Elastic Security

Integrating Elastic supports forwarding detections and recommendations from Insights to your SIEM. This accelerates root cause analysis and threat response at scale.

Elasticsearch is a distributed, RESTful search and analytics engine. It centrally stores your data for lightning-fast search, fine‑tuned relevancy, and powerful analytics that scale easily.

Retrieve the Elastic Security credentials

1. Log in to your Elastic Cloud account and navigate to your desired deployment.
2. From your deployment's overview page, copy the Cloud ID. This ID is required in the next section.
3. Navigate to Security/API Keys.
4. Click Create API Key, and enter a name for the new key. This key is required in the next section.

Add an Elastic integration in Insights

1. In the header of your Insights instance, click Menu > Integrations.
2. Click Elastic.
   The Configure Integration page displays.
3. Click Create Integration.
4. Enter the Elastic Cloud ID and API Key that you obtained for your elastic deployment in the previous section.
5. Click Create Integration.

You are redirected to your Elastic integration dashboard, with your new integration added under Configured.

Edit or delete an Elastic integration

Edit an individual Elastic integration

1. Click the vertical ellipsis for a configured integration.
2. Select Edit.
   The Configure Integration page displays.
3. Edit the Cloud ID and API Key as necessary to assist in troubleshooting failing integrations.
4. Click Save Integration.

ℹ️

Note

Edits to an integration may take up to two minutes to take effect.

You can remove individual Elastic integrations by deleting them. Deleting an integration cannot be undone and all of its configuration settings and data are deleted.

Delete an individual Elastic integration

1. Click the vertical ellipsis for a configured integration.
2. Select Delete.
3. Type delete in the box to confirm you want to delete the integration.
4. Click Delete Integration.

Elastic schema mapping