Elastic provides the world’s leading open-source search and analytics solution. Its technology allows users to store, search, and analyze big volumes of data in near-real-time, and underlies the search functions of many applications.
Download Integration Guide
Smart SOAR Integration
D3 Smart SOAR integrates with Elasticsearch, the search and analytics engine at the heart of the Elastic stack. Elasticsearch aggregates and stores data and logs for careful monitoring and detailed analysis. Predefined queries in Elasticsearch can generate alerts that are escalated to Smart SOAR for investigation of possible security concerns. Smart SOAR can also enrich events from other sources by querying Elasticsearch for additional context.
Enrich security alerts with Elasticsearch data from across the environment
Automate queries from Smart SOAR to Elasticsearch to fill gaps in investigations
Rapidly orchestrate incident response across integrated tools via codeless playbooks
Investigate security incidents via D3’s built-in MITRE ATT&CK TTP correlations
Key Use Case
Alert Escalation and Enrichment
By combining Elasticsearch for search and analytics with D3 Smart SOAR for incident enrichment and response, you can automatically escalate real threats to incident status in Smart SOAR and assess their criticality through data enrichment and MITRE ATT&CK matrix correlation. Predefined Elasticsearch queries can be used as the conditions to trigger an automation-powered playbook in Smart SOAR for fast and consistent triage and response. When Elasticsearch alerts trigger Smart SOAR’s automated workflows and full-lifecycle playbooks for incident response, analysts no longer have to manually coordinate dozens of triage and response tasks. Response occurs in seconds, not hours.
Anomaly Management and Automated Incident Response
Elastic's analytics are designed to detect any network anomalies that may occur. When an irregular activity is identified, it triggers an incident response in Smart SOAR, which then evaluates the activity against both internal and external threat intelligence tools to ensure that necessary remediation actions are taken. These actions may include network isolation and updating firewall rules. By combining Elastic's detection capabilities with D3's automated response, organizations can ensure quick and effective security incident management.
Meet Our Friends
Our Connected SOAR Security Alliance brings hundreds of vendors together, allowing customers to benefit from our deep industry relationships and fully vendor-agnostic, independent SOAR platform.