Skip to main content

Elastic Security​

Creating the Service Connector​

Before configuring Elastic Security you must create the Elastic Security service connector in ActiveEye. In order to do so, you must do the following:

  1. Log into ActiveEye
  2. In the lefthand menu, navigate to Admin -> Service Connectors
  3. Click on Add Connector
  4. Scroll down to the Security Management category, then click Add Connection under Elastic Security
  5. Under Display Name, add a meaningful name, then select the appropriate Account Priority from the dropdown
  6. Click Add
  7. In the redirected page, take note of the Event Ingestion URL for configuring Elastic Security

Configuring Elastic Security​

In order to configure Elastic Security to send its logs to ActiveEye, you must do the following:

  1. Log into Kibana
  2. In the lefthand menu, navigate to Management -> Stack Management -> Rules and Connectors
  3. Click the Connectors tab, then click Create Connector
  4. Select Webhook as the Connector Type
  5. Add the connector name and set method to POST
  6. Add the Event Ingestion URL generated when setting up the service connector, and add the HTTP header "key"
  7. After, navigate to Alerts under the Elastic Security tab
  8. Click Manage detection rules and click the desired Detection Rule
  9. Click Edit rule settings and navigate to the Actions tab
  10. Select the Actions frequency as "on each execution" and select the connector type Webhook
  11. Select the Webhook connector name made previously (e.g. ActiveEye API) and paste the following JSON without modification:
{"alertId": "{{alertId}}", "alertName": "{{alertName}}", "context.alerts": "{{context.alerts}}", "context.rule.description": "{{context.rule.description}}", "context.rule.severity":"{{context.rule.severity}}", "date":"{{date}}", "context.results_link": "{{{context.results_link}}}", "state.signals_count": "{{state.signals_count}}", "tags": "{{tags}}"}