Elastic Security
Leak events are written into your Elasticsearch index in ECS format.
How it works
The connection uses an Elasticsearch API key. Documents are written to the selected index. Field names follow the Elastic Common Schema, so Elastic Security’s built-in views and detection engine recognise the events without extra mapping.
Delivery is one-way. No search is run on the cluster and no other index is read.
Fields delivered
| Field | Content |
|---|---|
@timestamp | When the event was written |
event.kind | alert |
event.category | ["threat"] |
event.severity | critical · high · medium · low |
event.id | Event identifier |
message | Title and summary |
The leaked value itself is not in the document.
Limits
The key is created with write permission on the target index only.
The index name follows Elastic’s rules: lowercase.
Turning the connection off stops writing and deletes the key; documents already written stay in the index.
Setup
The setup steps are in the panel, on the integration’s own screen. What to do on the provider side and which value goes where is written there.