SIEM
Elastic
TechWatchAlert security events in an Elasticsearch data stream, with ECS fields.
What the connector does
TechWatchAlert indexes your organization's security events in an Elasticsearch data stream (logs-techwatchalert-default by default), on Elastic Cloud or your own cluster, with ECS fields. An event sent again is never indexed twice.
What comes into TechWatchAlert
- Detected vulnerabilities, tier and status changes, reported exploitation, reopened cases and verified fixes
- Machines that became exposed or were fixed, compliance and external attack surface findings
- Optionally, the actions in your organization's audit log
- Documents with ECS fields, ready for your dashboards and detection rules
Setup
- In Kibana, create an API key limited to the “create_doc” and “auto_configure” privileges on logs-techwatchalert-*
- In Organization settings › Security › SIEM, choose Elastic and enter the Elasticsearch address, the data stream and the key
- Choose the events to send, then “Test and save”
In the same family
Syslog TLS (CEF or JSON)TechWatchAlert security events in your syslog collector, encrypted over TLS, in CEF or JSON.View connector →SplunkTechWatchAlert security events in Splunk through the HTTP Event Collector, ready to correlate.View connector →Microsoft SentinelTechWatchAlert security events in a table of your Log Analytics workspace, queryable in KQL.View connector →
Connectors
Plug in your tools in minutes
Start with a repository, a fleet or a scan report: your first targeted alerts arrive with the first sync.
Free plan, no credit card · hosted in France