent queries. Query analytics help identify frequent search terms, especially those yielding no results, enabling content creation to bridge these gaps and improve customer support. Click analytics reveal the effectiveness of search results in generating user engagement, allowing for manual adjustments through the Curations tool to prioritize certain results. Recent Queries provide real-time insights into user searches, serving as an early warning system for potential issues. Built on the Elastic Stack, App Search offers the power of Elasticsearch with simplified customization, making it accessible for admins and analysts. Elastic provides a 14-day free trial and offers App Search across all subscription levels, emphasizing ease of use and integration with the 7.7 release.

Version 6.8.10 of the Elastic Stack was released on June 3, 2020, featuring a range of fixes, minor enhancements, and security vulnerability resolutions. Users are encouraged to upgrade to this latest version to benefit from these improvements. Detailed information on the changes made in Elasticsearch, Logstash, Kibana, and Beats can be found in the release notes, and further security-related details are available in the Elastic Security Advisory.

Version 7.7.1 of the Elastic Stack was released on June 3, 2020, featuring fixes, small enhancements, and addressing security vulnerabilities. Users are encouraged to upgrade to this latest version for improved functionality and security. Detailed information on the changes and updates for each component, including Elasticsearch, Logstash, Kibana, and Beats, can be found in the release notes. Additionally, the Elastic Security Advisory provides more insights into the security improvements made in this update.

The virtual Elastic{ON} Gov Summit, hosted by Elastic, brought together over 2,000 government agency representatives and partners to foster collaboration amidst social distancing. The event, aimed at replicating the community-building of its in-person counterpart, featured a keynote by Elastic founder Shay Banon, who emphasized the company's mission of "Search. Observe. Protect." and the importance of collaboration. The summit introduced solutions like the FedRAMP "In-Process" GovCloud offering and the new Workplace Search, designed to enhance productivity and security for public sector professionals. Elastic Security was highlighted for its capabilities in threat detection and mitigation, while a user story from Harris County showcased the development of a search tool to aid crime investigations. Attendees were encouraged to continue engaging with the Elastic community through various platforms, with plans for another virtual gathering in October 2020.