Elasticsearch v1.4.8

Search for and analyze data in real time. Supports version 6 and later.

Author:: Cortex XSOAR
Support:: xsoar
URL:: https://www.paloaltonetworks.com/cortex
Default data source:: Elasticsearch v2

agentixcloud_runtime_securityxsiamEDRcloudAttack Surface Managementcloud_postureexposure_management

Database

Classifiers (1)

Elasticsearch - Incoming Mapper

Incident fields (6)

Elasticsearch Event info
Elasticsearch Host
Elasticsearch Machine
Elasticsearch Source
Elasticsearch Timestamp
Elasticsearch index

Incident types (1)

Elasticsearch

Integrations (2)

Elasticsearch v2
ElasticsearchEventCollector

README

Elasticsearch is the distributed search and analytics engine at the heart of the Elastic Stack and where the indexing, search, and analysis magic happens.
Elasticsearch offers speed and flexibility to handle data in a wide variety of use cases.

What does this pack do?

This pack provides an integration with the Elasticsearch API and allows you to

Query Elasticsearch instances using DSL, EQL and Lucene syntaxes.
Search an index in Elasticsearch
Index a document into an Elastisearch index.

In addition, you can fetch incidents with predefined query.