Elastic Security Integration

Create API Key

Create an API key in Elasticsearch with index write permissions.

                # Create API key via Kibana Dev Tools
POST /_security/api_key
{
  "name": "dbaudit-integration",
  "role_descriptors": {
    "dbaudit_writer": {
      "cluster": ["monitor"],
      "index": [
        {
          "names": ["dbaudit-*"],
          "privileges": ["create_index", "index", "write", "manage"]
        }
      ]
    }
  }
}

# Response:
{
  "id": "VuaCfGcBCdbkQm-e5aOx",
  "name": "dbaudit-integration",
  "api_key": "ui2lp2axTNmsyakw9tvNnw"
}

# Use as: "VuaCfGcBCdbkQm-e5aOx:ui2lp2axTNmsyakw9tvNnw"
              

Create Index Template (Optional)

Create an index template with proper mappings for DB Audit events.

                # Create index template for DB Audit events
PUT /_index_template/dbaudit-events
{
  "index_patterns": ["dbaudit-events-*"],
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 1,
      "index.lifecycle.name": "dbaudit-policy"
    },
    "mappings": {
      "properties": {
        "@timestamp": { "type": "date" },
        "event.kind": { "type": "keyword" },
        "event.category": { "type": "keyword" },
        "event.action": { "type": "keyword" },
        "event.outcome": { "type": "keyword" },
        "user.name": { "type": "keyword" },
        "source.ip": { "type": "ip" },
        "database.name": { "type": "keyword" },
        "database.type": { "type": "keyword" },
        "query.statement": { "type": "text" },
        "query.rows_affected": { "type": "long" }
      }
    }
  }
}
              

Configure in DB Audit

Add the Elastic Security integration in the DB Audit dashboard.

1. Navigate to Integrations → SIEM in DB Audit
2. Click Add SIEM Integration
3. Select Elastic Security as the provider
4. Enter your Elasticsearch hosts and API key (or Cloud ID)
5. Configure index pattern and ECS settings
6. Select event types to forward
7. Test the connection and save

Create Detection Rules (Optional)

Create detection rules in Elastic Security for database threats.

                # Elastic Security Detection Rule
# Create via Security → Detections → Rules → Create new rule

{
  "name": "Suspicious Database Data Exfiltration",
  "description": "Detects queries returning large amounts of data",
  "risk_score": 73,
  "severity": "high",
  "type": "query",
  "query": "event.action:select AND query.rows_affected:>=10000",
  "index": ["dbaudit-events-*"],
  "interval": "5m",
  "from": "now-6m",
  "tags": ["Database", "Data Exfiltration"],
  "threat": [
    {
      "framework": "MITRE ATT&CK",
      "tactic": {
        "id": "TA0010",
        "name": "Exfiltration"
      }
    }
  ]
}