| Name |
Enter a name for the sighting search configuration. |
| Vendor Name |
Name of the vendor. The details of the selected vendor is populated by default. For example, Elasticsearch. |
| Integration Type |
Type of integration that you selected. For example, Threat Lookup. |
| Description |
Enter the description for the Elasticsearch integration. For example, The Elasticsearch enrichment integration aids in the investigation of an observable by supporting the querying of logs in your
Elasticsearch deployment. |
| Integration Configuration |
| Elasticsearch API Base URL |
The base URL you acquired from the Elasticsearch site. |
| Kibana Base URL |
The Kibana Base URL. [Optional] Links to a Kibana instance, when available. |
| Username |
Your Intel Elasticsearch username. |
| Password |
Your Intel Elasticsearch password. |
| Elasticsearch Index |
The Elasticsearch index. These in turn will hold documents that are unique to each index. Indices are identified by lowercase names that refer to actions that are performed actions (such as
searching and deleting). |
| Date range field |
The timestamp of the configuration. |
| Max Rows |
The maximum number of rows you want to search. |
| Earliest Result (days) |
The earliest results you want to see in number of days. |
| Include raw data samples in search results |
Select this to include samples of raw data in your sightings search results. The amount of data returned depends on your setting in the number of rows of raw data property in Security Incident Response properties. |
| MID Server |
Select Any to use any active MID Server, or select a specific MID Server name. |