Smart SOAR Integration

D3 Smart SOAR integrates with Elasticsearch, the search and analytics engine at the heart of the Elastic stack. Elasticsearch aggregates and stores data and logs for careful monitoring and detailed analysis. Predefined queries in Elasticsearch can generate alerts that are escalated to Smart SOAR for investigation of possible security concerns. Smart SOAR can also enrich events from other sources by querying Elasticsearch for additional context.

Integration features

Enrich security alerts with Elasticsearch data from across the environment
Automate queries from Smart SOAR to Elasticsearch to fill gaps in investigations
Rapidly orchestrate incident response across integrated tools via codeless playbooks
Investigate security incidents via D3’s built-in MITRE ATT&CK TTP correlations

Key Use Case


Alert Escalation and Enrichment

By combining Elasticsearch for search and analytics with D3 Smart SOAR for incident enrichment and response, you can automatically escalate real threats to incident status in Smart SOAR and assess their criticality through data enrichment and MITRE ATT&CK matrix correlation. Predefined Elasticsearch queries can be used as the conditions to trigger an automation-powered playbook in Smart SOAR for fast and consistent triage and response. When Elasticsearch alerts trigger Smart SOAR’s automated workflows and full-lifecycle playbooks for incident response, analysts no longer have to manually coordinate dozens of triage and response tasks. Response occurs in seconds, not hours.

Anomaly Management and Automated Incident Response

Elastic's analytics are designed to detect any network anomalies that may occur. When an irregular activity is identified, it triggers an incident response in Smart SOAR, which then evaluates the activity against both internal and external threat intelligence tools to ensure that necessary remediation actions are taken. These actions may include network isolation and updating firewall rules. By combining Elastic's detection capabilities with D3's automated response, organizations can ensure quick and effective security incident management.

Meet Our Friends

Our Connected SOAR Security Alliance brings hundreds of vendors together, allowing customers to benefit from our deep industry relationships and fully vendor-agnostic, independent SOAR platform.

X Elastic Integration

Get Started with D3 Security

One platform to stop alert overwhelm. Transform how your security team works, by focusing its resources on real threats.