Skip to main content

Elastic Security​

Creating the Service Connector​

Before configuring Elastic Security you must create the Elastic Security service connector in ActiveEye. In order to do so, you must do the following:

  1. Log into ActiveEye
  2. In the lefthand menu, navigate to Admin -> Service Connectors
  3. Click on Add Connector
  4. Scroll down to the Security Management category, then click Add Connection under Elastic Security
  5. Under Display Name, add a meaningful name, then select the appropriate Account Priority from the dropdown
  6. Click Add
  7. On the redirected page, copy the Event Ingestion URL and Event Ingestion Token for configuring Elastic Security

Configuring Elastic Security​

In order to configure Elastic Security to send its logs to ActiveEye, you must do the following:

  1. Log into Kibana
  2. In the lefthand menu, navigate to Management -> Stack Management -> Rules and Connectors
  3. Click the Connectors tab, then click Create Connector
  4. Select Webhook as the Connector Type
  5. Add the connector name and set method to POST
  6. Enter the Event Ingestion URL generated when setting up the service connector. Add the HTTP header Authorization with the value Bearer <token>, replacing <token> with the Event Ingestion Token. If your configuration does not support custom headers, append the token to the URL as a query parameter: <Event Ingestion URL>?api-key=<token>. If the URL already contains a query string, use &api-key=<token> instead.
  7. After, navigate to Alerts under the Elastic Security tab
  8. Click Manage detection rules and click the desired Detection Rule
  9. Click Edit rule settings and navigate to the Actions tab
  10. Select the Actions frequency as "on each execution" and select the connector type Webhook
  11. Select the Webhook connector name made previously (e.g. ActiveEye API) and paste the following JSON without modification:
{"alertId": "{{alertId}}", "alertName": "{{alertName}}", "context.alerts": "{{context.alerts}}", "context.rule.description": "{{context.rule.description}}", "context.rule.severity":"{{context.rule.severity}}", "date":"{{date}}", "context.results_link": "{{{context.results_link}}}", "state.signals_count": "{{state.signals_count}}", "tags": "{{tags}}"}