SOCRadar Launches Elastic Integration for Investigating External Threat Alarms in Kibana
Summary
SOCRadar Alerts is now available in Elastic Security, bringing external-threat alarms into Kibana with ECS-mapped fields, configurable polling, historical backfill and a built-in dashboard.
Key points
- The SOCRadar Alerts integration (v0.1.0) collects alarms through the SOCRadar API on a configurable polling interval and can backfill recent alarms.
- Alarms include severity, status, type, affected assets, related entities and details, mapped to the Elastic Common Schema.
- The integration’s Kibana dashboard displays severity distribution, alarm categories, volume trends and recent incidents.
- Analysts can correlate alarms with Elastic telemetry, investigate underlying alarm documents and open cases in Kibana.
- Covered findings include impersonating domains, leaked credentials, exposed data, risky external assets, vulnerability intelligence and threat-actor or campaign references.
- SOCRadar also offers Elastic integrations for Threat Feeds and Threat Intelligence (TAXII).
Article Details
- Event Type
- SOCRadar announced the SOCRadar Alerts integration for Elastic Security.
- Impact
- The integration collects SOCRadar alarms through its API and maps alarm details, severity, status, affected assets, and related entities to ECS in Elastic. It includes a Kibana dashboard and lets analysts investigate and correlate external threat alarms with other telemetry and open cases in the same workspace.
Vendors
Products
Elastic SecurityThe new SOCRadar Alerts integration (v0.1.0) is available natively in Elastic Security through the Elastic integrations catalog.KibanaDetections, logs, cases and dashboards all live in Kibana, and your analysts have built their muscle memory around it.SOCRadar AlertsThe SOCRadar Alerts integration ships with a built-in Kibana dashboard: severity distribution, alarm categories, volume trends and recent incidents.