Stellar SIEM is a robust platform that provides advanced threat detection and security analytics to protect enterprise networks.

Stellar SIEM is a comprehensive security information and event management platform designed to enhance threat detection and response capabilities. By integrating with Swimlane Turbine, users can automate security incident management tasks such as case creation, alert retrieval, and Elasticsearch queries. This integration empowers security teams to streamline operations, improve incident response times, and gain deeper insights into security events, all without the need for extensive coding.

The alerts endpoint returns at most 50 results per request; use skip and limit for pagination (e.g. second page: skip=10&limit=10). The Execute Elasticsearch Job action may require custom code depending on query structure.

This Stellar SIEM connector uses the Stellar Cyber public API (v1). Refer to Stellar Cyber API documentation for version-specific details.

Before you can use the Stellar SIEM connector for Turbine, you'll need access to the Stellar SIEM API. This requires the following:

Stellar Cyber only accepts HTTP Basic credentials on /connect/api/v1/access_token; every other endpoint requires a JWT bearer token. The connector handles this transparently in connector/src/runner_override.py, which overrides the framework's http_basic auth handler. On every action invocation it:

From there the framework's default action runner issues the actual API call with the bearer token already on the session, so every action - including Execute Elasticsearch Job - works against the customer's http_basic asset without per-action customization. JWTs expire after 10 minutes; a new one is minted on every action invocation.

This Stellar SIEM connector provides the following capabilities:

Returns a list of cases with optional pagination and filtering (limit, offset, tenantid, sort, order, status, min_score). Maximum 500 cases per request.

Stellar Cyber's documentation for this action can be found here.

Retrieves case scores for a given case ID.

Stellar Cyber's documentation for this action can be found here.

Retrieves paginated alerts for the given case. Use the path parameter Case ID (id) and the query parameters Skip and Limit (maximum 50 per request). Response includes data.docs with alert documents.

Stellar Cyber's documentation for this action can be found here (see Cases → alerts endpoint).

Performs an Elasticsearch DSL query on a specified index via /connect/api/data/{index}/_search. Only available to Super Admin users with root scope (API key from Generate New Token on System | ORGANIZATION MANAGEMENT | Users); not available for scoped API keys. Use path_parameters.index (e.g. aella-eventsummary-*, aella-ser-*) and json_body for the query DSL.

This action uses the framework's default HTTP runner. When the asset is HTTP Basic Authentication the bearer token is minted by the shared runner_override.http_basic() hook (see the Authentication Methods section above); when the asset is HTTP Bearer Authentication the supplied token is used directly.

Stellar Cyber's documentation for this action can be found here.

Returns a list of connectors in the Stellar Cyber instance.

Stellar Cyber's documentation for this action can be found here.

Returns a list of tenants in the Stellar Cyber instance.

Stellar Cyber's documentation for this action can be found here.

Creates a new connector in the Stellar Cyber instance. Send the connector definition in the JSON body.

Stellar Cyber's documentation for this action can be found here.

Returns a list of users in the Stellar Cyber instance.

Stellar Cyber's documentation for this action can be found here.

Adds a comment to an existing case. Provide the case ID in the path and the comment payload in the JSON body.

Stellar Cyber's documentation for this action can be found here.

Updates an existing case (status, assignee, tags, etc.). Provide the case ID in the path and the update payload in the JSON body.

Stellar Cyber's documentation for this action can be found here.

Authenticates against the Stellar Cyber API with username and password.

Authenticates using bearer token such as a JWT, etc.

Add a comment to a specified case in Stellar SIEM using the case ID and a comment string. This action requires path parameters and a JSON body.

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"parameters":{},"comment":"string"}

{"data":{"comment":"string","_id":"string","case_id":"string","created_at":123,"modified_at":123,"user":"string"}}

Create a connector configuration in Stellar SIEM using POST /connect/api/v1/connector with query parameters and JSON body.

{"parameters":{"update_profile":true,"profile":"Default"},"cust_id":"string","name":"Example Name","type":"string","category":"string","is_collect":true,"is_respond":true,"run_on":"string","conf":"string","filter_list":["string"],"advanced_setting":true}

Perform an Elasticsearch DSL query on a specified index in Stellar SIEM via /connect/api/data. Requires Super Admin and root scope access with a new token.

{"path_parameters":{"index":"string"},"parameters":{}}

{}

Retrieve the case score activities of a given case in Stellar SIEM, returning a list of score activities with reasons and associated alerts. Requires the case ID as a path parameter.

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

{"data":[]}

Retrieve a list of existing cases in Stellar SIEM with optional filters and pagination.

{"parameters":{"tenantid":"string","cust_id":"string","name":"Example Name","NOT~name":"Example Name","ticket_id":123,"NOT~ticket_id":123,"FROM~ticket_id":123,"TO~ticket_id":123,"score":123,"NOT~score":123,"FROM~score":123,"TO~score":123,"size":123,"NOT~size":123,"FROM~size":123,"TO~size":123,"status":"active","NOT~status":"active","severity":"string","NOT~severity":"string","modified_by":"string","NOT~modified_by":"string","modified_at":123,"NOT~modified_at":123,"FROM~modified_at":123,"TO~modified_at":123,"created_by":"string","NOT~created_by":"string","created_at":123,"NOT~created_at":123,"FROM~created_at":123,"TO~created_at":123,"tags":"string","NOT~tags":"string","assignee":"string","NOT~assignee":"string","event_id":"string","event_index":"string","min_score":123,"min_size_auto":123,"search":"string","queue":"string","skip":123,"limit":123,"sort":"string","order":"string","include_summary":true,"include_details":true,"format_summary":true}}

{"data":{"cases":[{}],"total":123}}

Retrieve a list of configured connectors in Stellar SIEM, optionally filtered by tenant using cust_id.

{"parameters":{"cust_id":"string"}}

{"total":123,"connectors":[]}

Retrieve the list of existing tenants in Stellar SIEM with optional query fields for specific data inclusion.

{"path_parameters":{},"parameters":{"fields":"string"}}

{"data":[]}

Retrieve the list of existing users in Stellar SIEM with an optional cust_id query to filter the results.

{"path_parameters":{},"parameters":{"cust_id":"string"}}

{"data":[]}

Retrieve a specified range of alerts for a case in Stellar SIEM using the case ID, with options to skip and set a limit up to 50 alerts per request.

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"parameters":{"skip":123,"limit":123}}

{"status_code":200,"reason":"OK","json_body":{"data":{"docs":[]}}}

Update a specific case in Stellar SIEM using its ID with details like name, severity, status, assignee, tags, and resolution.

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"parameters":{},"name":"Example Name","severity":"string","status":"active","assignee":"string","tags":{"delete":["string"],"add":["string"]},"update_alerts":true,"resolution":"string"}

{"data":{"_id":"string","acknowledged":123,"assignee":"string","closed":123,"created_at":123,"created_by":"string","cust_id":"string","insyncs":[{}],"modified_at":123,"modified_by":"string","name":"Example Name","score":123,"size":123,"status":"active","resolution":"string"}}