Elastic Security

​

Ingestion Endpoint

POST /v1/ingest/elastic

​

Setting Up the Webhook

​

Detection Rule Webhook Action

1. In Kibana, go to Security → Rules
2. Edit the detection rule you want to forward
3. Under Actions, add a Webhook action
4. Configure:
   • URL: https://your-calseta-host/v1/ingest/elastic
   • Method: POST
   • Headers: Authorization: Bearer cai_your_api_key
   • Body: Use the default alert JSON template

​

Connector Setup

1. Go to Stack Management → Connectors
2. Create a Webhook connector
3. Set the URL and authentication headers
4. Reference this connector in your detection rule actions

​

Payload Format

​

Severity Mapping

​

Indicator Extraction

• source.ip, destination.ip — network indicators
• user.name, user.email — account indicators
• file.hash.md5, file.hash.sha1, file.hash.sha256 — file hash indicators
• url.full, url.domain — URL and domain indicators
• Custom field mappings against raw_payload

​

Webhook Signature Verification

​

Example Payload

{
  "@timestamp": "2025-01-15T10:28:00Z",
  "signal": {
    "rule": {
      "name": "Brute Force Login Attempts",
      "severity": "high",
      "threat": [
        {
          "framework": "MITRE ATT&CK",
          "tactic": { "id": "TA0006", "name": "Credential Access" },
          "technique": [{ "id": "T1110", "name": "Brute Force" }]
        }
      ]
    }
  },
  "source": { "ip": "203.0.113.42" },
  "user": { "name": "admin" },
  "event": { "action": "authentication_failed", "outcome": "failure" }
}

​

API Reference