Elastic Integrations

The Doppel integration automates the collection of security alerts from the Doppel API and ingests them into the Elastic Common Schema (ECS). This allows security teams to centralize threat monitoring, perform cross-source correlation, and visualize Doppel data within Kibana dashboards.

How it works

The integration uses the cel input to periodically poll the Doppel alerts endpoint. It employs a stateful, cursor-based polling mechanism to ensure only new or updated alerts are ingested, which minimizes API overhead and prevents data gaps.

The Imperva integration for Elastic allows you to collect and analyze logs from Imperva SecureSphere devices using Elastic Agent. It specifically supports logs in CEF (Common Event Format).

By ingesting these logs, you can monitor security events, audit database activity, and gain visibility into web application traffic. The integration parses incoming logs into the Elastic Common Schema (ECS) format for use with pre-built dashboards.

The Cyware Intel Exchange integration for Elastic allows you to collect threat intelligence data from the Cyware Intel Exchange platform using the CTIX API v3. It periodically queries the API to retrieve Indicators of Compromise (IOCs) and visualizes them in Kibana.

Collected Data

The integration populates the following dataset:

• Indicator: Fetches saved result set data for conditional IOCs via the Indicator endpoint.

Supported Use Cases

• Centralized visibility into malicious IPs, domains, URLs, and file hashes within Elastic SIEM.
• Correlation of indicator metadata (source, type, TLP markings, revocation status, etc.) for threat detection and incident triage.
• Visualizing trends and breakdowns via Kibana dashboards.

The Kubelet Stats OpenTelemetry Input Package enables the collection of Kubernetes node, pod, container, and volume metrics from the Kubelet API. It utilizes the kubeletstatsreceiver within the Elastic Distribution of OpenTelemetry (EDOT) collector.

Workflow

1. Scraping: The Kubelet Stats receiver scrapes metrics from the Kubelet API.
2. Processing: The Elastic Agent processes and enriches the collected data.
3. Indexing: Data is sent to Elasticsearch for indexing.
4. Visualization: Upon data arrival in Elasticsearch, the Kubernetes OpenTelemetry Assets Package is automatically installed, enabling dashboards.

Note: For full dashboard functionality, you may also need data from additional inputs like the Kubernetes cluster, events, and objects packages.

The Custom TCP Logs integration allows you to collect raw text-based data from any source that can establish a TCP connection. It is designed to ingest logs from third-party software or hardware into the Elastic Stack.

Key Capabilities:

• Protocol Support: Supports Syslog standards (RFC 3164 and RFC 5424), octet-counted framing (RFC 6587), and secure transport via TLS/SSL.
• Data Collection: Acts as a receiver where an Elastic Agent listens on a specified TCP port. Once received, data is processed (raw text or syslog) and forwarded to your Elastic deployment.
• Default Data Stream: Uses the tcp.generic data stream, which captures the payload in the message field along with connection metadata like source.ip and source.port.

The Common Event Format (CEF) integration for Elastic allows you to collect, parse, and normalize logs from any device or application that supports the CEF standard. It maps CEF headers and extension fields to the Elastic Common Schema (ECS), enabling centralized security monitoring, compliance auditing, and unified data analysis across diverse security vendors (e.g., firewalls, intrusion prevention systems).

Key Capabilities:

• Centralized Security Monitoring: Ingest audit and security logs into a unified platform for real-time threat detection.
• Compliance and Auditing: Collect and retain detailed logs to meet regulatory requirements.
• Enhanced Threat Intelligence: Correlate events from different sources using ECS-enriched data.
• Operational Visibility: Monitor network health, traffic, and system events.

The MongoDB Atlas integration allows you to monitor and analyze your MongoDB Atlas deployment by collecting logs and metrics. This enables comprehensive monitoring, informative visualizations for usage trends, and faster troubleshooting through automated alerts.

Key Capabilities:

• Log Collection: Monitor alert, mongod_audit, mongod_database, organization, and project logs.
• Metric Collection: Track disk, hardware, and process metrics.
• Visualization & Alerting: Use the ingested data in Kibana to create dashboards and set up alerts to minimize MTTD (Mean Time to Detect) and MTTR (Mean Time to Resolve).

The Iptables integration for Elastic collects and analyzes logs from iptables and ip6tables on Linux distributions and Ubiquiti networking equipment. It provides visibility into network traffic filtered by kernel firewalls, helping monitor allowed and denied connections.

Supported Log Sources

• Linux iptables/ip6tables: Collected via local files, systemd journal, or network syslog.
• Ubiquiti Firewalls: Collected via remote syslog forwarding.

Data Streams

• log: Records read from local host filesystems.
• udp: Syslog network logs forwarded over the network.
• journald: Log messages retrieved from the systemd journal.

The PingDirectory integration provides visibility into an enterprise-grade LDAP directory server. It collects data from PingDirectory log files (via Elastic Agent filestream input) or over the network (via UDP input), and retrieves user identity and group membership data via the SCIM v2 API (via Elastic Agent CEL input).

Collected Data Streams:

• http_access: HTTP access logs (methods, URLs, status codes, headers, processing times).
• audit: Directory change operations (add, modify, delete, rename) and metadata.
• ldap_access: LDAP connection/disconnection events, requests, results, and response times.
• user: User identity records (usernames, emails, display names, etc.) from the SCIM v2 API.
• group: Group membership records (names, members, metadata) from the SCIM v2 API.

The Salesforce integration allows you to monitor your Salesforce CRM instance using Elastic Agent. It provides operational insights, data visualization for usage trends, and proactive alerting for security and operational events.

Supported Data Streams

• login: User login activities.
• logout: User logout activities.
• apex: Apex events including ApexCallout, ApexExecution, ApexRestApi, ApexSoap, ApexTrigger, and ExternalCustomApexCallout.
• setupaudittrail: Changes made in the Salesforce organization's setup area (retains data for the last 180 days).
• aura_request: Server-side Aura framework requests from the Salesforce Lightning Experience UI (useful for record and component level access logs).

The Azure Billing Metrics integration monitors actual and future Azure spending to help optimize resource use. It collects detailed resource usage and forecast expenses for upcoming weeks.

Key Capabilities:

• Usage Details: Tracks actual expenses including subscription ID, resource group, type, and name.
• Forecast Metrics: Tracks projected expenses over the coming weeks.
• APIs Used: Leverages the Azure Consumption API for usage details and the Azure Cost Management API for forecast data.