Elastic SIEM Integration¶

Elastic Security (formerly Elastic SIEM) integrates with Parapet Security through the webhook connector. This guide covers Elastic 8.x configuration.

Prerequisites¶

• Elastic Stack 8.0 or later
• Kibana access with Security feature enabled
• Connector management permissions
• Your Parapet Security webhook URL and token

Quick Setup¶

Step 1: Get Your Credentials¶

1. Log in to app.parapetsecurity.com
2. Go to Settings → Service Tokens
3. Click Generate New Token
4. Save both:
   • Webhook URL: https://webhook-{region}.parapetsecurity.com/webhook/{tenant-id}
   • Service Token: pst_... (shown only once)

Step 2: Create Webhook Connector¶

1. In Kibana, go to Stack Management → Connectors
2. Click Create connector
3. Select Webhook
4. Configure the connector:

1. Add the authentication header:
2. Header key: Authorization

3. Header value: Bearer pst_YOUR_TOKEN_HERE

4. Click Save & test

Step 3: Configure Connector Body¶

Set the request body template using Mustache syntax:

{
  "source": "elastic",
  "timestamp": "{{date}}",
  "rule": {
    "id": "{{rule.id}}",
    "name": "{{rule.name}}",
    "severity": "{{rule.severity}}",
    "risk_score": "{{rule.risk_score}}"
  },
  "alert": {
    "id": "{{alert.id}}",
    "status": "{{alert.status}}"
  },
  "context": {
    "kibana_url": "{{context.alerts_url}}",
    "host": "{{context.host.name}}",
    "user": "{{context.user.name}}",
    "source_ip": "{{context.source.ip}}"
  },
  "signals": "{{context.signals}}"
}

Step 4: Attach to Detection Rules¶

1. Go to Security → Detections → Rules
2. Select a detection rule (or create one)
3. Click Edit rule settings
4. Scroll to Actions
5. Click Add action → Webhook → Parapet Security
6. Configure when to run:
7. On each rule execution (recommended)

8. Or specific conditions

9. Save the rule

Step 5: Test the Integration¶

1. Trigger a test detection (or wait for a real one)
2. Go to Security → Alerts to see the Elastic alert
3. Check your Parapet Dashboard for the triaged alert

Configuration Options¶

Action Frequency¶

Control how often actions run:

Rule-Specific Configuration¶

Different rules can have different configurations:

Frequency: On each rule execution
Throttle: No throttling

Frequency: Hourly summary
Throttle: 1 hour

No webhook action attached

Custom Fields¶

Include additional context in your alerts:

{
  "source": "elastic",
  "timestamp": "{{date}}",
  "rule": {
    "name": "{{rule.name}}",
    "severity": "{{rule.severity}}",
    "tags": ["{{#rule.tags}}{{.}}{{/rule.tags}}"]
  },
  "alert": {
    "id": "{{alert.id}}",
    "original_time": "{{alert.original_time}}"
  },
  "host": {
    "name": "{{host.name}}",
    "os": "{{host.os.name}}",
    "ip": ["{{#host.ip}}{{.}}{{/host.ip}}"]
  },
  "user": {
    "name": "{{user.name}}",
    "domain": "{{user.domain}}"
  },
  "process": {
    "name": "{{process.name}}",
    "pid": "{{process.pid}}",
    "command_line": "{{process.command_line}}"
  },
  "network": {
    "direction": "{{network.direction}}",
    "protocol": "{{network.protocol}}"
  },
  "source": {
    "ip": "{{source.ip}}",
    "port": "{{source.port}}",
    "geo": {
      "country": "{{source.geo.country_name}}"
    }
  },
  "destination": {
    "ip": "{{destination.ip}}",
    "port": "{{destination.port}}"
  }
}

Sample Alert Payload¶

Here's what Elastic sends to Parapet Security:

{
  "source": "elastic",
  "timestamp": "2026-01-28T15:30:00.000Z",
  "rule": {
    "id": "d8e8fca2-dc0f-4c4e-a9d7-3c9e7c8b4a2d",
    "name": "Suspicious PowerShell Execution",
    "severity": "high",
    "risk_score": 75
  },
  "alert": {
    "id": "abc123",
    "status": "open"
  },
  "context": {
    "host": "workstation-42",
    "user": "jsmith",
    "source_ip": "192.168.1.50"
  }
}

Parapet Security's AI normalizes this to extract:

• Severity: High (from rule severity)
• Category: Endpoint/Execution
• Host: workstation-42
• User: jsmith
• MITRE Mapping: Based on rule content

Troubleshooting¶

Connector Test Fails¶

1. Verify URL format:

   https://webhook-us.parapetsecurity.com/webhook/YOUR-TENANT-ID
   

2. Check authorization header:

3. Must be exactly: Authorization: Bearer pst_...

4. No extra spaces

5. Test with curl:

   curl -X POST "https://webhook-us.parapetsecurity.com/webhook/YOUR-TENANT-ID" \
     -H "Authorization: Bearer pst_YOUR_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{"source": "elastic", "test": true}'
   

Alerts Not Appearing¶

1. Check rule is enabled: Security → Rules → Verify rule status is "Enabled"

2. Verify action is attached: Rule Settings → Actions → Webhook should show "Parapet Security"

3. Check Kibana logs: Stack Management → Logs → Search for connector errors

Missing Fields in Payload¶

If fields show as {{field.name}} instead of values:

1. Ensure the field exists in your data
2. Check ECS field names match your mapping
3. Use conditional rendering: {{#field}}{{field}}{{/field}}

Rate Limiting¶

If you see 429 errors:

1. Add throttling to your rules
2. Reduce rule frequency
3. Upgrade your Parapet Security plan

Advanced: Bulk Alert Forwarding¶

For high-volume environments, use Elastic Alerts summary:

{
  "source": "elastic",
  "timestamp": "{{date}}",
  "summary": {
    "total_alerts": "{{context.alerts.length}}",
    "rule_name": "{{rule.name}}"
  },
  "alerts": [
    {{#context.alerts}}
    {
      "id": "{{_id}}",
      "severity": "{{kibana.alert.severity}}",
      "host": "{{host.name}}"
    }{{^last}},{{/last}}
    {{/context.alerts}}
  ]
}

Integration with Elastic Agent¶

If using Elastic Agent with Fleet:

1. Detection rules apply to data from all agents
2. Webhook connector sends aggregated alerts
3. Host information included from agent metadata

Next Steps¶

• Configure Slack notifications for real-time alerts
• Set up alert filters to focus on what matters
• Understand AI triage results