It’s completely free even the EDR and Threat Intel functionality. It blows my mind too. The only things that are not free are things like machine learning detection, ransomware and cloud (k8) protection and other enterprise stuff like SSO. Besides the prebuilt elastic rules (https://github.com/elastic/detection-rules) I implemented about 50 of custom rules for stuff like too many failed logins, unusual traffic flow (you can also send flows from your FW to Elastic), user account creation, network reconnaissance, unusual geo-ip location etc.
The stack is based on the „pfELK“ docker compose file (meaning it integrates automatically with Pfsense/OPNsense logs) that I further modified to automatically include the fleet server and threat intel agent and stuff: https://github.com/maof97/pfelk-docker