Elastic Kibana 8 - Security is a powerful tool for visualizing and analyzing security data, providing advanced threat detection and response capabilities.

Elastic Kibana 8 is a powerful data visualization and exploration tool used for log and time-series analytics, application monitoring, and operational intelligence use cases. This connector enables seamless integration with Swimlane Turbine, allowing users to automate security operations by creating and managing cases, detection rules, and exceptions directly from the Swimlane platform. The integration enhances the ability to respond to security incidents efficiently by leveraging Kibana's robust capabilities in data analysis and visualization, thus providing a comprehensive security management solution.

Before you can use the Elastic Kibana 8 - Security connector for Turbine, you'll need access to the Elastic Kibana API. This requires the following:

This connector provides the following capabilities:

In order to use this connector with Elastic Cloud you must provide the following inputs in the configured asset:

If you generated a ApiKey from within the Elastic Cloud portal you may have need run the following commands to generate the correct ApiKey:

Which will result in a value similar to the following:

Then take this value and decode it again

This will result in the correct ApiKey.

In order to use this connector with an on-premises Elasticsearch and Kibana, you must provide the following inputs in the configured asset:

For more information on authentication, click here.

Within the asset if you receive an error about the host, please remove any trailing slashes from the host string.

This connector was last tested against product version: Elastic Kibana 8.10

Authenticates using an API Key

Authenticates using username and password.

Add a comment or alert to an existing case in Elastic Kibana 8 - Security by supplying the case ID and comment type.

{"json_body":{"alertId":["293f1bc0-74f6-11ea-b83a-553aecdb28b6"],"comment":"adding a test comment","index":[".siem-signals"],"owner":"cases","rule":{"id":"94d80550-aaf4-11ec-985f-97e55adae8b9","name":"security_rule"},"type":"user"},"path_parameters":{"case_id":"93f1bc0-74f6-11ea-b83a-553aecdb28b6"}}

{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Encoding":"gzip","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 29 Sep 2023 06:22:52 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Polic...

Generate a blocklist container in Elastic Kibana 8 - Security using specified description, name, list ID, type, and namespace.

{"json_body":{"description":"Excludes Linux trusted processes","name":"Linux process exceptions","list_id":"endpoint_blocklist","type":"endpoint","namespace_type":"agnostic","tags":["linux","processes"]}}

{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"486","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 09:15:40 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...

Generate a new blocklist entry in Elastic Kibana 8 - Security using details like description, entries, list ID, and more.

{"json_body":{"comments":[],"description":"some description about this entry","entries":[{"field":"file.path","value":["c:/path/to/file.exe","c:/path/to/file2.exe"],"type":"match_any","operator":"included"}],"list_id":"endpoint_blocklists","name":"Linux process exceptions","namespace_type":"agnostic","os_types":["macos"],"tags":["policy:all"],"type":"simple"}}

{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"649","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Thu, 05 Oct 2023 09:23:57 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...

Create a new case in Elastic Kibana 8 - Security with details such as connector, description, owner, settings, tags, and title.

{"json_body":{"assignees":[{"uid":""}],"description":"A case description.","title":"Case title 1","tags":["tag 1"],"connector":{"id":"131d4448-abe0-4789-939d-8ef60680b498","name":"My connector","type":".jira","fields":{"issueType":"10006","priority":"High","parent":null,"caseId":""}},"settings":{"syncAlerts":true},"owner":"cases","severity":"critical"}}

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"description":"A case description.","title":"Case title 1","tags":["tag 1"],"settings":{"syncAlerts":true},"owner":"cases","category":null,"assignees":[],"connector":{"id":"131d4448-abe0-4789-939d-8ef60680b498","type":".jira","fields":{},"name":"My connector"},"severity":"low","status":"open","duration":null,"closed_at":null,"closed_by":null,"created_at":"2023-09-29T06:09:04.418Z","created_by":{"username":"elastic","full_name":n...

Establish A New Connector In Elastic Kibana 8 - Security, Requiring A Name, Type ID, Configuration Details, And Secrets.

{"json_body":{"name":"my-swimlane-connector","connector_type_id":".swimlane","config":{"connectorType":"all","mappings":{"alertIdConfig":{"id":"b6fst","name":"Alert Name","key":"alert-name","fieldType":"text"},"caseIdConfig":{"id":"b6fst","name":"Alert Name","key":"alert-name","fieldType":"text"},"caseNameConfig":{"id":"b6fst","name":"Alert Name","key":"alert-name","fieldType":"text"},"commentsConfig":{"id":"b6fst","name":"Alert Name","key":"alert-name","fieldType":"text"},"descriptionConfig":{"id":"b6fst","name":"Alert Name","key":"alert-name","fieldType":"text"},"ruleNameConfig":{"id":"b6fst","name":"Alert Name","key":"alert-name","fieldType":"text"},"severityConfig":{"id":"b6fst","name":"Alert Name","key":"alert-name","fieldType":"text"}},"appId":"myAppID","apiUrl":"https://myswimlaneinstance.com"},"secrets":{"apiToken":"myToken"}}}

{"status_code":200,"response_headers":{"Cache-Control":"private, no-cache, no-store, must-revalidate","Content-Length":"948","Content-Security-Policy":"script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'","Content-Type":"application/json; charset=utf-8","Cross-Origin-Opener-Policy":"same-origin","Date":"Fri, 29 Sep 2023 17:21:03 GMT","Kbn-License-Sig":"32d677b996af4c7f688b50f4fe5a1f16e20a7342641acb3e8f21395ff4e79519","Kbn-Name":"instance-0000000000","Permissions-Policy":...

Generate alerts in Elastic Kibana 8 by creating an event correlation rule with specified description, name, risk score, severity, and language.

{"json_body":{"rule_id":"eql-outbound-rundll32-connections","risk_score":21,"description":"Unusual rundll32.exe network connection","name":"rundll32.exe network connection","severity":"low","tags":["EQL","Windows","rundll32.exe"],"type":"eql","language":"eql","query":"sequence by process.entity_id with maxspan=2h [process where event.type in (\"start\", \"process_started\") and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\") and ((process.args == \"rundll32.exe\" and process.args_count == 1) or (process.args != \"rundll32.exe\" and process.args_count == 0))] [network where event.type == \"connection\" and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\")]"}}