[Marketplace Contribution] Elastic Security for SIEM

[xsoar-bot]

Status

• In Progress
• Ready
• In Hold - (Reason for hold)

Contributor

@whsmith1223

Description

This pack allows for using Elastic Security for SIEM for security operations management. It also allows for searching Elastic logs.

Notes

These contributions help to boost the severe lack of SIEM capabilities with the Elasticsearch v2 integration. By adding support for Kibana API commands, users can integrate into case management and much more than simple log searching that exists today.

Auto-Generated Documentation Requiring Modification

• Packs/ElasticSecurityForSIEM/Integrations/ElasticSecurityForSIEM/README.md

Video Link

Short demo video of the Pack usage. Speeds up the review. Optional but recommended. Use a video sharing service such as Google Drive or YouTube.

relates: https://jira-dc.paloaltonetworks.com/browse/CIAC-16312

[content-bot]

Thank you for your contribution. Your generosity and caring are unrivaled! Rest assured - our content wizard @kamalq97 will very shortly look over your proposed changes.
For your convenience, here is a link to the contributions SLAs document.

[content-bot]

Thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution, please ask the reviewer to update your information in the pack contributors file. See more information here link

[content-bot]

🤖 AI-Powered Code Review Available

Hi @kamalq97, you can leverage AI-powered code review to assist with this PR!

Available Commands:

• @marketplace-ai-reviewer start review - Initiate a full AI code review
• @marketplace-ai-reviewer re-review - Incremental review for new commits

[barryyosi-panw]

Hi @whsmith1223 before I start reviewing your contribution, I'd ask you to rename the pack to CommunityElasticsearch to reflect its purpose as a complementary pack for the XSOAR supported one.

In addition, please drop the duplicated commands from the Elasticsearch_v2 integration, otherwise it would conflict if both integrations are configured, accordingly the integration can be named just Kibana.

[whsmith1223]

Just a heads up I submitted #43781 with the proposed changes